last executing test programs: 3.337270809s ago: executing program 1 (id=10967): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x6a, 0xa, 0x0, 0xffc4, 0x3ff, 0x89, 0x10, 0x5c}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x90) setsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000040)=0x20, 0x4) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x15, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b7020000380d0000bfa30000000000000703000000feffff720af0fff8ffff1989a4f0ff00000000b7060000080000001e640000000000004504040001000000170400000c000a00b7040000ff0100006a0af2fe00000000850000001a000000b70000003f00000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb937b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c4608800000000000000005cbb5a2600"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffe49}, 0x42) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@ipv6_newnexthop={0x34, 0x68, 0x5fb9a818fb7378e9, 0x70bd2c, 0x25dfdbff, {0xa, 0x0, 0x0, 0x0, 0x4}, [@NHA_OIF={0x8, 0x5, r9}, @NHA_GATEWAY={0x14, 0x6, @in6_addr=@loopback}]}, 0x34}}, 0x4000) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@bridge_newvlan={0x24, 0x70, 0x1, 0x0, 0x25dfdbfd, {0x7, 0x0, 0x0, r7}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_RANGE={0x6, 0x2, 0x9}}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x440040c4) r10 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_TIOCOUTQ(r10, 0x5411, &(0x7f000000a080)) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r11, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000200)={0x34, r12, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000005e}, 0x0) r13 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="5c00000012006bab9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060200000800020011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$tun(r1, &(0x7f0000000980)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@generic={0x1, 0x6, "11b712", 0x0, 0x11, 0xff, @local, @private1}}}, 0x36) 3.119456831s ago: executing program 1 (id=10970): write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x10012, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x13, 0x0, &(0x7f00000001c0)) 2.660092571s ago: executing program 1 (id=10973): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000000)=0xf3, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x10, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000000000000089120e000000000095"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x63, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fffffc}, 0x94) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000200)={@private1, 0x0}, &(0x7f0000000380)=0x14) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb0c0018000000000000001800000018000000030000000b0000000000008af5ff0000006100"], &(0x7f0000000400)=""/48, 0x33, 0x30, 0x1, 0x10000, 0x10000}, 0x28) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x5, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xdd42}, [@exit, @jmp={0x5, 0x1, 0x3, 0x0, 0x5, 0x50, 0xfffffffffffffff0}]}, &(0x7f0000000540)='GPL\x00', 0x7f, 0x3f, &(0x7f0000000580)=""/63, 0x41000, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000005c0)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000600)={0x4, 0xc, 0xfffffff8, 0x5}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000640)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, r1, 0x1, r1, 0xffffffffffffffff], &(0x7f0000000680)=[{0x0, 0x1, 0x5}], 0x10, 0x3}, 0x94) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0xffffffffffffffff, 0xfffffffd}, 0xc) pipe(&(0x7f0000000080)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000240)=[{&(0x7f00000000c0)='s', 0x1}], 0x1, 0x2) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000880)={0x0, 0x608a2a18, 0x10}, 0xc) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r10, &(0x7f00000001c0)=[{&(0x7f0000000280)="dc", 0x1}], 0x1, 0x3) close(r10) setsockopt$inet_tcp_TCP_REPAIR(r10, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) splice(r9, 0x0, r10, 0x0, 0x10500, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000980)={r11}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r11, 0x68, &(0x7f0000000200)}, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), r7) sendmsg$NL80211_CMD_RADAR_DETECT(r9, &(0x7f0000000d00)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c40)={0x70, r12, 0x8, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x0, 0x56}}}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x67}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x55}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffffffff}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffffffbf}]}, 0x70}, 0x1, 0x0, 0x0, 0x20040000}, 0x4008011) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000940)={{0x1, 0xffffffffffffffff}, &(0x7f00000008c0), &(0x7f0000000900)=r1}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000a00)={{0x1, 0xffffffffffffffff}, &(0x7f0000000980), &(0x7f00000009c0)='%ps \x00'}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_tracing={0x1a, 0x14, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@ldst={0x0, 0x3, 0x6, 0x2, 0x0, 0x6, 0x10}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000000c0)='syzkaller\x00', 0x6, 0xd7, &(0x7f0000000280)=""/215, 0x41000, 0x3, '\x00', r3, 0x18, r4, 0x8, &(0x7f0000000480)={0x6, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x3, 0x9, 0x1a, 0x95c1}, 0x10, 0x460e, r5, 0x6, &(0x7f0000000a40)=[r6, 0x1, r7, r8, r9, r11, r1, r13, r14], &(0x7f0000000a80)=[{0x3, 0x2, 0xe, 0x9}, {0x0, 0x5, 0x5, 0x5}, {0x3, 0x3, 0xd, 0x7}, {0x3, 0x2, 0x4, 0x1}, {0x2, 0x3, 0x7, 0x9}, {0x5, 0x4, 0x6, 0x8}], 0x10, 0x400}, 0x94) 2.536415693s ago: executing program 1 (id=10977): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140700000000010000000000000000000000000a20000000060a0b040000000000000000020000000900010073797a3000000000140000001100010000000000000000000000000a"], 0x48}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x0) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) close(0x4) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@mpls_getroute={0xa0, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_NEWDST={0x84, 0x13, [{0x8, 0x0, 0x1}, {0x48}, {0x999f}, {}, {0xa67}, {0x9}, {0xa7}, {0x831}, {0x2}, {0x6, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x7, 0x0, 0x1}, {0x1, 0x0, 0x1}, {0x2}, {0xc}, {0x4, 0x0, 0x1}, {0xffb6b, 0x0, 0x1}, {0x5}, {0x101}, {}, {0x7}, {0x208}, {0x3, 0x0, 0x1}, {0x8}, {0x7}, {0xb, 0x0, 0x1}, {0x2}, {0x7f, 0x0, 0x1}, {0x5, 0x0, 0x1}, {0x8f, 0x0, 0x1}, {0xd4}, {0x6, 0x0, 0x1}]}]}, 0xa0}}, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000001240)=ANY=[@ANYBLOB="340000006800010000000000fddbdf25020000000000000006000700010000000c000880050004000100000008000500", @ANYRES32=r6], 0x34}, 0x1, 0x0, 0x0, 0x440a}, 0x4040414) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5001000000000000000000000000000000180ebc9e886819426e1bc2422df5cd00fffc05000100070000000900020073797a31000000000400078014000300686173683a69702c706f72742c69700005"], 0x50}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000a941fb34711bfc0000000000000200000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) socket$kcm(0x10, 0x100000000002, 0x4) bind$pptp(r7, &(0x7f0000000140)={0x18, 0x2, {0x3, @multicast2}}, 0x1e) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080)=0x800, 0x4) 2.040698123s ago: executing program 4 (id=10985): r0 = socket(0xa, 0x1, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2b, 0x0, {0x2, 0x0, 0x0, r2, 0x40, 0x10, 0xa}, [@NDA_DST_IPV6={0x14, 0x1, @loopback}, @NDA_LLADDR={0xa, 0x2, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) unshare(0x20000400) (async) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x12, &(0x7f00000000c0)=0x7b, 0x4) r4 = socket(0x400000000010, 0x3, 0x0) connect$inet6(r4, 0x0, 0x0) (async, rerun: 64) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYRESOCT=r1, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000004010500e0000001000000000000000000000000000004d63c00000002000000e00000010000000000000000000000000735000004030700080000000400000001000000fe80000000000000000000000000000c000004d36c00000002000000fc0000000000000000000000000000010135000002007300018000000400000007000000ff020000000000000000000000000001000004d33c00000002000000e00000010000000000000000000000000635000002030700050000000300000007000000fe800000000000000000000000000012800000013c0000000a000000ac1414bb000000000000000000000000000000000101090008000000e700000007000000"], 0x1bc}}, 0x0) 1.905126207s ago: executing program 2 (id=10987): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x9b}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f00000003c0)={0x9, 0x100, 0xfffffffd, 0x7ff, 0x3}) (async) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000000080)={&(0x7f0000000140)={0xa, 0xa, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c, 0x0, 0x0, &(0x7f0000000040)}, 0x922bac8556bda5ce) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) (async, rerun: 32) sendmsg$NLBL_UNLABEL_C_ACCEPT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x24008851}, 0x40040) (async, rerun: 32) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000f00)=ANY=[@ANYBLOB="300000001800dd8d0000000000000000020000000000000900000000060015000a0000000c00168008000100bc"], 0x30}}, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f0000000200)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff07003506000002000000170600000ee50000bf250000000000001f650000000000006507000002000000070700004c0001000f75000000000000bf54000000000000070400000400f9ff2d3501000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c45402000000a2d23da04d1ffc187fa1a2ba7ba030c7267c2de00435fd233cc0f0d9b2c3127c46b0f408398d09ee4dc258d726eae098804de25df627a64ac7efde50fd7f1dd5b17ed764c33b06598bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a459db8e7ada8ee987cc0000f6"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0xfffffffffffffe66}, 0x48) (async, rerun: 64) sendmmsg$alg(r3, &(0x7f0000000140), 0x4924b68, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) (async, rerun: 32) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000440), r2) (async, rerun: 32) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001780)=""/4091, 0xffb}, {&(0x7f0000000300)=""/124, 0x7c}, {&(0x7f0000000240)=""/84, 0x54}, {&(0x7f00000000c0)=""/50, 0x32}], 0x4}, 0x40) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r3, &(0x7f0000000500)={&(0x7f0000000400), 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x24, r4, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7ff}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x48004) (async, rerun: 64) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000700)={0x1c, r6, 0xc3583661201c9f3d, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x20000400) (async, rerun: 64) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async, rerun: 64) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (rerun: 64) connect$bt_rfcomm(r8, &(0x7f0000000140)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4}, 0xa) ppoll(&(0x7f0000000080)=[{r8, 0x2}], 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0x8c, r7, 0x2, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x74}, @void, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "24d028c1e7e73e063c2eaca181be167ae95cfe7debce4b0e"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}]]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000810}, 0x4401) (rerun: 64) 1.904534948s ago: executing program 4 (id=10988): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='blkio.bfq.idle_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000240)="94", 0x1) vmsplice(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b316666b5dfb7295c4915989d5bcb120e8fedaa97b93a137c256ce4", 0xc4}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd349031b2cd874c7a8961a586a9f2d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3ef4e4a4b0dcdb70db735d5c1652eed3848b2dd4131bb0eb7cfadfaf5", 0x9d}], 0x2, 0x0) tee(r2, r5, 0x2, 0x100000000000003) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000001240)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x14) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000004c0)=ANY=[@ANYBLOB="340000000806030000000000000000000200000005000100070000000900020073797a310000000009006772e7601440020073797a3000000000"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x40000) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010025bd700000000000070000000c0001800500020001000000f1"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r8, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0xbc, r10, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1e}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4f}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xc27}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r13}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}]}, 0xbc}, 0x1, 0x0, 0x0, 0x20000000}, 0x48000) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r15 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000340)={0xd, 0xfff9, 0x200, 0x81, 0x3, 0x5, 0x8, 0x9}, 0x20) r17 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r17, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="200000006a0083130000000000000000000000000000000008000500d768d9f8"], 0x20}}, 0x0) sendmsg$nl_route_sched(r15, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r16, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@gettaction={0x124, 0x32, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x10f9b81f4c3fc9e1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x2ddd}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_gd=@TCA_ACT_TAB={0x98, 0x1, [{0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x14, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x59}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x38}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x4010}, 0x808) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@delneigh={0x40, 0x1d, 0x8, 0x4, 0x25dfdbfc, {0x7, 0x0, 0x0, r16, 0x10, 0x85, 0x9}, [@NDA_SRC_VNI={0x8, 0xb, 0xc}, @NDA_CACHEINFO={0x14, 0x3, {0x2, 0x5, 0x400, 0xdba4}}, @NDA_DST_IPV4={0x8, 0x1, @broadcast}]}, 0x40}}, 0x0) 1.828694304s ago: executing program 0 (id=10990): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000200)={0x0, 0x0, 0x207}, 0x20) r1 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000a40)=ANY=[@ANYBLOB="140000001800eb8976156951b2ba29ef80"], 0xfe33) (async) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000340), &(0x7f0000000380)=0x4) (async) r2 = accept4(r1, &(0x7f0000000000)=@isdn, &(0x7f0000000080)=0x80, 0x40800) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000300)={0x0, '\x00', {0x2}, 0x7}) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x2, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={0x1, 0x58, &(0x7f0000000100)}, 0x10) (async) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r3) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r3) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x8c, r7, 0x4, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x60, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}]}, @ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0xc0}, 0x40010) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f00000002c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1c, r5, 0x800, 0x70bd2c, 0x25dfdbfa, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0xc48c5) (async) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.78288463s ago: executing program 2 (id=10991): r0 = socket$inet6(0x10, 0x3, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) recvfrom$inet6(r0, &(0x7f0000000040)=""/57, 0x39, 0x0, &(0x7f0000000080)={0xa, 0x4e23, 0x6, @loopback, 0x1}, 0x1c) 1.672714961s ago: executing program 0 (id=10993): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000)=0xc, 0x4) sendto$inet(r0, &(0x7f0000000640)="01c5c6f8", 0x4, 0x4004084, &(0x7f0000000680)={0x2, 0x4e20, @local}, 0x10) 1.672064202s ago: executing program 4 (id=10994): r0 = socket$inet6(0xa, 0x3, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x2, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000400000000000000080003851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff00000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xa}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x2, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, 0x1, @dev={0xac, 0x14, 0x14, 0x32}, @loopback}, "ffffff7f00000000"}}}}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x28c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x154, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}, @NFTA_QUEUE_SREG_QNUM={0x8}]}}}, {0x120, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x110, 0x2, 0x0, 0x1, [@NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_FROM_DATA={0xfc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf8, 0x1, "caa3ddcacc2426b5fa3eeb2506cf5cf5f7c25c7f89cbbc2af3114f7bf484960b85a1132cb6a09eae1688e1685d8417d70ba28d67f870419b2b71905c04fc392dd0aedbbe6f3d58990ddd7b02b59f94efe0f19244b35b06dfe399480bc3c06440e43cd4a37b9536fb2022b989457d6180fa89649c24ba25fc51ceb217c3e0aca9f26e1120442add28121251efb64d2b5474df46bc6eb289d7238efa31e3f1e86969e9f0448c8d68e3f1d6cf444ea036861c07c6b2c123b3618fd961fe7d39e3e650863cb25c57d0a7effde92664965ee04ec3d1c7bdb6b1311b7a6ca820edc3d496034a554f77166abe0c1dbd397c40cbcefc17b8"}]}]}}}, {0xc, 0x1, 0x0, 0x1, @nat={{0x8}, @void}}]}, @NFTA_RULE_EXPRESSIONS={0x118, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @lookup={{0xb}, @void}}, {0x1c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x2}]}}}, {0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x10}]}}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}, {0x58, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_OSF_TTL={0x5, 0x2, 0xd}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_OSF_TTL={0x5, 0x2, 0x4}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_OSF_TTL={0x5, 0x2, 0x7}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xe}]}}}, {0x10, 0x1, 0x0, 0x1, @socket={{0xb}, @void}}, {0x34, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x2b4}}, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000003c0)=0x4, 0x4) r3 = socket$inet(0x2, 0x3, 0x8) setsockopt$inet_buf(r3, 0x0, 0x20, 0x0, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2c, r5, 0x1, 0x4000000, 0x0, {0x1a}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4, &(0x7f0000000180)={0xa, 0x4e23, 0x8be6, @mcast2}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000000)={0x3a, 0x2, '\x00', [@hao={0xc9, 0x10, @empty}]}, 0x20) 1.641878538s ago: executing program 2 (id=10995): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, '\x00', "877dab43c700", '\x00', "0100"}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r2, &(0x7f0000000240)=[{&(0x7f00000000c0)=""/195, 0xc3}], 0x1) write$cgroup_subtree(r3, &(0x7f0000000700)=ANY=[], 0xfe33) r4 = socket(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000000000200feae04459737426f3e1a868eccc8b2c8000a14000000160a0102000000000000000005000004180000000e0a01030000000000000000000000060400038024000000000a0102000000000000000007000001040006000900010073797a310000000030000000160a010100000000000009040003800900010073797a31000000000900020073797a320000000014000000"], 0xa8}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r7 = socket(0x2b, 0x80801, 0x1) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f0000000100)=[{r8, 0x18d}], 0x1, 0x8001) close(r8) write$cgroup_subtree(r9, &(0x7f0000000040), 0xfffffc3f) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000040)=0x5, 0x4) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r4, 0x84, 0x74, &(0x7f0000000a40)=""/4096, &(0x7f0000000280)=0x1000) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000c80080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000f9db00000900010073797a31"], 0xe8}}, 0x40) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=r5, @ANYBLOB="03150000040000000a00100000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x7ccce9406ca9ffde}, 0x40810) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6000000010000104000000000300000000000000", @ANYRES32=r5, @ANYBLOB="fab0817dbcb5f31a2c001280110001006272696467655fd0c32bcb9546cab5a64fd08329736c975c1e38000010140005800500091d000000000500080028fca1a01400030069705f075081b473d288e7a35fd230c1bb5ea3958b4fde8eb23a8203cdb81bde2eb5ed679dc87d7a11f236d72c12f928322072d7dd22a4b79b376e2b4a348541297e"], 0x60}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 1.549731041s ago: executing program 1 (id=10997): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r3, &(0x7f00000005c0)=[{&(0x7f0000003080)=@in={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f00000030c0)=[{&(0x7f0000005d00)="ec", 0x1}], 0x1, 0x0, 0x0, 0x90}], 0x1, 0x1) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f00000006c0)=0x6, 0x4) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000140)=0x4) syz_emit_ethernet(0x6c, &(0x7f0000000440)=ANY=[@ANYBLOB="ffffffffffff0180c200bc9a396dc6aad81049000690780000000000000000248088a80000000000ff0083100008000006000086dd080088be00000000100000000100000000000000080022eb00000033b5ac334908e63b200000fd010000000000002765b69e9d4bf8a54600000000000000"], 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r2) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xd1, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="480000001000030500"/20, @ANYRES32=r5, @ANYBLOB="0000000040000200280012800a000100767863616e000000180002801400010000000000", @ANYRES64=r6], 0x48}, 0x1, 0x0, 0x0, 0x2400008c}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="440000001000370400000000fdffffff00000000", @ANYRES32=r1, @ANYBLOB="4b39050000000000240012800b000100697036677265000014000280"], 0x44}, 0x1, 0x0, 0x0, 0x48800}, 0x24000010) 1.406942341s ago: executing program 4 (id=10999): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)={0x64, r2, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x444e}, {0x6, 0x16, 0x2}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x7}, {0x8, 0xb, 0x7fff}}]}, 0x64}, 0x1, 0x0, 0x0, 0x804}, 0x4000000) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000400), &(0x7f0000000440)=0x8) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000380)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x18, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x4, 0x1}]}, 0x18}}, 0x0) listen(r5, 0x2) shutdown(r3, 0x0) connect$unix(r3, &(0x7f0000fce000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) r7 = accept(r5, 0x0, 0x0) sendto$inet6(r7, &(0x7f0000000000)="35ebc9747b", 0x5, 0x400440e9, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r1, 0x2}, {r3, 0x3102}, {r0, 0x2101}, {r0, 0x20c0}], 0x4, &(0x7f00000000c0)={r9, r10+10000000}, &(0x7f0000000100)={[0x1]}, 0x8) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r4, 0x40047211, &(0x7f0000000300)=0x8) sendmsg$nl_xfrm(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@delpolicy={0x5c, 0x14, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast1}}, [@sec_ctx={0xc, 0x8, {0x8}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x48040}, 0x0) 1.336727586s ago: executing program 4 (id=11001): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) r1 = socket(0x848000000015, 0x805, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000040)={0xa, 0x0, 0xf444, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) recvmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) ioctl$TUNSETNOCSUM(r2, 0xc040ff0b, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x16}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 1.216371601s ago: executing program 2 (id=11002): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb, 0x0, 0x0, 0x10, &(0x7f0000000380), 0x0, 0x0, 0xc1, 0x8, 0x0, 0x0}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="100100002e00090027bd70000000000004000000fa0017"], 0x110}, 0x1, 0x0, 0x0, 0x42845}, 0x84) unshare(0x400) r3 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e24, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r4, 0x1000) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r1, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f000042a000/0x800000)=nil, 0x800000, 0x0, 0x11, r5, 0x0) 1.213971672s ago: executing program 3 (id=11003): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c000008200001000000000000000a000000000000000000000005001600080000000000"], 0x2c}}, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r2, 0x84, 0x14, &(0x7f0000002140)=""/4092, &(0x7f0000001080)=0xffc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0xfffff47b, @mcast1, 0xb}, 0x1c) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fedbdf25020000000c0004000500000000000000080001010400000000000000000065762f6e65742f74756e0000000015a001b0e89134f06c200e816b3385bb495c05317341ac"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.183056901s ago: executing program 3 (id=11004): r0 = socket$kcm(0x23, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0xc0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x9, 0x1, 0x42, 0x40, 0x0, 0x1}, 0x48) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000001440)={'bridge0\x00', 0x0}) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000001300)={0x0, 0x6e2}, &(0x7f0000001340)=0x8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x107d, r3}, 0x38) (async) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001dc0)={r3, &(0x7f0000000d00), &(0x7f0000000dc0)=""/4096}, 0x20) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b70300001b0000008500000083000000bf0900000000000055090100000000009500000000000000bf080000000000007b9af8ff00000000b5090500000000007baaf0ff00000000bda804000000000007080000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018220000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf91000000000000b6080000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b70300001b0000008500000083000000bf0900000000000055090100000000009500000000000000bf080000000000007b9af8ff00000000b5090500000000007baaf0ff00000000bda804000000000007080000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004600000076000000bf91000000000000b6080000000000008500000085000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.111327259s ago: executing program 3 (id=11005): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000)=0xc, 0x4) sendto$inet(r0, &(0x7f0000000640)="01c5c6", 0x3, 0x4004084, &(0x7f0000000680)={0x2, 0x4e20, @local}, 0x10) (fail_nth: 11) 695.559131ms ago: executing program 0 (id=11006): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) (async) listen(r0, 0x7ff) (async) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) (async) close(0x3) (async) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) recvmmsg(r3, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x40000040, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000100000008000200000000000900020073797a32000000000900010073797a3000000000080005400000001d0800034000000007440000000c0a01020000000000000000010000020900020073797a3200000000180003801400008046fe0180080003400000000104000b800900010073797a3000000000140000001000010000000000000000000000000a6ae1dde3981a5c0d73f1c7e595f7bc8233b8b6a47e7c16abd3ff6a18690c6ed2c8627a068d87143c1157c5c01338d496e1672265f727baaef837e5df60d9b3e62da4ac6a784877b695a736cd84b7b865c56523d50624085783e7e8c5172ceadc63923c09cd790c65908093312a1f3339f84d91705113c1f519421ae69f0ee8f9862ddbea85be2d97286adfb5cec93c889dfd3a76249e2499"], 0xd0}}, 0x0) 596.220971ms ago: executing program 1 (id=11007): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140700000000010000000000000000000000000a20000000060a0b040000000000000000020000000900010073797a3000000000140000001100010000000000000000000000000a"], 0x48}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x0) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) close(0x4) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@mpls_getroute={0xa0, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_NEWDST={0x84, 0x13, [{0x8, 0x0, 0x1}, {0x48}, {0x999f}, {}, {0xa67}, {0x9}, {0xa7}, {0x831}, {0x2}, {0x6, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x7, 0x0, 0x1}, {0x1, 0x0, 0x1}, {0x2}, {0xc}, {0x4, 0x0, 0x1}, {0xffb6b, 0x0, 0x1}, {0x5}, {0x101}, {}, {0x7}, {0x208}, {0x3, 0x0, 0x1}, {0x8}, {0x7}, {0xb, 0x0, 0x1}, {0x2}, {0x7f, 0x0, 0x1}, {0x5, 0x0, 0x1}, {0x8f, 0x0, 0x1}, {0xd4}, {0x6, 0x0, 0x1}]}]}, 0xa0}}, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000001240)=ANY=[@ANYBLOB="340000006800010000000000fddbdf25020000000000000006000700010000000c000880050004000100000008000500", @ANYRES32=r6], 0x34}, 0x1, 0x0, 0x0, 0x440a}, 0x4040414) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5001000000000000000000000000000000180ebc9e886819426e1bc2422df5cd00fffc05000100070000000900020073797a31000000000400078014000300686173683a69702c706f72742c69700005"], 0x50}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000a941fb34711bfc0000000000000200000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) socket$kcm(0x10, 0x100000000002, 0x4) bind$pptp(r7, &(0x7f0000000140)={0x18, 0x2, {0x3, @multicast2}}, 0x1e) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000080)=0x800, 0x4) 595.421819ms ago: executing program 3 (id=11008): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="660a000000000000611183000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1e, 0x2, 0x2) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @remote}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}]}}}]}, 0x40}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="40100000004104002000128008000100677265001400028008000700ac1414aa0600030081000000"], 0x40}}, 0x4040000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x824, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r9 = socket(0x21, 0xa, 0x8001) setsockopt$WPAN_SECURITY(r9, 0x0, 0x31, &(0x7f0000000fc0)=0x1, 0x4) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="1b0000000000000000000000879034820800000000000000", @ANYRES32, @ANYBLOB="0000008000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000050000000200"/28], 0x50) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="04000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x4, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB="1800000000000300000000000000000018150000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008900000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r12, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="016fbfbd7000fedbdf250900000008000300", @ANYRES32=r14, @ANYBLOB="08000600", @ANYRES32=r13], 0x2c}, 0x1, 0x0, 0x0, 0x48440}, 0x4040000) r15 = socket$inet6(0xa, 0x80803, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r15, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@empty, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0x200, 0x0, 0xa, 0x547b31180522e14c, 0x0, 0xf988f237effa8409}, {0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc}, {0x0, 0x0, 0x4, 0x400000}, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in=@empty, 0x4d2, 0x2b}, 0x0, @in6=@private1, 0xfffffffd, 0x3, 0x0, 0x0, 0x80000003}}, 0xe8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r0, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000003c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x95, &(0x7f0000000480)=[{}, {}], 0x10, 0x10, &(0x7f00000004c0), &(0x7f0000000500), 0x8, 0x63, 0x8, 0x8, &(0x7f0000000540)}}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000740)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)='%-5lx \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0x19, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000001800000000000000000008018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000009500000000f700007fb3040005000000850000758ac260b8cba89906d88709d1070023000000180000000900b6e2e68eaeb0e8fce70376c06b43b4d7f366f6eec0abdc4d37ae1dcee5a9d814a42ae47e906d714c5716cc4810e6f81c6fea83337c2cbafc7857d23a4aa4fc148dbf3bd0dc92cd0d79d1706458c7", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000000000000850000008600000085200000040000003533f0fffcffffffbf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x7fff, 0x0, 0x0, 0x40f00, 0x10, '\x00', r14, @fallback=0x28, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x0, 0x9, 0x6, 0x3}, 0x10, r16, 0xffffffffffffffff, 0x0, &(0x7f0000000840)=[r17, r18], 0x0, 0x10, 0x4}, 0x94) clock_gettime(0x0, &(0x7f0000005340)) 545.449359ms ago: executing program 0 (id=11009): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) accept(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0x10, &(0x7f0000000000)=@framed={{}, [@tail_call={{}, {}, {}, {0x4}}, @printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x76}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000080)={{0x3c, @dev={0xac, 0x14, 0x14, 0x1c}, 0x4e20, 0x3, 'wrr\x00', 0x20, 0x770, 0x2e}, {@broadcast, 0x4e20, 0x1, 0x4, 0x10, 0x2}}, 0x44) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8a00fe00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff8effb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000c5"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 426.908646ms ago: executing program 4 (id=11010): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0x9) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000880)={'tunl0\x00', 0x0}) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_int(r5, 0x0, 0x1, &(0x7f00000009c0)=0x1234, 0x4) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x58, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_BACKUP_PORT={0x8, 0x22, r4}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 328.317438ms ago: executing program 3 (id=11011): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4}, 0x48) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x1411, 0x223}, 0x10}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0xa, 0x17, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000008fd9a2d600000018110000e834de26a951c0e20c1ba869000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008c000000bf0900000000000066090600000003e7040000000600000018010000756c6c2500000000002020207d9af8ff00000000ad9100000000000037010000f8ffffffb702000008000000b70300000000000014000000060000005c93000000000000b5030200000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 327.816444ms ago: executing program 2 (id=11012): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r2, 0x0) write$cgroup_int(r2, &(0x7f0000000080)=0x80000000, 0x12) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) read(r0, &(0x7f0000000100)=""/92, 0x5c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) pipe(&(0x7f00000001c0)) (async) mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r2, 0x0) (async) write$cgroup_int(r2, &(0x7f0000000080)=0x80000000, 0x12) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) read(r0, &(0x7f0000000100)=""/92, 0x5c) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) (async) 312.649985ms ago: executing program 0 (id=11013): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4f23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) (async) r1 = socket(0x2a, 0x2, 0x403) (async, rerun: 32) r2 = socket$unix(0x1, 0x5, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd22, 0x6000000, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {}, {0x7, 0xe}}, [@TCA_RATE={0x6, 0x5, {0x3, 0x7f}}, @filter_kind_options=@f_fw={{0x7}, {0x5c, 0x2, [@TCA_FW_ACT={0x58, 0x4, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xfffffc00, 0x8, 0x10000000, 0x200000b, 0xff}, @broadcast, @local, 0xff, 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) (async, rerun: 32) getsockname$qrtr(r1, &(0x7f0000000040), &(0x7f0000000080)=0xc) 274.2209ms ago: executing program 3 (id=11014): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="61123000000000006113680000000000bf2000000000000015000600071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070300000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586162c17600674290ca9d8d6413b8199e34f67ceaaa78710f9f8aba4765c91382f497585ca39c595b21afa6bce62b5ab0d44e9c32ad6f0349d92962a58d39494a19a9183362382792ac85578d3de07b7e155cf4ee5e3dd51212d2831bd8e2655b2fbd88791e4c66c832a774919b28b8a62711f0f156e636804e1d3f44a5ff3d63a3a51f0c7ec0c8c25e072194ddd83aa155a537e15c0d91f502deef03f83e826718705c9aef9613ac4a325a428d147c1749196e94226671fd9573ab0d079d44b13b56f793e98ab571c58e98e022f18a3be3f318e0690fff93f44f22473dc8004fc758218349bd3f0516a72a7ea913bfa7603063ed3118b2d680cbc"], &(0x7f0000000100)='GPL\x00'}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) setsockopt$SO_J1939_ERRQUEUE(r2, 0x6b, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010001ffffcfffffffdffffff00000000", @ANYRES32=0x0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00", @ANYRES32=r3], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 229.415993ms ago: executing program 2 (id=11015): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x16}, @NFTA_CT_DIRECTION={0x5}]}}}, {0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xc}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) close(r0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x30}, {0x6}]}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket(0x11, 0x800000003, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4004}}, 0x26) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r3, 0x8b32, &(0x7f0000000040)) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000280)=0xfffffffb, 0x4) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xac, 0x0, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x800}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xff}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x5}]}, @CTA_NAT_SRC={0x20, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @loopback}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @multicast1}}]}, @CTA_NAT_SRC={0xc, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x19}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1006}, @CTA_FILTER={0x4}, @CTA_TUPLE_ORIG={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_SEQ_ADJ_REPLY={0x24, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x3}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x40}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x10}, 0x4004080) 0s ago: executing program 0 (id=11016): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@filter={'filter\x00', 0x4, 0x4, 0x370, 0xffffffff, 0xe8, 0xe8, 0x0, 0xfeffffff, 0xffffffff, 0x2a0, 0x2a0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x1f}, @loopback, [0xffffffff, 0xffffff00, 0xffffffff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffff00], 'wlan1\x00', 'sit0\x00', {}, {0xff}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xff000000, 0x1ffffff01], 'sit0\x00', 'batadv_slave_1\x00', {0xff}, {}, 0x34}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x5, {0x2000010}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000b80)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x26, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r4, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@local, @in=@remote, 0x4e22, 0x8, 0x4e23, 0x0, 0xa, 0x80, 0x0, 0x2}, {0x1, 0x3, 0x8, 0x6, 0x2, 0x600d382c, 0x80, 0x4}, {0x17e, 0x9, 0x8, 0xfffffffffffffff8}, 0x100, 0x6e6bbb, 0x0, 0x0, 0x3, 0x2}, {{@in=@rand_addr=0x64010100, 0x4d3, 0x2b}, 0xa, @in6=@mcast1, 0x3503, 0x4, 0x3, 0x7, 0x8, 0x6, 0x400}}, 0xe8) write$tun(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="000086dd00031100040000f5a60c6eec00be00442ffffe80000000000000000000000000000000000000000007000000000000000002042088be000000030c000800050086dd88a888be000000021609660501000000000088a8080022eb00020000200cf0080200000000000002000494030800655800000002"], 0x7a) kernel console output (not intermixed with test programs): over after parsing attributes in process `syz.4.9146'. [ 1231.167750][ T7034] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9146'. [ 1231.814673][ T7071] netlink: 'syz.2.9163': attribute type 1 has an invalid length. [ 1231.850176][ T7071] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 1231.959416][ T7079] sctp: [Deprecated]: syz.1.9164 (pid 7079) Use of int in maxseg socket option. [ 1231.959416][ T7079] Use struct sctp_assoc_value instead [ 1231.992111][ T7080] sctp: [Deprecated]: syz.1.9164 (pid 7080) Use of int in maxseg socket option. [ 1231.992111][ T7080] Use struct sctp_assoc_value instead [ 1232.201812][ T7092] netlink: 48 bytes leftover after parsing attributes in process `syz.1.9168'. [ 1232.319582][ T7095] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9170'. [ 1232.353289][ T7095] openvswitch: netlink: Flow key attr not present in new flow. [ 1232.528115][ T5843] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1232.539414][ T5843] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1232.554324][ T5843] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1232.565918][ T5843] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1232.583373][ T5843] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1232.718905][ T7101] lo speed is unknown, defaulting to 1000 [ 1232.775013][ T7115] delete_channel: no stack [ 1232.824091][ T7110] delete_channel: no stack [ 1233.029672][ T7126] netlink: 'syz.2.9180': attribute type 1 has an invalid length. [ 1233.037837][ T7126] netlink: 228 bytes leftover after parsing attributes in process `syz.2.9180'. [ 1233.053634][ T3749] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.097430][ T3749] netdevsim netdevsim3 eth3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1233.117484][ T3749] netdevsim netdevsim3 eth3 (unregistering): unset [0, 2] type 1 family 0 port 2816 - 0 [ 1233.138184][ T3749] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 34434 - 0 [ 1233.172037][ T3749] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1233.334674][ T3749] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.358170][ T3749] netdevsim netdevsim3 eth2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1233.381784][ T3749] netdevsim netdevsim3 eth2 (unregistering): unset [0, 2] type 1 family 0 port 2816 - 0 [ 1233.411801][ T3749] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 34434 - 0 [ 1233.431473][ T3749] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1233.517330][ T3749] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.527464][ T3749] netdevsim netdevsim3 eth1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1233.542202][ T3749] netdevsim netdevsim3 eth1 (unregistering): unset [0, 2] type 1 family 0 port 2816 - 0 [ 1233.553011][ T3749] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 34434 - 0 [ 1233.565607][ T3749] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1233.643595][ T3749] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.665744][ T3749] netdevsim netdevsim3 eth0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 1233.686335][ T3749] netdevsim netdevsim3 eth0 (unregistering): unset [0, 2] type 1 family 0 port 2816 - 0 [ 1233.732006][ T3749] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 34434 - 0 [ 1233.754851][ T3749] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1234.236100][ T7101] chnl_net:caif_netlink_parms(): no params data found [ 1234.311794][ T3749] team0: left allmulticast mode [ 1234.316768][ T3749] team_slave_0: left allmulticast mode [ 1234.331055][ T3749] team_slave_1: left allmulticast mode [ 1234.336693][ T3749] team0: left promiscuous mode [ 1234.346836][ T3749] team_slave_0: left promiscuous mode [ 1234.362845][ T3749] team_slave_1: left promiscuous mode [ 1234.368762][ T3749] bridge0: port 3(team0) entered disabled state [ 1234.377213][ T3749] bridge_slave_1: left allmulticast mode [ 1234.383668][ T3749] bridge_slave_1: left promiscuous mode [ 1234.389455][ T3749] bridge0: port 2(bridge_slave_1) entered disabled state [ 1234.399828][ T3749] bridge_slave_0: left promiscuous mode [ 1234.405966][ T3749] bridge0: port 1(bridge_slave_0) entered disabled state [ 1234.433967][ T3749] tipc: Resetting bearer [ 1234.681434][ T5843] Bluetooth: hci5: command tx timeout [ 1234.718878][ T3749] tipc: Disabling bearer [ 1234.935778][ T3749] bond3 (unregistering): (slave bridge2): Releasing backup interface [ 1234.944436][ T3749] bridge2 (unregistering): left promiscuous mode [ 1234.996953][ T3749] team0: Port device bridge3 removed [ 1235.184061][ T3749] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1235.193284][ T3749] bond_slave_0: left allmulticast mode [ 1235.201511][ T3749] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1235.217304][ T3749] bond_slave_1: left allmulticast mode [ 1235.224390][ T3749] bond0 (unregistering): Released all slaves [ 1235.237731][ T3749] bond1 (unregistering): Released all slaves [ 1235.253222][ T3749] bond2 (unregistering): Released all slaves [ 1235.275999][ T3749] bond3 (unregistering): Released all slaves [ 1235.290259][ T3749] bond4 (unregistering): Released all slaves [ 1235.308052][ T3749] bond5 (unregistering): (slave veth3): Releasing active interface [ 1235.319292][ T3749] bond5 (unregistering): Released all slaves [ 1235.338305][ T3749] bond6 (unregistering): Released all slaves [ 1235.356017][ T3749] bond7 (unregistering): (slave lo): Releasing backup interface [ 1235.364442][ T3749] bond7 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 1235.378711][ T3749] bond7 (unregistering): Released all slaves [ 1235.396957][ T3749] bond8 (unregistering): Released all slaves [ 1235.411750][ T3749] bond9 (unregistering): Released all slaves [ 1235.429174][ T3749] bond10 (unregistering): Released all slaves [ 1235.451831][ T3749] bond11 (unregistering): Released all slaves [ 1235.491000][ T7184] netlink: 'syz.1.9197': attribute type 29 has an invalid length. [ 1235.586910][ T7197] workqueue: Failed to create a rescuer kthread for wq "bond16": -EINTR [ 1235.713472][ T7203] netlink: 'syz.0.9199': attribute type 10 has an invalid length. [ 1235.741383][ T3749] : left promiscuous mode [ 1235.914827][ T3749] tipc: Disabling bearer [ 1235.923365][ T3749] tipc: Left network mode [ 1236.172867][ T7101] bridge0: port 1(bridge_slave_0) entered blocking state [ 1236.221995][ T7101] bridge0: port 1(bridge_slave_0) entered disabled state [ 1236.237088][ T7232] netlink: 'syz.2.9204': attribute type 10 has an invalid length. [ 1236.245926][ T7101] bridge_slave_0: entered allmulticast mode [ 1236.264817][ T7101] bridge_slave_0: entered promiscuous mode [ 1236.276135][ T7101] bridge0: port 2(bridge_slave_1) entered blocking state [ 1236.327438][ T7101] bridge0: port 2(bridge_slave_1) entered disabled state [ 1236.336647][ T7101] bridge_slave_1: entered allmulticast mode [ 1236.390070][ T7101] bridge_slave_1: entered promiscuous mode [ 1236.478363][ T7232] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1236.697421][ T7101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1236.754531][ T5843] Bluetooth: hci5: command tx timeout [ 1236.780421][ T7101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1237.033079][ T7101] team0: Port device team_slave_0 added [ 1237.079799][ T7101] team0: Port device team_slave_1 added [ 1237.282768][ T7283] macvtap1: entered allmulticast mode [ 1237.298631][ T7283] veth0_macvtap: entered allmulticast mode [ 1237.343769][ T7101] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1237.371406][ T7101] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1237.413669][ T7101] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1237.536375][ T7101] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1237.550775][ T7101] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1237.582016][ T7101] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1237.854424][ T7299] __nla_validate_parse: 8 callbacks suppressed [ 1237.854444][ T7299] netlink: 4436 bytes leftover after parsing attributes in process `syz.0.9221'. [ 1237.891387][ T7305] netlink: 1 bytes leftover after parsing attributes in process `syz.1.9223'. [ 1237.985619][ T7307] netlink: 1 bytes leftover after parsing attributes in process `syz.1.9223'. [ 1238.026067][ T7307] xt_policy: neither incoming nor outgoing policy selected [ 1238.044406][ T7101] hsr_slave_0: entered promiscuous mode [ 1238.067770][ T7101] hsr_slave_1: entered promiscuous mode [ 1238.131586][ T7101] debugfs: 'hsr0' already exists in 'hsr' [ 1238.157494][ T7101] Cannot create hsr debugfs directory [ 1238.305610][ T3749] hsr_slave_1: left promiscuous mode [ 1238.321883][ T3749] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1238.350198][ T3749] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1238.424013][ T3749] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1238.449205][ T3749] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1238.492725][ T3749] batman_adv: batadv0: Interface deactivated: dummy0 [ 1238.503733][ T3749] batman_adv: batadv0: Removing interface: dummy0 [ 1238.584588][ T3749] veth1_macvtap: left promiscuous mode [ 1238.603611][ T3749] veth0_macvtap: left promiscuous mode [ 1238.661716][ T3749] veth1_vlan: left promiscuous mode [ 1238.726674][ T7362] netlink: 'syz.2.9231': attribute type 1 has an invalid length. [ 1238.758288][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 1238.831223][ T5843] Bluetooth: hci5: command tx timeout [ 1239.188988][ T3749] team0 (unregistering): Port device team_slave_1 removed [ 1239.206587][ T3749] team0 (unregistering): Port device team_slave_0 removed [ 1239.880124][ T7389] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9236'. [ 1240.138359][ T7391] syzkaller1: entered promiscuous mode [ 1240.148863][ T7391] syzkaller1: entered allmulticast mode [ 1240.401485][ T3749] IPVS: stop unused estimator thread 0... [ 1240.913592][ T5843] Bluetooth: hci5: command tx timeout [ 1241.929553][ T7484] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9253'. [ 1242.621350][ T7521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9260'. [ 1243.417567][ T7420] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1243.441108][ T7101] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1243.443010][ T7524] netlink: 'syz.4.9260': attribute type 2 has an invalid length. [ 1243.500550][ T7101] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1243.550035][ T7101] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1243.658419][ T7555] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1243.669552][ T7101] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1243.868023][ T7572] netlink: 'syz.4.9265': attribute type 2 has an invalid length. [ 1243.871833][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5110 ms [ 1243.883933][ C0] lec:lec_tx_timeout: lec0 [ 1243.926985][ T7101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1243.983547][ T7101] 8021q: adding VLAN 0 to HW filter on device team0 [ 1244.025752][T13889] bridge0: port 1(bridge_slave_0) entered blocking state [ 1244.033006][T13889] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1244.068248][T13889] bridge0: port 2(bridge_slave_1) entered blocking state [ 1244.075524][T13889] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1244.313075][ T7592] lo speed is unknown, defaulting to 1000 [ 1244.368881][ T7596] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9271'. [ 1244.545678][ T7603] netlink: 'syz.1.9273': attribute type 1 has an invalid length. [ 1244.564841][ T7603] netlink: 280 bytes leftover after parsing attributes in process `syz.1.9273'. [ 1244.653703][ T7603] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 1244.773412][ T7101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1244.838893][ T7613] netlink: 'syz.4.9275': attribute type 1 has an invalid length. [ 1244.883556][ T7101] veth0_vlan: entered promiscuous mode [ 1244.943649][ T7101] veth1_vlan: entered promiscuous mode [ 1245.026677][ T7101] veth0_macvtap: entered promiscuous mode [ 1245.045950][ T7101] veth1_macvtap: entered promiscuous mode [ 1245.107355][ T7621] netlink: 4096 bytes leftover after parsing attributes in process `syz.1.9277'. [ 1245.108346][ T7101] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1245.134356][ T7621] openvswitch: netlink: Flow actions attr not present in new flow. [ 1245.164919][ T7101] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1245.204532][ T3749] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1245.216603][ T3749] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1245.248670][ T3749] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1245.265922][ T3749] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1245.333901][ T7624] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9278'. [ 1245.352310][ T7624] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 1245.408118][ T7624] team1: entered promiscuous mode [ 1245.414251][ T7624] team1: entered allmulticast mode [ 1245.585939][T13889] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1245.605907][T13889] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1245.733625][ T7633] veth0: entered promiscuous mode [ 1245.820067][ T7643] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1245.830705][ T3749] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1245.855521][ T3749] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1245.896791][ T7641] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9284'. [ 1246.102724][ T7647] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9172'. [ 1246.415241][ T7632] veth0: left promiscuous mode [ 1246.669655][ T581] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1246.683162][ T581] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1246.692301][ T581] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1246.707582][ T581] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1246.715664][ T581] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1246.724331][ T7665] netlink: 'syz.0.9292': attribute type 9 has an invalid length. [ 1247.084872][ T7666] lo speed is unknown, defaulting to 1000 [ 1247.232521][ T7676] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9295'. [ 1247.247871][ T3749] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1247.251362][ T7676] netlink: 'syz.4.9295': attribute type 3 has an invalid length. [ 1247.270640][ T3749] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1247.510145][ T3749] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1247.542442][ T3749] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1247.692596][ T7705] sctp: [Deprecated]: syz.3.9303 (pid 7705) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1247.692596][ T7705] Use struct sctp_sack_info instead [ 1247.802520][ T3749] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1247.823656][ T3749] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1247.866401][ T7712] netlink: 'syz.4.9305': attribute type 1 has an invalid length. [ 1248.049543][ T3749] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1248.060303][ T3749] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1248.099409][ T7712] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1248.196519][ T7726] netlink: 48 bytes leftover after parsing attributes in process `syz.3.9309'. [ 1248.634935][ T7751] netlink: 'syz.4.9314': attribute type 1 has an invalid length. [ 1248.651212][ T7751] netlink: 'syz.4.9314': attribute type 3 has an invalid length. [ 1248.674698][ T7751] netlink: 224 bytes leftover after parsing attributes in process `syz.4.9314'. [ 1248.752426][ T5843] Bluetooth: hci0: command tx timeout [ 1248.779683][ T7751] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9314'. [ 1249.140451][ T3749] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 1249.319756][ T3749] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1249.328146][ T3749] bond0 (unregistering): (slave bridge0): the permanent HWaddr of slave - aa:aa:aa:aa:aa:0c - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1250.308554][ T3749] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1250.323328][ T3749] bond0 (unregistering): Released all slaves [ 1250.334573][ T3749] bond1 (unregistering): Released all slaves [ 1250.352508][ T3749] bond2 (unregistering): Released all slaves [ 1250.368498][ T3749] bond3 (unregistering): Released all slaves [ 1250.386322][ T3749] bond4 (unregistering): Released all slaves [ 1250.407101][ T3749] bond5 (unregistering): Released all slaves [ 1250.422361][ T3749] bond6 (unregistering): Released all slaves [ 1250.438868][ T3749] bond7 (unregistering): Released all slaves [ 1250.454154][ T3749] bond8 (unregistering): Released all slaves [ 1250.512729][ T7765] team0 (unregistering): Port device geneve2 removed [ 1250.553117][ T7752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1250.637627][ T3749] 9: left promiscuous mode [ 1250.703159][ T7666] chnl_net:caif_netlink_parms(): no params data found [ 1250.717877][ T3749] tipc: Left network mode [ 1250.734285][ T7758] netlink: 'syz.3.9316': attribute type 1 has an invalid length. [ 1250.751221][ T7758] __nla_validate_parse: 2 callbacks suppressed [ 1250.751239][ T7758] netlink: 96 bytes leftover after parsing attributes in process `syz.3.9316'. [ 1250.791782][ T7758] netlink: 1 bytes leftover after parsing attributes in process `syz.3.9316'. [ 1250.800706][ T7758] netlink: 'syz.3.9316': attribute type 1 has an invalid length. [ 1250.842655][ T5843] Bluetooth: hci0: command tx timeout [ 1250.858156][ T7758] netlink: 'syz.3.9316': attribute type 8 has an invalid length. [ 1250.882789][ T7758] netlink: 606 bytes leftover after parsing attributes in process `syz.3.9316'. [ 1250.986476][ T7666] bridge0: port 1(bridge_slave_0) entered blocking state [ 1250.995806][ T7666] bridge0: port 1(bridge_slave_0) entered disabled state [ 1251.005923][ T7666] bridge_slave_0: entered allmulticast mode [ 1251.032188][ T7666] bridge_slave_0: entered promiscuous mode [ 1251.041476][ T7666] bridge0: port 2(bridge_slave_1) entered blocking state [ 1251.048853][ T7666] bridge0: port 2(bridge_slave_1) entered disabled state [ 1251.060543][ T7666] bridge_slave_1: entered allmulticast mode [ 1251.069835][ T7666] bridge_slave_1: entered promiscuous mode [ 1251.207602][ T7666] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1251.265161][ T7666] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1251.414438][ T7666] team0: Port device team_slave_0 added [ 1251.422293][ T7806] netlink: 'syz.4.9324': attribute type 1 has an invalid length. [ 1251.497276][ T7666] team0: Port device team_slave_1 added [ 1251.657560][ T7816] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9326'. [ 1251.726517][ T7666] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1251.760996][ T7666] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1251.792254][ T7820] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9327'. [ 1251.816336][ T7666] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1251.886680][ T7666] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1251.896713][ T7666] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1251.932449][ T7666] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1252.145001][ T7666] hsr_slave_0: entered promiscuous mode [ 1252.156337][ T7666] hsr_slave_1: entered promiscuous mode [ 1252.166895][ T7834] netlink: 'syz.0.9332': attribute type 9 has an invalid length. [ 1252.175211][ T7666] debugfs: 'hsr0' already exists in 'hsr' [ 1252.191907][ T7666] Cannot create hsr debugfs directory [ 1252.215312][ T7834] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9332'. [ 1252.236633][ T7834] nbd: must specify a size in bytes for the device [ 1252.307457][ T7838] netlink: 'syz.1.9334': attribute type 1 has an invalid length. [ 1252.316318][ T7838] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9334'. [ 1252.488358][ T7849] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9335'. [ 1252.510424][ T7849] IPv6: NLM_F_CREATE should be specified when creating new route [ 1252.525448][ T7849] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1252.532831][ T7849] IPv6: NLM_F_CREATE should be set when creating new route [ 1252.540163][ T7849] IPv6: NLM_F_CREATE should be set when creating new route [ 1252.917775][ T5843] Bluetooth: hci0: command tx timeout [ 1252.999361][ T7861] netlink: 'syz.0.9338': attribute type 9 has an invalid length. [ 1253.141246][ T7867] vcan0: tx drop: invalid sa for name 0xffffffffffffffff [ 1253.778293][ T7890] vxlan0: entered promiscuous mode [ 1253.805167][ T7890] vxlan0: entered allmulticast mode [ 1253.848129][ T7897] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.9345'. [ 1253.859314][ T3753] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1253.893754][ T3753] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1253.914429][ T7897] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1254.005892][ T3749] hsr_slave_0: left promiscuous mode [ 1254.051822][ T3749] hsr_slave_1: left promiscuous mode [ 1254.107512][ T3749] veth1: left promiscuous mode [ 1254.155223][ T3749] vlan0: left allmulticast mode [ 1254.160202][ T3749] veth0_vlan: left allmulticast mode [ 1254.181181][ T3749] vlan0: left promiscuous mode [ 1254.192017][ T3749] veth1_vlan: left allmulticast mode [ 1254.197606][ T3749] veth0_macvtap: left promiscuous mode [ 1254.219234][ T3749] veth1_vlan: left promiscuous mode [ 1254.225536][ T7909] netlink: 9 bytes leftover after parsing attributes in process `syz.4.9346'. [ 1254.498335][ T3749] pim6reg527 (unregistering): left allmulticast mode [ 1254.945469][ T3749] team0 (unregistering): Port device batadv2 removed [ 1254.960100][ T3749] team0 (unregistering): Port device batadv1 removed [ 1254.991107][ T5843] Bluetooth: hci0: command tx timeout [ 1255.385152][ T3761] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1255.408449][ T3761] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1255.437292][ T7909] gretap0: entered promiscuous mode [ 1255.498828][ T7910] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1255.790668][ T7937] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1255.808291][ T7937] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1255.839985][ T7937] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1255.868073][ T7937] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1255.902158][ T7666] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1255.915291][ T7666] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1255.927529][ T7666] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1255.940390][ T7666] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1256.092306][ T7666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1256.133361][ T7666] 8021q: adding VLAN 0 to HW filter on device team0 [ 1256.160511][T25739] bridge0: port 1(bridge_slave_0) entered blocking state [ 1256.168034][T25739] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1256.214490][T25739] bridge0: port 2(bridge_slave_1) entered blocking state [ 1256.221745][T25739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1256.499215][ T7969] __nla_validate_parse: 1 callbacks suppressed [ 1256.499237][ T7969] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.9361'. [ 1256.530423][ T7969] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1256.867011][ T7666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1256.905186][ T7991] vcan0: entered allmulticast mode [ 1256.997208][ T7996] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9365'. [ 1257.034395][ T7666] veth0_vlan: entered promiscuous mode [ 1257.097810][ T7666] veth1_vlan: entered promiscuous mode [ 1257.266189][ T7666] veth0_macvtap: entered promiscuous mode [ 1257.286958][ T7666] veth1_macvtap: entered promiscuous mode [ 1257.360091][ T7666] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1257.422776][ T7666] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1257.447553][T13889] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1257.489049][ T8021] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9373'. [ 1257.502758][T13889] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1257.523992][ T8022] netlink: 84 bytes leftover after parsing attributes in process `syz.1.9371'. [ 1257.535706][T13889] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1257.579430][T13889] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1257.675533][ T3749] IPVS: stop unused estimator thread 0... [ 1257.775873][ T8028] ip6tnl0: entered allmulticast mode [ 1257.799642][ T8028] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9375'. [ 1257.999858][T25739] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1258.044319][T25739] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1258.119338][ T3761] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1258.150983][ T3761] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1258.170242][ T8056] netlink: 'syz.1.9380': attribute type 1 has an invalid length. [ 1258.204299][ T8056] netlink: 'syz.1.9380': attribute type 4 has an invalid length. [ 1258.258852][ T8056] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.9380'. [ 1258.314046][ T8061] netlink: 48 bytes leftover after parsing attributes in process `syz.3.9381'. [ 1258.393974][ T8067] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9291'. [ 1258.480667][ T8067] syzkaller1: entered promiscuous mode [ 1258.491068][ T8067] syzkaller1: entered allmulticast mode [ 1258.559002][ T8071] netlink: 48 bytes leftover after parsing attributes in process `syz.3.9384'. [ 1258.588336][ T8073] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9383'. [ 1258.628353][ T8073] Cannot find add_set index 0 as target [ 1259.395340][ T8109] set match dimension is over the limit! [ 1259.713699][ T581] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1259.732223][ T581] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1259.774181][ T581] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1259.806337][ T581] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1259.814721][ T581] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1259.882165][ T8122] lo speed is unknown, defaulting to 1000 [ 1259.965038][ T8128] openvswitch: netlink: IP tunnel dst address not specified [ 1260.661729][ T8149] syzkaller0: entered promiscuous mode [ 1260.667306][ T8149] syzkaller0: entered allmulticast mode [ 1260.737852][T13429] IPVS: starting estimator thread 0... [ 1260.744817][ T8153] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1260.752927][ T8160] netlink: 'syz.4.9407': attribute type 23 has an invalid length. [ 1260.806568][ T8162] netlink: 'syz.0.9410': attribute type 3 has an invalid length. [ 1260.874508][ T8159] IPVS: using max 27 ests per chain, 64800 per kthread [ 1260.924789][ T8122] chnl_net:caif_netlink_parms(): no params data found [ 1261.129049][ T8175] netem: incorrect ge model size [ 1261.148590][ T8175] netem: change failed [ 1261.171965][ T8179] sctp: [Deprecated]: syz.3.9413 (pid 8179) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1261.171965][ T8179] Use struct sctp_sack_info instead [ 1261.261121][ T8122] bridge0: port 1(bridge_slave_0) entered blocking state [ 1261.268466][ T8122] bridge0: port 1(bridge_slave_0) entered disabled state [ 1261.276807][ T8122] bridge_slave_0: entered allmulticast mode [ 1261.293424][ T8122] bridge_slave_0: entered promiscuous mode [ 1261.308143][ T8122] bridge0: port 2(bridge_slave_1) entered blocking state [ 1261.327374][ T8122] bridge0: port 2(bridge_slave_1) entered disabled state [ 1261.346665][ T8122] bridge_slave_1: entered allmulticast mode [ 1261.358529][ T8122] bridge_slave_1: entered promiscuous mode [ 1261.578040][ T8122] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1261.596607][ T8122] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1261.714457][ T8122] team0: Port device team_slave_0 added [ 1261.739576][ T8122] team0: Port device team_slave_1 added [ 1261.802590][T25739] tipc: Subscription rejected, illegal request [ 1261.836905][ T8122] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1261.851667][ T8122] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1261.885013][ T581] Bluetooth: hci2: command tx timeout [ 1261.893111][ T8122] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1261.907746][ T8122] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1261.915565][ T8122] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1261.943783][ T8122] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1262.037981][ T8200] __nla_validate_parse: 7 callbacks suppressed [ 1262.038002][ T8200] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9420'. [ 1262.056294][ T8200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9420'. [ 1262.066128][ T8200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9420'. [ 1262.090072][ T8202] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9420'. [ 1262.114520][ T8122] hsr_slave_0: entered promiscuous mode [ 1262.130748][ T8122] hsr_slave_1: entered promiscuous mode [ 1262.165096][ T8122] debugfs: 'hsr0' already exists in 'hsr' [ 1262.212065][ T8122] Cannot create hsr debugfs directory [ 1262.259838][ T8206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9422'. [ 1262.324932][ T8209] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9423'. [ 1262.491330][ T8209] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1262.722888][ T8221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9426'. [ 1262.837089][ T8122] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1262.858077][ T8122] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.876491][ T8122] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 1263.001254][ T8122] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1263.024306][ T8122] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1263.051388][ T8122] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 1263.161956][ T8122] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1263.175199][ T8122] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1263.186126][ T8122] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 1263.283648][ T8122] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1263.298805][ T8122] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1263.320032][ T8122] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 1263.522985][ T8122] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1263.551249][ T8122] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1263.569012][ T8249] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9436'. [ 1263.589744][ T8122] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1263.616565][ T8122] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1263.650581][ T8254] netlink: 'syz.3.9438': attribute type 21 has an invalid length. [ 1263.685068][ T8253] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1263.700270][ T8254] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9438'. [ 1263.826982][ T8268] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 1263.885463][ T8273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9441'. [ 1263.911676][T13889] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1263.935440][T13889] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1263.958076][ T581] Bluetooth: hci2: command tx timeout [ 1263.983688][T13889] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1264.013986][T13889] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1264.093654][ T8122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1264.156962][ T8283] IPVS: set_ctl: invalid protocol: 33 224.0.0.1:20000 [ 1264.187310][ T8286] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1264.211857][ T8286] team0: Device macvlan3 is already an upper device of the team interface [ 1264.312108][ T8283] bridge0: entered promiscuous mode [ 1264.317416][ T8283] bridge0: entered allmulticast mode [ 1264.367055][ T8290] lo speed is unknown, defaulting to 1000 [ 1264.415906][ T8122] 8021q: adding VLAN 0 to HW filter on device team0 [ 1264.579314][ T8122] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1264.650897][ T8122] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1264.687246][T13899] bridge0: port 1(bridge_slave_0) entered blocking state [ 1264.694562][T13899] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1264.758271][T13899] bridge0: port 2(bridge_slave_1) entered blocking state [ 1264.765567][T13899] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1265.006807][ T8304] openvswitch: netlink: Message has 4 unknown bytes. [ 1265.020085][ T8308] x_tables: duplicate entry at hook 3 [ 1265.034481][ T8308] netlink: 'syz.2.9450': attribute type 21 has an invalid length. [ 1265.388926][ T8122] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1265.447408][ T8316] erspan0: entered promiscuous mode [ 1265.534606][ T8122] veth0_vlan: entered promiscuous mode [ 1265.549148][ T8122] veth1_vlan: entered promiscuous mode [ 1265.632912][ T8318] netlink: 'syz.2.9454': attribute type 4 has an invalid length. [ 1265.664065][ T8318] IPVS: set_ctl: invalid protocol: 255 127.0.0.1:20003 [ 1265.674590][ T8122] veth0_macvtap: entered promiscuous mode [ 1265.709009][ T8122] veth1_macvtap: entered promiscuous mode [ 1265.773247][ T8122] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1265.806182][ T8122] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1265.836096][T25769] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1265.847870][T25769] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1265.869641][T25769] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1265.928299][T13899] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1266.032360][ T581] Bluetooth: hci2: command tx timeout [ 1266.069950][ T8334] sctp: [Deprecated]: syz.0.9458 (pid 8334) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1266.069950][ T8334] Use struct sctp_sack_info instead [ 1266.099851][T13888] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1266.118809][T13888] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1266.194526][T13889] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1266.213999][T13889] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1266.333145][ T8344] mac80211_hwsim hwsim92 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1266.513018][ T8354] sctp: [Deprecated]: syz.1.9466 (pid 8354) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1266.513018][ T8354] Use struct sctp_sack_info instead [ 1266.646681][ T8359] netlink: Unknown conntrack attr (0) [ 1266.846727][ T8363] pim6reg1: entered promiscuous mode [ 1266.853145][ T8363] pim6reg1: entered allmulticast mode [ 1267.084422][ T8382] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1267.091746][ T8382] IPv6: NLM_F_CREATE should be set when creating new route [ 1267.099266][ T8382] IPv6: NLM_F_CREATE should be set when creating new route [ 1267.106590][ T8382] IPv6: NLM_F_CREATE should be set when creating new route [ 1267.131033][ T8383] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1267.227667][ T8389] __nla_validate_parse: 6 callbacks suppressed [ 1267.227690][ T8389] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9476'. [ 1267.294874][ T8389] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9476'. [ 1267.498158][ T8407] netlink: 14544 bytes leftover after parsing attributes in process `syz.4.9483'. [ 1267.537350][T13429] IPVS: starting estimator thread 0... [ 1267.545289][ T8405] nft_compat: unsupported protocol 0 [ 1267.631227][ T8418] IPVS: using max 26 ests per chain, 62400 per kthread [ 1267.773028][ T8426] netlink: 64 bytes leftover after parsing attributes in process `syz.3.9487'. [ 1267.838302][ T8425] syzkaller1: entered promiscuous mode [ 1267.846899][ T8425] syzkaller1: entered allmulticast mode [ 1268.111997][ T581] Bluetooth: hci2: command tx timeout [ 1268.242730][ T8451] IPVS: set_ctl: invalid protocol: 51 10.1.1.1:0 [ 1268.309523][ T8458] netlink: 'syz.0.9500': attribute type 11 has an invalid length. [ 1268.333860][ T8458] netlink: 228 bytes leftover after parsing attributes in process `syz.0.9500'. [ 1268.463200][ T8475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9498'. [ 1268.473528][T13888] nci: nci_rx_work: unknown MT 0x1 [ 1268.486276][ T8475] macvtap1: entered promiscuous mode [ 1268.493725][ T8475] vlan0: entered promiscuous mode [ 1268.499242][ T8475] macvtap1: entered allmulticast mode [ 1268.505619][ T8475] vlan0: entered allmulticast mode [ 1268.510785][ T8475] veth0_vlan: entered allmulticast mode [ 1269.268865][ T8495] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9509'. [ 1269.279273][ T8495] netlink: 'syz.0.9509': attribute type 3 has an invalid length. [ 1269.287389][ T8495] netlink: 'syz.0.9509': attribute type 1 has an invalid length. [ 1269.295485][ T8495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9509'. [ 1271.226313][ T8462] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1277.402530][ T7090] lec:lec_start_xmit: lec0:No lecd attached [ 1282.911931][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5510 ms [ 1282.920009][ C0] lec:lec_tx_timeout: lec0 [ 1292.343312][ T8509] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.9515'. [ 1292.363022][ T8511] netlink: 'syz.1.9513': attribute type 4 has an invalid length. [ 1292.662034][ T8532] netlink: 68 bytes leftover after parsing attributes in process `syz.2.9522'. [ 1292.739533][ T8538] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9523'. [ 1293.016331][ T8552] ip6t_REJECT: ECHOREPLY is not supported [ 1293.045928][ T8552] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9530'. [ 1293.236686][ T8571] netlink: 45 bytes leftover after parsing attributes in process `syz.3.9535'. [ 1293.253473][ T8572] netlink: 45 bytes leftover after parsing attributes in process `syz.3.9535'. [ 1293.303054][ T8573] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.9535'. [ 1293.567106][ T8585] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9540'. [ 1293.577612][ T8583] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9539'. [ 1293.624234][ T8583] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9539'. [ 1293.872211][ T8595] sctp: [Deprecated]: syz.1.9543 (pid 8595) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1293.872211][ T8595] Use struct sctp_sack_info instead [ 1294.378063][ T8640] netlink: 'syz.2.9561': attribute type 25 has an invalid length. [ 1294.485996][ T8646] x_tables: duplicate underflow at hook 2 [ 1294.773368][ T8662] vcan1: entered promiscuous mode [ 1294.796305][ T8662] vcan1: entered allmulticast mode [ 1294.967982][ T8672] netlink: 'syz.2.9573': attribute type 12 has an invalid length. [ 1294.976606][ T8672] netlink: 'syz.2.9573': attribute type 29 has an invalid length. [ 1295.365961][ T30] audit: type=1800 audit(1771908672.142:11): pid=8693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.9579" name="memory.events" dev="tmpfs" ino=762 res=0 errno=0 [ 1295.395623][ T8701] x_tables: duplicate entry at hook 3 [ 1295.523198][ T8693] netlink: 'syz.0.9579': attribute type 25 has an invalid length. [ 1295.703662][ T8710] netlink: 'syz.3.9583': attribute type 16 has an invalid length. [ 1295.725481][ T8710] netlink: 'syz.3.9583': attribute type 17 has an invalid length. [ 1295.875208][ T8710] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1296.127914][ T8729] udevd[8729]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1296.150771][ T8729] udevd[8729]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1296.213548][ T8741] netlink: 'syz.2.9590': attribute type 5 has an invalid length. [ 1296.403049][ T581] block nbd2: Receive control failed (result -32) [ 1296.562308][ T8759] : entered promiscuous mode [ 1296.693249][ T8767] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1297.334306][ T8802] lo speed is unknown, defaulting to 1000 [ 1297.407129][ T8807] __nla_validate_parse: 22 callbacks suppressed [ 1297.407151][ T8807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9608'. [ 1297.435572][ T8810] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9606'. [ 1297.526497][ T8812] xt_CT: No such helper "pptp" [ 1298.309366][ T8849] netlink: 'syz.1.9615': attribute type 5 has an invalid length. [ 1298.449770][ T8857] mac80211_hwsim hwsim96 wlan0: entered promiscuous mode [ 1298.987680][ T8892] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9629'. [ 1299.089823][ T8903] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9630'. [ 1299.099483][ T8904] netlink: 'syz.0.9631': attribute type 10 has an invalid length. [ 1299.119126][ T8904] bridge0: port 2(bridge_slave_1) entered disabled state [ 1299.126667][ T8904] bridge0: port 1(bridge_slave_0) entered disabled state [ 1299.186592][ T8904] bridge0: port 2(bridge_slave_1) entered blocking state [ 1299.193903][ T8904] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1299.201676][ T8904] bridge0: port 1(bridge_slave_0) entered blocking state [ 1299.208890][ T8904] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1299.222735][ T8904] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1299.396872][ T8912] syzkaller0: entered promiscuous mode [ 1299.431749][ T8912] syzkaller0: entered allmulticast mode [ 1299.734128][ T8944] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9640'. [ 1299.914526][ T8956] IPv6: sit1: Disabled Multicast RS [ 1299.930230][ T8956] sit1: entered allmulticast mode [ 1300.199183][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 1300.829283][ T8995] netlink: 48 bytes leftover after parsing attributes in process `syz.2.9658'. [ 1300.965169][ T9000] x_tables: duplicate underflow at hook 1 [ 1301.265495][ T9012] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1301.299640][ T9013] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9664'. [ 1301.343737][ T9014] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9664'. [ 1301.368822][ T9019] netlink: 'syz.4.9666': attribute type 1 has an invalid length. [ 1301.563991][ T9031] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9669'. [ 1301.609407][ T9033] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1301.820705][ T9044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9673'. [ 1302.002683][ T9045] netlink: 'syz.0.9674': attribute type 1 has an invalid length. [ 1302.066856][ T9045] bond3: entered promiscuous mode [ 1302.072681][ T9045] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1302.132379][ T9045] bond3: (slave bridge1): making interface the new active one [ 1302.140068][ T9045] bridge1: entered promiscuous mode [ 1302.147687][ T9045] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 1302.435528][ T9069] Bluetooth: MGMT ver 1.23 [ 1302.475784][ T9067] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 1302.649089][ T9076] __nla_validate_parse: 2 callbacks suppressed [ 1302.649111][ T9076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9684'. [ 1303.073323][ T9094] netlink: 'syz.4.9690': attribute type 3 has an invalid length. [ 1303.082007][ T9100] lo speed is unknown, defaulting to 1000 [ 1303.125483][ T9094] netlink: 'syz.4.9690': attribute type 1 has an invalid length. [ 1303.160630][ T9094] netlink: 60387 bytes leftover after parsing attributes in process `syz.4.9690'. [ 1303.207599][ T9104] bond3: option packets_per_slave: invalid value (18446744073709551615) [ 1303.219242][ T9104] bond3: option packets_per_slave: allowed values 0 - 65535 [ 1303.258035][ T9104] bond3 (unregistering): Released all slaves [ 1303.357831][ T9114] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1303.474382][ T9113] syzkaller0: entered promiscuous mode [ 1303.490236][ T9113] syzkaller0: entered allmulticast mode [ 1303.775035][ T9122] IPv6: NLM_F_CREATE should be specified when creating new route [ 1304.204691][ T9140] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9700'. [ 1304.253440][ T9140] nbd: must specify at least one socket [ 1304.601436][ T9153] RDS: rds_bind could not find a transport for ::ffff:172.30.0.1, load rds_tcp or rds_rdma? [ 1304.647133][ T9158] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1304.875891][ T9164] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9706'. [ 1305.477262][ T9168] syzkaller0: entered promiscuous mode [ 1305.497244][ T9168] syzkaller0: entered allmulticast mode [ 1305.645472][ T9202] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9715'. [ 1305.880943][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5680 ms [ 1305.889066][ C0] lec:lec_tx_timeout: lec0 [ 1307.996477][ T9217] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9719'. [ 1308.018449][ T9224] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 1308.092524][ T9217] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9719'. [ 1308.122083][ T9230] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9724'. [ 1308.133197][ T9230] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9724'. [ 1308.263071][ T9239] netlink: 'syz.2.9727': attribute type 6 has an invalid length. [ 1308.273875][ T9239] atomic_op ffff88804f64a998 conn xmit_atomic 0000000000000000 [ 1308.606578][ T9264] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9732'. [ 1308.637221][ T9265] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9734'. [ 1308.737481][ T9269] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9735'. [ 1308.801989][ T9271] sctp: [Deprecated]: syz.3.9736 (pid 9271) Use of int in max_burst socket option. [ 1308.801989][ T9271] Use struct sctp_assoc_value instead [ 1309.006340][ T9281] bridge0: port 1(bridge_slave_0) entered disabled state [ 1309.016470][ T9281] bridge0: port 2(bridge_slave_1) entered disabled state [ 1309.134145][ T9292] netlink: 'syz.4.9740': attribute type 3 has an invalid length. [ 1309.350162][ T9306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9744'. [ 1309.567802][ T9312] lo speed is unknown, defaulting to 1000 [ 1309.715231][ T9329] dvmrp0: entered allmulticast mode [ 1310.148815][ T9340] lo: entered promiscuous mode [ 1310.202168][ T9340] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1310.458079][ T9352] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9755'. [ 1310.625521][ T9356] netlink: 'syz.0.9757': attribute type 1 has an invalid length. [ 1310.634081][ T9356] netlink: 16179 bytes leftover after parsing attributes in process `syz.0.9757'. [ 1310.886167][ T9373] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1311.149646][ T9391] netlink: Unknown conntrack attr (0) [ 1311.824320][ T9434] syzkaller0: entered promiscuous mode [ 1311.872731][ T9434] syzkaller0: entered allmulticast mode [ 1312.514396][ T581] Bluetooth: hci4: command 0x0406 tx timeout [ 1312.591941][ T9479] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1312.645439][ T9481] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1312.806233][ T9491] netlink: 'syz.3.9798': attribute type 1 has an invalid length. [ 1313.062257][ T9508] delete_channel: no stack [ 1313.088583][ T9511] __nla_validate_parse: 14 callbacks suppressed [ 1313.088606][ T9511] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9805'. [ 1313.196041][ T9505] netlink: 'syz.3.9803': attribute type 1 has an invalid length. [ 1313.246142][ T9514] vlan2: entered allmulticast mode [ 1313.255214][ T9510] x_tables: duplicate underflow at hook 3 [ 1313.304745][ T9517] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1313.651710][ T9549] IPv6: Can't replace route, no match found [ 1313.668595][ T9549] IPv6: Can't replace route, no match found [ 1314.041826][ T9565] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9819'. [ 1314.052307][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9819'. [ 1314.068843][ T9566] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 1314.083284][ T9566] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1314.092009][ T9566] gretap1: entered promiscuous mode [ 1314.097324][ T9566] gretap1: entered allmulticast mode [ 1314.145798][ T9568] macvtap2: entered allmulticast mode [ 1314.152221][ T9568] veth0_macvtap: entered allmulticast mode [ 1314.232631][ T9572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9822'. [ 1314.243840][ T9572] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9822'. [ 1314.254632][ T9572] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9822'. [ 1314.316600][ T9572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9822'. [ 1314.328991][ T9575] netlink: 116 bytes leftover after parsing attributes in process `syz.3.9823'. [ 1314.331445][ T9572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9822'. [ 1314.463845][ T9580] netlink: 'syz.3.9826': attribute type 3 has an invalid length. [ 1314.484851][ T9580] netlink: 'syz.3.9826': attribute type 3 has an invalid length. [ 1314.506582][ T9580] netlink: 68 bytes leftover after parsing attributes in process `syz.3.9826'. [ 1314.803864][ T9600] netlink: 'syz.0.9832': attribute type 11 has an invalid length. [ 1315.310179][ T9636] netlink: 'syz.4.9840': attribute type 33 has an invalid length. [ 1315.353277][ T9628] netlink: 'syz.4.9840': attribute type 33 has an invalid length. [ 1315.500295][ T9641] netlink: 'syz.2.9844': attribute type 1 has an invalid length. [ 1315.747939][ T9652] xt_HMARK: spi-set and port-set can't be combined [ 1315.754149][ T9651] netlink: 'syz.0.9849': attribute type 9 has an invalid length. [ 1315.783781][ T9651] netlink: 'syz.0.9849': attribute type 11 has an invalid length. [ 1315.797511][ T9651] netlink: 'syz.0.9849': attribute type 12 has an invalid length. [ 1316.773994][ T9718] bond1: Invalid ad_actor_system MAC address. [ 1316.780154][ T9718] bond1: option ad_actor_system: invalid value (1) [ 1316.814795][ T9718] bond1 (unregistering): Released all slaves [ 1317.352471][ T9759] tipc: Started in network mode [ 1317.357418][ T9759] tipc: Node identity d27fb7949277, cluster identity 4711 [ 1317.371866][ T9759] tipc: Enabled bearer , priority 0 [ 1317.454420][ T9765] IPVS: persistence engine module ip_vs_pe_H not found [ 1317.913668][ T9799] sctp: [Deprecated]: syz.4.9888 (pid 9799) Use of int in max_burst socket option. [ 1317.913668][ T9799] Use struct sctp_assoc_value instead [ 1318.136100][ T9813] __nla_validate_parse: 22 callbacks suppressed [ 1318.136121][ T9813] netlink: 84 bytes leftover after parsing attributes in process `syz.4.9892'. [ 1318.193729][ T9758] tipc: Disabling bearer [ 1318.242025][ T9823] netlink: 388 bytes leftover after parsing attributes in process `syz.2.9893'. [ 1318.512916][T13888] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1318.551090][T13888] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1318.577282][T13888] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1318.586789][T13888] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1318.605888][ T9839] netlink: 48 bytes leftover after parsing attributes in process `syz.4.9900'. [ 1319.011813][ T9870] xt_hashlimit: size too large, truncated to 1048576 [ 1319.072839][ T9866] netlink: 576 bytes leftover after parsing attributes in process `syz.1.9910'. [ 1319.211294][ T9880] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9915'. [ 1319.435310][ T9894] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9919'. [ 1319.439023][ T9893] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9919'. [ 1319.679316][ T9906] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9924'. [ 1319.829617][ T9909] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0xc9 [ 1320.047304][ T9922] delete_channel: no stack [ 1320.142953][ T9927] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9931'. [ 1320.614685][ T9950] netlink: 'syz.3.9938': attribute type 39 has an invalid length. [ 1320.746269][ T9956] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9940'. [ 1320.967634][ T9972] netlink: 'syz.3.9944': attribute type 21 has an invalid length. [ 1321.080546][ T9972] bond3: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 1321.104357][ T9972] bond3 (unregistering): Released all slaves [ 1321.145328][ T9978] Cannot find del_set index 4 as target [ 1321.169773][ T9978] netlink: 'syz.1.9946': attribute type 30 has an invalid length. [ 1321.694810][ T1778] IPVS: starting estimator thread 0... [ 1321.707470][T10008] IPv6: NLM_F_CREATE should be specified when creating new route [ 1321.803143][T10009] IPVS: using max 26 ests per chain, 62400 per kthread [ 1321.915064][T10020] openvswitch: netlink: Invalid VLAN frame [ 1322.303216][T10045] wireguard0: entered promiscuous mode [ 1322.312310][T10045] wireguard0: entered allmulticast mode [ 1322.347004][T10045] team0: Device wireguard0 is of different type [ 1322.370713][T10040] netlink: set zone limit has 4 unknown bytes [ 1322.635049][T10058] netlink: 'syz.4.9973': attribute type 1 has an invalid length. [ 1322.668713][T10058] bond3: entered promiscuous mode [ 1322.675970][T10058] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1322.777731][T10058] bond3: (slave bridge3): making interface the new active one [ 1322.811137][T10058] bridge3: entered promiscuous mode [ 1322.817936][T10058] bond3: (slave bridge3): Enslaving as an active interface with an up link [ 1322.899709][T10069] netlink: 'syz.2.9977': attribute type 1 has an invalid length. [ 1322.909675][T10068] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1323.004645][T10076] vcan1: entered promiscuous mode [ 1323.009839][T10076] vcan1: entered allmulticast mode [ 1323.137819][T10084] netlink: 'syz.0.9982': attribute type 21 has an invalid length. [ 1323.162141][T10084] __nla_validate_parse: 10 callbacks suppressed [ 1323.162162][T10084] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9982'. [ 1323.272728][T10080] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1323.336095][T10100] openvswitch: netlink: Message has 8 unknown bytes. [ 1323.345667][T10100] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1323.929711][T10145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9996'. [ 1324.015919][T10151] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9998'. [ 1324.645516][T10180] netlink: 'syz.3.10008': attribute type 1 has an invalid length. [ 1324.663795][T10181] batman_adv: batadv0: Adding interface: dummy0 [ 1324.690228][T10181] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1324.777916][T10181] batman_adv: batadv0: Interface activated: dummy0 [ 1324.792080][T10188] netlink: 'syz.2.10009': attribute type 29 has an invalid length. [ 1324.806070][T10181] netlink: 5 bytes leftover after parsing attributes in process `syz.0.10007'. [ 1324.828766][T10188] netlink: 'syz.2.10009': attribute type 29 has an invalid length. [ 1324.836885][T10181] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 1324.858031][T10190] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10011'. [ 1324.902066][T10185] syzkaller0: entered promiscuous mode [ 1324.910018][T10185] syzkaller0: entered allmulticast mode [ 1325.085055][T10198] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1325.100533][T10203] openvswitch: netlink: Message has 8 unknown bytes. [ 1325.121989][T10203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1325.243532][T10203] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10014'. [ 1327.752135][T10185] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1327.788903][T10230] netlink: 256 bytes leftover after parsing attributes in process `syz.4.10023'. [ 1327.969265][T10243] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10024'. [ 1328.124460][T10251] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 1328.153443][T10249] netlink: 'syz.1.10028': attribute type 1 has an invalid length. [ 1328.176369][T10254] openvswitch: netlink: Key type 2208 is out of range max 32 [ 1328.235348][T10258] bond19: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1328.309649][T10258] bond19: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1328.330983][T10258] bond19: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 1328.453653][T10249] bond19: (slave vcan1): The slave device specified does not support setting the MAC address [ 1328.502472][T10249] bond19: (slave vcan1): making interface the new active one [ 1328.532509][T10249] bond19: (slave vcan1): Enslaving as an active interface with an up link [ 1328.664632][ T30] audit: type=1804 audit(1771908705.442:12): pid=10277 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.10038" name="/newroot/202/cgroup.controllers" dev="tmpfs" ino=1051 res=1 errno=0 [ 1328.740308][ T30] audit: type=1800 audit(1771908705.442:13): pid=10277 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.10038" name="cgroup.controllers" dev="tmpfs" ino=1051 res=0 errno=0 [ 1328.772845][T10270] syzkaller0: entered promiscuous mode [ 1328.778868][T10270] syzkaller0: entered allmulticast mode [ 1328.825011][T10270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10035'. [ 1328.855866][T10270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10035'. [ 1329.154335][T10312] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 1329.634853][T10323] bond20: entered promiscuous mode [ 1329.656344][T10323] macvlan2: entered promiscuous mode [ 1329.683361][T10323] macvlan2: entered allmulticast mode [ 1329.699716][T10323] bond20: (slave macvlan2): Opening slave failed [ 1329.904838][T10335] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10051'. [ 1329.909574][T10338] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10052'. [ 1330.112440][T10349] xt_hashlimit: size too large, truncated to 1048576 [ 1330.435302][T10376] netlink: 'syz.3.10061': attribute type 30 has an invalid length. [ 1330.592707][T10379] vlan2: entered allmulticast mode [ 1330.597914][T10379] geneve1: entered allmulticast mode [ 1330.663128][T10375] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1330.702212][T10375] syzkaller1: Refused to change device type [ 1331.553133][ T581] Bluetooth: hci4: command 0x0406 tx timeout [ 1331.559349][T10312] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 1331.566998][T10312] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 1331.641343][T10419] bridge2: entered promiscuous mode [ 1331.646717][T10419] bridge2: entered allmulticast mode [ 1331.683951][T10419] team0: Port device bridge2 added [ 1331.689438][T10420] bridge0: port 3(team0) entered blocking state [ 1331.700189][T10424] netlink: 96 bytes leftover after parsing attributes in process `syz.1.10074'. [ 1331.705883][T10420] bridge0: port 3(team0) entered disabled state [ 1331.720570][T10420] team0: entered allmulticast mode [ 1331.726894][T10420] team_slave_0: entered allmulticast mode [ 1331.734694][T10420] team_slave_1: entered allmulticast mode [ 1331.746604][T10420] team0: entered promiscuous mode [ 1331.752530][T10420] team_slave_0: entered promiscuous mode [ 1331.758466][T10420] team_slave_1: entered promiscuous mode [ 1331.767327][T10420] bridge0: port 3(team0) entered blocking state [ 1331.774245][T10420] bridge0: port 3(team0) entered forwarding state [ 1331.788328][T10424] 8021q: VLANs not supported on gre0 [ 1331.868123][T10429] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10076'. [ 1331.884765][T10429] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10076'. [ 1331.902483][T10429] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10076'. [ 1331.943159][T10429] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1331.965828][T10429] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1331.990431][T10429] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1332.000640][T10429] bridge0: port 3(team0) entered disabled state [ 1332.007236][T10429] bridge0: port 2(bridge_slave_1) entered disabled state [ 1332.014704][T10429] bridge0: port 1(bridge_slave_0) entered disabled state [ 1332.024624][T10438] netlink: 'syz.2.10079': attribute type 8 has an invalid length. [ 1332.044102][T10429] bond0 (unregistering): Released all slaves [ 1332.305046][T10447] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.10083'. [ 1332.437071][T10454] syzkaller0: entered promiscuous mode [ 1332.444607][T10454] syzkaller0: entered allmulticast mode [ 1332.541768][T10457] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10087'. [ 1332.787730][T10467] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 1332.992185][ T581] Bluetooth: hci1: command 0x0406 tx timeout [ 1333.028527][T10312] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1333.044944][T10485] netlink: 'syz.0.10095': attribute type 1 has an invalid length. [ 1333.052408][T10312] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1333.074133][T10485] erspan1: entered allmulticast mode [ 1333.162433][T10312] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1333.175176][T10312] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1333.352265][T10312] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1333.363748][T10312] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 1333.385233][T10488] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1333.515200][T10491] syzkaller1: entered promiscuous mode [ 1333.522449][T10312] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1333.528194][T10491] syzkaller1: entered allmulticast mode [ 1333.550675][T10312] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1334.072992][T10518] __nla_validate_parse: 3 callbacks suppressed [ 1334.073013][T10518] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10105'. [ 1334.135310][T25769] netdevsim netdevsim0 netdevsim0: set [1, 2] type 2 family 0 port 20002 - 0 [ 1334.167504][T25769] netdevsim netdevsim0 netdevsim1: set [1, 2] type 2 family 0 port 20002 - 0 [ 1334.181310][T25769] netdevsim netdevsim0 netdevsim2: set [1, 2] type 2 family 0 port 20002 - 0 [ 1334.227341][T25769] netdevsim netdevsim0 netdevsim3: set [1, 2] type 2 family 0 port 20002 - 0 [ 1334.259722][T10523] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10108'. [ 1334.482749][T10547] sctp: [Deprecated]: syz.3.10114 (pid 10547) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1334.482749][T10547] Use struct sctp_sack_info instead [ 1334.524755][T10547] sctp: [Deprecated]: syz.3.10114 (pid 10547) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1334.524755][T10547] Use struct sctp_sack_info instead [ 1334.602499][T10550] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 1335.018536][T10583] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.10127'. [ 1335.672387][T10579] FAULT_INJECTION: forcing a failure. [ 1335.672387][T10579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1335.705497][T10579] CPU: 0 UID: 0 PID: 10579 Comm: syz.1.10124 Not tainted syzkaller #0 PREEMPT(full) [ 1335.705527][T10579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1335.705540][T10579] Call Trace: [ 1335.705548][T10579] [ 1335.705558][T10579] dump_stack_lvl+0xe8/0x150 [ 1335.705593][T10579] should_fail_ex+0x412/0x560 [ 1335.705623][T10579] _copy_from_iter+0x1d3/0x1670 [ 1335.705653][T10579] ? rcu_is_watching+0x15/0xb0 [ 1335.705688][T10579] ? __pfx__copy_from_iter+0x10/0x10 [ 1335.705725][T10579] ? netlink_sendmsg+0x650/0xb40 [ 1335.705749][T10579] ? skb_put+0x11b/0x210 [ 1335.705782][T10579] netlink_sendmsg+0x6c0/0xb40 [ 1335.705819][T10579] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1335.705848][T10579] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1335.705875][T10579] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1335.705902][T10579] __sys_sendto+0x709/0x7a0 [ 1335.705935][T10579] ? __pfx___sys_sendto+0x10/0x10 [ 1335.705960][T10579] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1335.706008][T10579] ? __fget_files+0x3a0/0x420 [ 1335.706048][T10579] ? ksys_write+0x242/0x270 [ 1335.706074][T10579] ? __pfx_ksys_write+0x10/0x10 [ 1335.706101][T10579] __x64_sys_sendto+0xde/0x100 [ 1335.706134][T10579] do_syscall_64+0x14d/0xf80 [ 1335.706165][T10579] ? trace_irq_disable+0x3b/0x150 [ 1335.706196][T10579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.706217][T10579] ? clear_bhb_loop+0x40/0x90 [ 1335.706243][T10579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.706264][T10579] RIP: 0033:0x7fe41cb5cece [ 1335.706291][T10579] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1335.706310][T10579] RSP: 002b:00007fe41dad3e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1335.706333][T10579] RAX: ffffffffffffffda RBX: 00007fe41dad56c0 RCX: 00007fe41cb5cece [ 1335.706349][T10579] RDX: 0000000000000020 RSI: 00007fe41dad4000 RDI: 0000000000000004 [ 1335.706371][T10579] RBP: 0000000000000000 R08: 00007fe41dad3f04 R09: 000000000000000c [ 1335.706384][T10579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 1335.706397][T10579] R13: 00007fe41dad3f58 R14: 00007fe41dad4000 R15: 0000000000000000 [ 1335.706431][T10579] [ 1336.228747][T10642] netlink: 'syz.1.10147': attribute type 15 has an invalid length. [ 1336.246795][T10642] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10147'. [ 1336.551309][T10669] openvswitch: netlink: Flow key attr not present in new flow. [ 1336.647111][T10669] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1336.715705][T10669] netlink: 256 bytes leftover after parsing attributes in process `syz.1.10153'. [ 1336.749764][T10669] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10153'. [ 1336.922977][T10683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10159'. [ 1336.988771][T10687] tipc: Trying to set illegal importance in message [ 1337.023453][T10687] netlink: 'syz.1.10160': attribute type 17 has an invalid length. [ 1337.052774][T10687] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10160'. [ 1337.074140][T10687] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10160'. [ 1337.287201][T10708] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10166'. [ 1337.329454][T10708] netlink: 'syz.2.10166': attribute type 21 has an invalid length. [ 1337.405667][T10714] openvswitch: netlink: IP tunnel dst address not specified [ 1337.637031][T10719] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 1337.769847][T10736] bond0: entered promiscuous mode [ 1337.775583][T10736] bond0: entered allmulticast mode [ 1337.781798][T10736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1337.864269][T10737] bond4: entered promiscuous mode [ 1337.869376][T10737] bond4: entered allmulticast mode [ 1337.880322][T10737] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1338.227584][T10769] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1338.504359][T10792] netlink: 'syz.4.10189': attribute type 14 has an invalid length. [ 1338.534628][T10792] netlink: 'syz.4.10189': attribute type 14 has an invalid length. [ 1338.843809][T10815] tipc: Started in network mode [ 1338.848751][T10815] tipc: Node identity ac141441, cluster identity 4711 [ 1338.872316][T10815] tipc: Enabled bearer , priority 10 [ 1339.072917][T10830] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 1339.913370][T10888] __nla_validate_parse: 7 callbacks suppressed [ 1339.913393][T10888] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10210'. [ 1339.992483][T13428] tipc: Node number set to 2886997057 [ 1340.378092][T10912] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 1340.433445][T10917] netlink: 484 bytes leftover after parsing attributes in process `syz.0.10214'. [ 1340.931622][T10951] netlink: 52 bytes leftover after parsing attributes in process `syz.1.10228'. [ 1340.966885][T10958] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10227'. [ 1341.068536][T10962] team0 (unregistering): Port device team_slave_0 removed [ 1341.100151][T10962] team0 (unregistering): Port device team_slave_1 removed [ 1341.148347][T10968] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 1341.159690][T10968] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1341.195976][T10966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10231'. [ 1341.242455][T10966] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10231'. [ 1341.398053][T10981] netlink: 96 bytes leftover after parsing attributes in process `syz.4.10237'. [ 1341.427206][T10983] netlink: 'syz.1.10238': attribute type 10 has an invalid length. [ 1341.473758][T10981] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1341.491104][T10981] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1341.512423][T10983] netlink: 228 bytes leftover after parsing attributes in process `syz.1.10238'. [ 1341.552135][T10983] C: renamed from lo [ 1341.573216][T10983] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1341.635918][T10995] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10241'. [ 1341.685047][T11000] Unknown metaid 0 dlen 28 [ 1341.694246][T11000] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10242'. [ 1341.833976][T11014] netlink: 'syz.3.10246': attribute type 23 has an invalid length. [ 1341.876711][ T7090] lec:lec_start_xmit: lec0:No lecd attached [ 1341.964106][T11016] openvswitch: netlink: Flow key attr not present in new flow. [ 1342.162915][T11029] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1342.187292][T11029] netlink: 'syz.3.10252': attribute type 1 has an invalid length. [ 1342.210487][T11029] netlink: 'syz.3.10252': attribute type 2 has an invalid length. [ 1342.319949][T11048] netlink: 'syz.3.10252': attribute type 1 has an invalid length. [ 1342.342771][T11049] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 1342.350483][T11048] netlink: 'syz.3.10252': attribute type 2 has an invalid length. [ 1342.361655][T11051] ip6gre1: entered promiscuous mode [ 1342.376354][T11048] netlink: 'syz.3.10252': attribute type 1 has an invalid length. [ 1342.385018][T11048] netlink: 'syz.3.10252': attribute type 3 has an invalid length. [ 1342.480388][T11059] netlink: 'syz.1.10260': attribute type 62 has an invalid length. [ 1343.065927][T11080] syzkaller0: entered promiscuous mode [ 1343.093432][T11080] syzkaller0: entered allmulticast mode [ 1345.594636][T11134] __nla_validate_parse: 8 callbacks suppressed [ 1345.594659][T11134] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10280'. [ 1345.647016][T11138] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1345.657110][T11141] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10284'. [ 1345.684531][T11138] sctp: [Deprecated]: syz.0.10281 (pid 11138) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1345.684531][T11138] Use struct sctp_sack_info instead [ 1345.953194][T11159] team0: Device ip6gre1 is of different type [ 1346.216189][T11172] netlink: 36 bytes leftover after parsing attributes in process `syz.1.10293'. [ 1346.239710][T11175] netlink: 9 bytes leftover after parsing attributes in process `syz.4.10295'. [ 1346.280087][T11175] 0: renamed from hsr_slave_1 (while UP) [ 1346.303289][T11175] 0: entered allmulticast mode [ 1346.336777][T11175] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check. [ 1346.403883][T11180] netlink: 80 bytes leftover after parsing attributes in process `syz.1.10296'. [ 1346.438212][T11182] netlink: 64 bytes leftover after parsing attributes in process `syz.1.10296'. [ 1346.454830][T11176] lo speed is unknown, defaulting to 1000 [ 1346.458363][T11178] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1346.502841][T11178] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1346.873040][T11193] IPv6: NLM_F_CREATE should be specified when creating new route [ 1346.881377][T11193] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10300'. [ 1346.910821][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 1346.919062][ C0] lec:lec_tx_timeout: lec0 [ 1347.514842][T11225] netlink: 'syz.3.10310': attribute type 1 has an invalid length. [ 1347.535384][T11229] netlink: 'syz.3.10310': attribute type 1 has an invalid length. [ 1347.714497][T11240] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.10314'. [ 1347.813626][T11246] netlink: 'syz.4.10313': attribute type 17 has an invalid length. [ 1347.831504][T11246] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10313'. [ 1347.845908][T11246] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10313'. [ 1348.380376][T11276] wireguard0: entered promiscuous mode [ 1348.386611][T11276] wireguard0: entered allmulticast mode [ 1348.417076][T11276] team0: Device wireguard0 is of different type [ 1348.843942][T11300] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1348.886298][T11300] bond_slave_0: entered promiscuous mode [ 1348.892542][T11300] bond_slave_1: entered promiscuous mode [ 1348.934125][T11300] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1348.944825][T11300] bond21: (slave macvlan2): making interface the new active one [ 1348.968258][T11300] bond21: (slave macvlan2): Enslaving as an active interface with an up link [ 1349.315855][T11332] netlink: 'syz.1.10337': attribute type 1 has an invalid length. [ 1349.329163][T11324] ip6tnl0: Caught tx_queue_len zero misconfig [ 1349.376002][T11332] netlink: 'syz.1.10337': attribute type 1 has an invalid length. [ 1349.398749][T11334] IPVS: set_ctl: invalid protocol: 43 127.0.0.1:20001 [ 1350.107259][T11375] netlink: 'syz.0.10348': attribute type 2 has an invalid length. [ 1350.207536][T11379] netlink: 'syz.4.10347': attribute type 1 has an invalid length. [ 1350.241302][T11379] NCSI netlink: No device for ifindex 0 [ 1351.552368][T11448] __nla_validate_parse: 6 callbacks suppressed [ 1351.552390][T11448] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10369'. [ 1351.612923][T11455] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10370'. [ 1351.637096][T11448] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10369'. [ 1351.838583][T11463] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10374'. [ 1351.849643][T11463] openvswitch: netlink: Flow actions attr not present in new flow. [ 1352.157226][T11487] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1352.445632][T11520] netlink: 'syz.0.10392': attribute type 9 has an invalid length. [ 1352.465732][T11520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10392'. [ 1352.498129][T11521] netlink: 72 bytes leftover after parsing attributes in process `syz.0.10392'. [ 1352.545335][T11520] netlink: 'syz.0.10392': attribute type 9 has an invalid length. [ 1352.553654][T11525] tipc: Enabling of bearer rejected, media not registered [ 1352.562829][T11520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10392'. [ 1352.765642][T11538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10396'. [ 1352.787722][T11538] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10396'. [ 1352.800524][T11538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10396'. [ 1353.017672][T11541] tun0: tun_chr_ioctl cmd 1074025675 [ 1353.024400][T11541] tun0: persist enabled [ 1353.120160][T11557] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 1353.141479][T11552] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 1353.193818][T11552] netlink: 'syz.2.10401': attribute type 10 has an invalid length. [ 1353.275768][T11558] --map-set only usable from mangle table [ 1353.282801][T11560] macvtap1: entered promiscuous mode [ 1353.288668][T11560] vlan0: entered promiscuous mode [ 1353.296420][T11560] macvtap1: entered allmulticast mode [ 1353.302674][T11560] vlan0: entered allmulticast mode [ 1353.308131][T11560] veth0_vlan: entered allmulticast mode [ 1353.366297][T11552] bridge0: port 2(bridge_slave_1) entered disabled state [ 1353.418445][T11552] bridge_slave_1: left allmulticast mode [ 1353.439940][T11552] bridge_slave_1: left promiscuous mode [ 1353.456270][T11552] bridge0: port 2(bridge_slave_1) entered disabled state [ 1353.489189][T11552] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1353.511305][T11558] bridge_slave_1: entered promiscuous mode [ 1353.517269][T11558] bridge_slave_1: entered allmulticast mode [ 1353.942717][T11590] syzkaller0: entered promiscuous mode [ 1353.955691][T11590] syzkaller0: entered allmulticast mode [ 1354.085563][T11602] netlink: 'syz.0.10412': attribute type 1 has an invalid length. [ 1354.191582][T11606] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1354.255600][T11597] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1354.262755][T11608] netlink: 'syz.2.10413': attribute type 3 has an invalid length. [ 1354.544015][T11625] netlink: 'syz.1.10420': attribute type 2 has an invalid length. [ 1354.566997][T11625] netlink: 'syz.1.10420': attribute type 11 has an invalid length. [ 1354.893111][T11647] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 1354.982858][T11639] lo speed is unknown, defaulting to 1000 [ 1355.118604][T11659] atomic_op ffff88806323c998 conn xmit_atomic 0000000000000000 [ 1355.263507][T11666] veth0_to_bridge: mtu less than device minimum [ 1355.756868][T11692] xfrm0: entered promiscuous mode [ 1355.826199][T11697] openvswitch: netlink: IP tunnel dst address not specified [ 1356.687039][T13433] IPVS: starting estimator thread 0... [ 1356.694466][T11725] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1356.753803][T11735] __nla_validate_parse: 24 callbacks suppressed [ 1356.753827][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1356.811411][T11733] IPVS: using max 26 ests per chain, 62400 per kthread [ 1356.840130][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1356.880573][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1356.948994][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1356.988183][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.017045][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.067144][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.107399][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.140726][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.169178][T11735] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10453'. [ 1357.482390][T11774] netlink: 'syz.1.10463': attribute type 1 has an invalid length. [ 1357.582016][T11777] nbd0: detected capacity change from 127 to 0 [ 1358.276722][T11817] netlink: 'syz.4.10479': attribute type 1 has an invalid length. [ 1358.412890][T11817] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1358.493758][T11824] netlink: 'syz.3.10480': attribute type 10 has an invalid length. [ 1358.547515][T11828] syzkaller0: entered promiscuous mode [ 1358.561004][T11828] syzkaller0: entered allmulticast mode [ 1358.684743][T11841] netlink: 'syz.1.10486': attribute type 1 has an invalid length. [ 1358.701136][T11841] netlink: 'syz.1.10486': attribute type 7 has an invalid length. [ 1358.709235][T11841] netlink: 'syz.1.10486': attribute type 8 has an invalid length. [ 1358.883316][T11849] netdevsim netdevsim1: Firmware load for './file0/file0/..' refused, path contains '..' component [ 1359.055404][T11858] netlink: 'syz.1.10493': attribute type 39 has an invalid length. [ 1359.257428][T11864] ip6erspan0: entered allmulticast mode [ 1359.605414][T11879] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1359.615792][T11881] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1359.642651][T11880] netlink: 'syz.2.10500': attribute type 5 has an invalid length. [ 1360.197862][T11906] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1361.078445][T11949] netlink: 'syz.0.10519': attribute type 18 has an invalid length. [ 1361.640480][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 1362.835130][T11996] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 1362.882594][T11997] ip6gre1: entered promiscuous mode [ 1363.139434][T12009] __nla_validate_parse: 102 callbacks suppressed [ 1363.139469][T12009] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10531'. [ 1363.469671][T12032] netlink: 104 bytes leftover after parsing attributes in process `syz.4.10534'. [ 1363.543020][T12032] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10534'. [ 1364.004775][T12054] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10540'. [ 1364.336154][T12083] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10547'. [ 1364.399207][T12076] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 1364.465195][T12083] bond0 (unregistering): Released all slaves [ 1364.536761][T12097] block nbd0: reconnected socket [ 1364.542693][ T5843] block nbd0: Receive control failed (result -107) [ 1364.595698][T25769] bridge_slave_1: left allmulticast mode [ 1364.610221][T25769] bridge_slave_1: left promiscuous mode [ 1364.629731][T25769] bridge0: port 2(bridge_slave_1) entered disabled state [ 1364.698474][T12103] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10553'. [ 1364.708550][T25769] bridge_slave_0: left allmulticast mode [ 1364.708623][T25769] bridge_slave_0: left promiscuous mode [ 1364.708907][T25769] bridge0: port 1(bridge_slave_0) entered disabled state [ 1364.975509][T25769] bond6 (unregistering): (slave ip6gretap1): Releasing active interface [ 1365.084142][T25769] gretap0 (unregistering): left promiscuous mode [ 1365.156521][T25769] bond4 (unregistering): (slave geneve2): Releasing active interface [ 1365.396493][T12119] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10556'. [ 1365.398463][T12120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10556'. [ 1365.478943][T25769] bond10 (unregistering): (slave bridge7): Removing an active aggregator [ 1365.490942][T25769] bond10 (unregistering): (slave bridge7): Releasing backup interface [ 1365.499314][T25769] bond10 (unregistering): (slave bridge7): the permanent HWaddr of slave - 02:cc:bc:31:05:6e - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1365.578072][T25769] bond10 (unregistering): (slave bridge8): Releasing backup interface [ 1365.624675][T25769] bond11 (unregistering): (slave bridge9): Releasing backup interface [ 1365.633778][T25769] bridge9 (unregistering): left promiscuous mode [ 1365.685944][T25769] bond12 (unregistering): (slave bridge10): Releasing backup interface [ 1365.694650][T25769] bridge10 (unregistering): left promiscuous mode [ 1365.726438][T25769] bond0 (unregistering): left promiscuous mode [ 1365.732845][T25769] bond_slave_0: left promiscuous mode [ 1365.738392][T25769] bond_slave_1: left promiscuous mode [ 1365.751936][T25769] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1365.764595][T25769] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1365.775729][T25769] bond0 (unregistering): Released all slaves [ 1365.788335][T25769] bond1 (unregistering): Released all slaves [ 1365.805087][T25769] bond2 (unregistering): Released all slaves [ 1365.820402][T25769] bond3 (unregistering): Released all slaves [ 1365.835141][T25769] bond4 (unregistering): Released all slaves [ 1365.859830][T25769] bond5 (unregistering): (slave veth7): Releasing active interface [ 1365.871825][T25769] bond5 (unregistering): Released all slaves [ 1365.886268][T25769] bond6 (unregistering): Released all slaves [ 1365.902787][T25769] bond7 (unregistering): Released all slaves [ 1365.918847][T25769] bond8 (unregistering): Released all slaves [ 1365.938177][T25769] bond9 (unregistering): Released all slaves [ 1365.956890][T25769] bond10 (unregistering): Released all slaves [ 1365.978092][T25769] bond11 (unregistering): Released all slaves [ 1365.997671][T25769] bond12 (unregistering): Released all slaves [ 1366.024372][T25769] bond13 (unregistering): (slave bond14): Releasing active interface [ 1366.033649][T25769] bond13 (unregistering): Released all slaves [ 1366.048866][T25769] bond14 (unregistering): Released all slaves [ 1366.309548][T12128] x_tables: duplicate underflow at hook 4 [ 1366.363915][T25769] tipc: Left network mode [ 1366.420619][T12136] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10562'. [ 1366.462531][T12138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10563'. [ 1366.772684][T12164] netlink: 'syz.0.10568': attribute type 63 has an invalid length. [ 1366.781596][T12164] netlink: 'syz.0.10568': attribute type 63 has an invalid length. [ 1366.910830][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5270 ms [ 1366.918899][ C0] lec:lec_tx_timeout: lec0 [ 1367.809896][T12216] x_tables: duplicate underflow at hook 1 [ 1368.233320][T12237] __nla_validate_parse: 4 callbacks suppressed [ 1368.233341][T12237] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10587'. [ 1368.347183][T25769] hsr_slave_1: left promiscuous mode [ 1368.362058][T25769] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1368.380047][T25769] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1368.419931][T25769] veth1_macvtap: left promiscuous mode [ 1368.426314][T25769] veth0_macvtap: left promiscuous mode [ 1368.446742][T25769] veth1_vlan: left promiscuous mode [ 1368.453684][T25769] veth0_vlan: left promiscuous mode [ 1368.556685][T12257] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10592'. [ 1368.914762][T25769] team0 (unregistering): Port device team_slave_1 removed [ 1368.938918][T25769] team0 (unregistering): Port device team_slave_0 removed [ 1369.090419][T12251] tipc: New replicast peer: 255.255.255.255 [ 1369.106799][T12251] tipc: Enabled bearer , priority 10 [ 1369.114852][T12255] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10589'. [ 1369.118005][T12257] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1369.170931][T12257] netlink: 148 bytes leftover after parsing attributes in process `syz.0.10592'. [ 1369.198821][T12261] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1369.206297][T12261] IPv6: NLM_F_CREATE should be set when creating new route [ 1369.258166][T12261] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10593'. [ 1369.551149][T12281] sctp: [Deprecated]: syz.1.10599 (pid 12281) Use of int in maxseg socket option. [ 1369.551149][T12281] Use struct sctp_assoc_value instead [ 1369.839569][T25769] IPVS: stop unused estimator thread 0... [ 1370.041410][T12306] netlink: 'syz.2.10607': attribute type 142 has an invalid length. [ 1370.058998][T12306] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1370.130439][T12178] tipc: Node number set to 1074313108 [ 1370.287299][T13434] IPVS: starting estimator thread 0... [ 1370.373985][T12329] delete_channel: no stack [ 1370.381205][T12320] IPVS: using max 30 ests per chain, 72000 per kthread [ 1370.395454][T12329] netlink: 424 bytes leftover after parsing attributes in process `syz.4.10615'. [ 1370.659031][T12345] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1370.690927][T12345] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1370.726110][T12349] netlink: 'syz.1.10623': attribute type 29 has an invalid length. [ 1370.736160][T12350] netlink: 'syz.1.10623': attribute type 29 has an invalid length. [ 1370.745311][T12349] netlink: 500 bytes leftover after parsing attributes in process `syz.1.10623'. [ 1370.764394][T12349] unsupported nla_type 58 [ 1370.807447][T12352] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10624'. [ 1370.921138][T12357] tipc: Enabled bearer , priority 0 [ 1370.929267][T12357] syzkaller0: entered promiscuous mode [ 1370.935711][T12357] syzkaller0: entered allmulticast mode [ 1370.976833][T12357] tipc: Resetting bearer [ 1371.003633][T12357] netlink: 5 bytes leftover after parsing attributes in process `syz.1.10625'. [ 1371.022781][T12357] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 1371.053321][T12356] tipc: Resetting bearer [ 1371.064213][T12366] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10627'. [ 1371.098348][T12356] tipc: Disabling bearer [ 1371.392638][T12380] bond0: Unable to set up delay as MII monitoring is disabled [ 1371.425610][T12380] bond0 (unregistering): Released all slaves [ 1371.796819][T12419] netlink: 'syz.1.10637': attribute type 10 has an invalid length. [ 1372.053688][T12433] netlink: 'syz.1.10638': attribute type 33 has an invalid length. [ 1372.290949][T12443] netlink: 'syz.4.10641': attribute type 3 has an invalid length. [ 1372.299391][T12443] netlink: 'syz.4.10641': attribute type 2 has an invalid length. [ 1372.318853][T12433] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.465945][T12433] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.636473][T12433] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.750134][T12433] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.789818][T12468] ip6t_REJECT: ECHOREPLY is not supported [ 1372.942357][T25743] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1372.962582][T25743] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.007426][T25743] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.020089][T25743] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.201147][T12493] netlink: 'syz.4.10655': attribute type 3 has an invalid length. [ 1373.411893][T12505] netlink: 'syz.1.10662': attribute type 4 has an invalid length. [ 1373.540104][T12512] __nla_validate_parse: 20 callbacks suppressed [ 1373.540127][T12512] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10662'. [ 1373.670682][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805c4f3800: rx timeout, send abort [ 1373.681625][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805c4f3800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1373.819369][T12528] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1373.990171][T12537] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10671'. [ 1374.015727][T12537] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10671'. [ 1374.293163][T12532] bridge0: port 2(bridge_slave_1) entered disabled state [ 1374.300769][T12532] bridge0: port 1(bridge_slave_0) entered disabled state [ 1375.253291][T12537] geneve2: entered promiscuous mode [ 1375.258754][T12537] geneve2: entered allmulticast mode [ 1375.275079][T12542] geneve2: entered promiscuous mode [ 1375.283203][T13888] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.320947][T13888] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.353911][T13888] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.381139][T13888] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.390093][T13888] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 42858 - 0 [ 1375.405550][T13888] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 42858 - 0 [ 1375.414155][T13888] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 42858 - 0 [ 1375.423756][T13888] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 42858 - 0 [ 1375.495772][T12570] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10678'. [ 1375.626035][T12581] netlink: 100 bytes leftover after parsing attributes in process `syz.4.10684'. [ 1375.995077][T12607] bond3: Unable to set peer notification delay as MII monitoring is disabled [ 1376.023313][T12607] bond3 (unregistering): Released all slaves [ 1376.038023][T12618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10693'. [ 1376.085892][T12618] netlink: 44 bytes leftover after parsing attributes in process `syz.4.10693'. [ 1376.097293][T12618] netlink: 43 bytes leftover after parsing attributes in process `syz.4.10693'. [ 1376.108189][T12618] netlink: 'syz.4.10693': attribute type 6 has an invalid length. [ 1376.141588][T12618] netlink: 'syz.4.10693': attribute type 5 has an invalid length. [ 1376.166507][T12618] netlink: 43 bytes leftover after parsing attributes in process `syz.4.10693'. [ 1376.197126][T12626] netlink: 'syz.3.10692': attribute type 2 has an invalid length. [ 1376.227977][T12626] 9: entered promiscuous mode [ 1376.277877][T12630] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10695'. [ 1376.840225][T12653] xt_hashlimit: size too large, truncated to 1048576 [ 1377.372360][T12665] syz_tun: entered promiscuous mode [ 1377.378098][T12665] macvtap1: entered promiscuous mode [ 1377.395781][T12665] syz_tun: left promiscuous mode [ 1377.426814][T12672] netlink: 'syz.4.10708': attribute type 62 has an invalid length. [ 1377.634259][T12671] syzkaller0: entered promiscuous mode [ 1377.648510][T12671] syzkaller0: entered allmulticast mode [ 1378.039646][T12700] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1380.034120][T12707] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1380.040135][T12707] syzkaller1: linktype set to 823 [ 1380.050705][T12712] __nla_validate_parse: 2 callbacks suppressed [ 1380.050724][T12712] netlink: 81 bytes leftover after parsing attributes in process `syz.3.10717'. [ 1380.156645][T12729] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10723'. [ 1380.273905][T12736] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10722'. [ 1380.315145][T12736] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10722'. [ 1380.316008][T12738] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10724'. [ 1380.361041][T12738] openvswitch: netlink: Flow actions attr not present in new flow. [ 1380.479130][T12749] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.10727'. [ 1380.516459][T12749] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1380.548818][T12749] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10727'. [ 1380.575165][T12755] netlink: 'syz.2.10729': attribute type 10 has an invalid length. [ 1380.689685][T12755] xt_HMARK: proto mask must be zero with L3 mode [ 1380.718775][T12762] netlink: 'syz.2.10729': attribute type 1 has an invalid length. [ 1380.726891][T12762] netlink: 228 bytes leftover after parsing attributes in process `syz.2.10729'. [ 1380.760965][T12762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10729'. [ 1380.796337][T12755] netlink: 'syz.2.10729': attribute type 1 has an invalid length. [ 1380.816007][T12755] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10729'. [ 1381.006017][T12775] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2 [ 1381.265864][T12790] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1381.280489][T12790] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1381.571499][T12802] openvswitch: netlink: Message has 4 unknown bytes. [ 1381.646347][T12808] netlink: 'syz.4.10749': attribute type 21 has an invalid length. [ 1381.657738][T12808] netlink: 'syz.4.10749': attribute type 4 has an invalid length. [ 1381.666386][T12808] netlink: 'syz.4.10749': attribute type 5 has an invalid length. [ 1381.676479][T12808] netlink: 'syz.4.10749': attribute type 21 has an invalid length. [ 1381.685823][T12808] netlink: 'syz.4.10749': attribute type 4 has an invalid length. [ 1381.700940][T12808] netlink: 'syz.4.10749': attribute type 5 has an invalid length. [ 1381.737735][T12810] bond22 (unregistering): Released all slaves [ 1382.001308][T12818] bond0: entered promiscuous mode [ 1382.006500][T12818] bond0: entered allmulticast mode [ 1382.017274][T12818] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1382.033885][T12829] macvlan2: entered promiscuous mode [ 1382.039358][T12829] macvlan2: entered allmulticast mode [ 1382.047283][T12829] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1382.094833][T12826] syzkaller1: entered promiscuous mode [ 1382.100496][T12826] syzkaller1: entered allmulticast mode [ 1382.700018][T12873] IPVS: set_ctl: invalid protocol: 136 100.1.1.1:20002 [ 1382.827007][T12877] validate_nla: 1 callbacks suppressed [ 1382.827029][T12877] netlink: 'syz.2.10770': attribute type 33 has an invalid length. [ 1382.947512][T12886] bond6: option mode: invalid value (133) [ 1382.983219][T12886] bond6 (unregistering): Released all slaves [ 1383.026266][T12891] netlink: 'syz.3.10773': attribute type 11 has an invalid length. [ 1383.575026][T12910] can: request_module (can-proto-0) failed. [ 1383.864891][T12929] bond6 (unregistering): Released all slaves [ 1384.626619][T12969] lo speed is unknown, defaulting to 1000 [ 1385.129379][T13008] __nla_validate_parse: 18 callbacks suppressed [ 1385.129401][T13008] netlink: 84 bytes leftover after parsing attributes in process `syz.1.10814'. [ 1385.149404][T13008] netlink: 'syz.1.10814': attribute type 39 has an invalid length. [ 1385.444408][T13024] SET target dimension over the limit! [ 1385.510509][T13024] bond22: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1385.572713][T13024] bond22 (unregistering): Released all slaves [ 1386.033224][T13066] netlink: 'syz.4.10830': attribute type 3 has an invalid length. [ 1386.329097][T13075] lo: left promiscuous mode [ 1386.354745][T13075] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1386.378324][T13073] netlink: 'syz.4.10831': attribute type 12 has an invalid length. [ 1386.387763][T13073] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10831'. [ 1405.447572][ T7090] lec:lec_start_xmit: lec0:No lecd attached [ 1407.966351][T13091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10837'. [ 1407.996675][T13091] vlan2: entered allmulticast mode [ 1408.002041][T13091] mac80211_hwsim hwsim88 wlan0: entered allmulticast mode [ 1408.018418][T13094] batadv_slave_1: default FDB implementation only supports local addresses [ 1408.213215][T13096] nbd5: detected capacity change from 0 to 127 [ 1408.757158][T13124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10848'. [ 1408.768065][T13124] netlink: 'syz.3.10848': attribute type 5 has an invalid length. [ 1408.776308][T13124] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10848'. [ 1408.796675][T13124] geneve3: entered promiscuous mode [ 1408.802983][T13124] geneve3: entered allmulticast mode [ 1408.810167][T25743] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 1408.823694][ T5843] block nbd5: Receive control failed (result -104) [ 1408.845888][T25743] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1408.874978][T25743] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1408.901842][T25743] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1409.157601][T13141] netlink: 'syz.2.10854': attribute type 1 has an invalid length. [ 1409.168771][T13144] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10853'. [ 1409.253212][T13150] macsec2: entered promiscuous mode [ 1409.318555][T13151] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10853'. [ 1409.352989][T13144] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10853'. [ 1409.563042][T13167] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.10862'. [ 1409.719212][T13171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10863'. [ 1409.748720][T13171] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10863'. [ 1409.779821][T13175] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10865'. [ 1410.155802][T13187] syzkaller0: entered promiscuous mode [ 1410.166158][T13187] syzkaller0: entered allmulticast mode [ 1410.323131][T13200] vlan2: entered allmulticast mode [ 1410.328513][T13200] mac80211_hwsim hwsim96 wlan0: entered allmulticast mode [ 1410.400444][T13204] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1410.621989][T13210] netlink: 'syz.3.10877': attribute type 10 has an invalid length. [ 1410.684405][T13206] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:20003 [ 1410.698467][T13215] netlink: 'syz.1.10879': attribute type 21 has an invalid length. [ 1410.910966][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5460 ms [ 1410.919106][ C0] lec:lec_tx_timeout: lec0 [ 1411.025135][T13232] netlink: 'syz.4.10887': attribute type 3 has an invalid length. [ 1411.201442][T13250] FAULT_INJECTION: forcing a failure. [ 1411.201442][T13250] name failslab, interval 1, probability 0, space 0, times 0 [ 1411.218109][T13888] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1411.224558][T13250] CPU: 0 UID: 0 PID: 13250 Comm: syz.3.10892 Not tainted syzkaller #0 PREEMPT(full) [ 1411.224636][T13250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1411.224670][T13250] Call Trace: [ 1411.224692][T13250] [ 1411.224722][T13250] dump_stack_lvl+0xe8/0x150 [ 1411.224810][T13250] should_fail_ex+0x412/0x560 [ 1411.224895][T13250] should_failslab+0xa8/0x100 [ 1411.224971][T13250] __kmalloc_cache_noprof+0x88/0x660 [ 1411.225029][T13250] ? sctp_association_new+0x89/0x25e0 [ 1411.225128][T13250] sctp_association_new+0x89/0x25e0 [ 1411.225230][T13250] ? sctp_do_bind+0x661/0x9d0 [ 1411.225341][T13250] sctp_connect_new_asoc+0x2e4/0x6b0 [ 1411.225435][T13250] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1411.225538][T13250] ? __local_bh_enable_ip+0xd0/0x130 [ 1411.225598][T13250] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1411.225662][T13250] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1411.225758][T13250] sctp_sendmsg+0x1528/0x2c10 [ 1411.225877][T13250] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1411.225962][T13250] ? aa_sk_perm+0x15a/0x960 [ 1411.226026][T13250] ? aa_sk_perm+0x82d/0x960 [ 1411.226104][T13250] ? __pfx_aa_sk_perm+0x10/0x10 [ 1411.226177][T13250] ? sock_rps_record_flow+0x19/0x400 [ 1411.226264][T13250] ? inet_sendmsg+0x2f4/0x370 [ 1411.226338][T13250] __sys_sendto+0x627/0x7a0 [ 1411.226369][T13250] ? __pfx___sys_sendto+0x10/0x10 [ 1411.226393][T13250] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1411.226439][T13250] ? __fget_files+0x3a0/0x420 [ 1411.226481][T13250] ? ksys_write+0x242/0x270 [ 1411.226506][T13250] ? __pfx_ksys_write+0x10/0x10 [ 1411.226533][T13250] __x64_sys_sendto+0xde/0x100 [ 1411.226565][T13250] do_syscall_64+0x14d/0xf80 [ 1411.226596][T13250] ? trace_irq_disable+0x3b/0x150 [ 1411.226625][T13250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1411.226647][T13250] ? clear_bhb_loop+0x40/0x90 [ 1411.226673][T13250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1411.226695][T13250] RIP: 0033:0x7fea4a39c629 [ 1411.226716][T13250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1411.226734][T13250] RSP: 002b:00007fea4b1d7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1411.226756][T13250] RAX: ffffffffffffffda RBX: 00007fea4a615fa0 RCX: 00007fea4a39c629 [ 1411.226771][T13250] RDX: 0000000000000003 RSI: 0000200000000640 RDI: 0000000000000003 [ 1411.226784][T13250] RBP: 00007fea4b1d7090 R08: 0000200000000680 R09: 0000000000000010 [ 1411.226825][T13250] R10: 0000000004004084 R11: 0000000000000246 R12: 0000000000000001 [ 1411.226866][T13250] R13: 00007fea4a616038 R14: 00007fea4a615fa0 R15: 00007ffcd9a260a8 [ 1411.226941][T13250] [ 1411.518300][T13888] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1411.582363][T13257] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1411.620891][T13888] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1411.641811][T13888] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1411.682278][T13257] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1412.133516][T13295] xt_l2tp: unknown flags: 10 [ 1412.138417][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.138417][T13296] Use struct sctp_assoc_value instead [ 1412.184427][T13295] xt_l2tp: unknown flags: 10 [ 1412.188303][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.188303][T13296] Use struct sctp_assoc_value instead [ 1412.215817][T13295] xt_l2tp: unknown flags: 10 [ 1412.223900][T13295] xt_l2tp: unknown flags: 10 [ 1412.228496][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.228496][T13296] Use struct sctp_assoc_value instead [ 1412.228558][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.228558][T13296] Use struct sctp_assoc_value instead [ 1412.228585][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.228585][T13296] Use struct sctp_assoc_value instead [ 1412.274725][T13295] xt_l2tp: unknown flags: 10 [ 1412.288587][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.288587][T13296] Use struct sctp_assoc_value instead [ 1412.304218][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.304218][T13296] Use struct sctp_assoc_value instead [ 1412.319582][T13295] xt_l2tp: unknown flags: 10 [ 1412.344968][T13295] xt_l2tp: unknown flags: 10 [ 1412.356069][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.356069][T13296] Use struct sctp_assoc_value instead [ 1412.385607][T13295] xt_l2tp: unknown flags: 10 [ 1412.393213][T13295] xt_l2tp: unknown flags: 10 [ 1412.394428][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.394428][T13296] Use struct sctp_assoc_value instead [ 1412.430177][T13296] sctp: [Deprecated]: syz.1.10906 (pid 13296) Use of int in max_burst socket option. [ 1412.430177][T13296] Use struct sctp_assoc_value instead [ 1412.467946][T13295] xt_l2tp: unknown flags: 10 [ 1412.486890][T13311] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1412.879824][T13335] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1412.973443][T13335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1413.037832][T13341] erspan0: entered promiscuous mode [ 1413.048781][T13350] netlink: 'syz.2.10924': attribute type 2 has an invalid length. [ 1413.079765][T13350] __nla_validate_parse: 11 callbacks suppressed [ 1413.079791][T13350] netlink: 188 bytes leftover after parsing attributes in process `syz.2.10924'. [ 1413.098877][T13341] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10920'. [ 1413.189044][T13350] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1413.246375][T13357] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10927'. [ 1413.334619][T13366] netlink: 'syz.2.10929': attribute type 1 has an invalid length. [ 1413.342891][T13366] netlink: 2108 bytes leftover after parsing attributes in process `syz.2.10929'. [ 1413.618188][T13377] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10932'. [ 1413.632894][T13381] xt_ecn: cannot match TCP bits for non-tcp packets [ 1413.655012][T13377] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10932'. [ 1413.704319][T13384] netlink: 104 bytes leftover after parsing attributes in process `syz.1.10935'. [ 1413.846737][T13395] netlink: 'syz.4.10938': attribute type 2 has an invalid length. [ 1414.158071][T13417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10944'. [ 1414.192131][T13421] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10945'. [ 1414.334859][T13426] netlink: 'syz.4.10947': attribute type 5 has an invalid length. [ 1414.415350][T13426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1414.456824][T13426] bond4: (slave bond0): Enslaving as a backup interface with an up link [ 1414.631818][T13454] netlink: 348 bytes leftover after parsing attributes in process `syz.3.10952'. [ 1414.650436][T13454] netlink: 'syz.3.10952': attribute type 11 has an invalid length. [ 1414.839528][T13467] bond6: Unable to set down delay as MII monitoring is disabled [ 1414.849298][T13467] bond6 (unregistering): Released all slaves [ 1415.033705][T13477] FAULT_INJECTION: forcing a failure. [ 1415.033705][T13477] name failslab, interval 1, probability 0, space 0, times 0 [ 1415.047969][T13477] CPU: 0 UID: 0 PID: 13477 Comm: syz.4.10960 Not tainted syzkaller #0 PREEMPT(full) [ 1415.047991][T13477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1415.048001][T13477] Call Trace: [ 1415.048007][T13477] [ 1415.048015][T13477] dump_stack_lvl+0xe8/0x150 [ 1415.048041][T13477] should_fail_ex+0x412/0x560 [ 1415.048063][T13477] should_failslab+0xa8/0x100 [ 1415.048083][T13477] __kmalloc_cache_noprof+0x88/0x660 [ 1415.048100][T13477] ? sctp_add_bind_addr+0x8c/0x370 [ 1415.048130][T13477] sctp_add_bind_addr+0x8c/0x370 [ 1415.048153][T13477] sctp_copy_local_addr_list+0x314/0x4f0 [ 1415.048174][T13477] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1415.048194][T13477] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1415.048216][T13477] ? sctp_v4_is_any+0x35/0x60 [ 1415.048234][T13477] ? sctp_copy_one_addr+0x93/0x360 [ 1415.048256][T13477] sctp_bind_addr_copy+0xb3/0x3c0 [ 1415.048274][T13477] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1415.048294][T13477] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1415.048320][T13477] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1415.048347][T13477] ? __local_bh_enable_ip+0xd0/0x130 [ 1415.048367][T13477] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1415.048388][T13477] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1415.048444][T13477] sctp_sendmsg+0x1528/0x2c10 [ 1415.048490][T13477] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1415.048519][T13477] ? aa_sk_perm+0x15a/0x960 [ 1415.048544][T13477] ? aa_sk_perm+0x82d/0x960 [ 1415.048577][T13477] ? __pfx_aa_sk_perm+0x10/0x10 [ 1415.048609][T13477] ? sock_rps_record_flow+0x19/0x400 [ 1415.048635][T13477] ? inet_sendmsg+0x2f4/0x370 [ 1415.048661][T13477] __sys_sendto+0x627/0x7a0 [ 1415.048684][T13477] ? __pfx___sys_sendto+0x10/0x10 [ 1415.048702][T13477] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1415.048736][T13477] ? __fget_files+0x3a0/0x420 [ 1415.048778][T13477] ? ksys_write+0x242/0x270 [ 1415.048795][T13477] ? __pfx_ksys_write+0x10/0x10 [ 1415.048814][T13477] __x64_sys_sendto+0xde/0x100 [ 1415.048836][T13477] do_syscall_64+0x14d/0xf80 [ 1415.048858][T13477] ? trace_irq_disable+0x3b/0x150 [ 1415.048879][T13477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.048894][T13477] ? clear_bhb_loop+0x40/0x90 [ 1415.048912][T13477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.048926][T13477] RIP: 0033:0x7f9f2499c629 [ 1415.048941][T13477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1415.048957][T13477] RSP: 002b:00007f9f257ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1415.048973][T13477] RAX: ffffffffffffffda RBX: 00007f9f24c15fa0 RCX: 00007f9f2499c629 [ 1415.048984][T13477] RDX: 0000000000000003 RSI: 0000200000000640 RDI: 0000000000000003 [ 1415.048993][T13477] RBP: 00007f9f257ec090 R08: 0000200000000680 R09: 0000000000000010 [ 1415.049003][T13477] R10: 0000000004004084 R11: 0000000000000246 R12: 0000000000000001 [ 1415.049013][T13477] R13: 00007f9f24c16038 R14: 00007f9f24c15fa0 R15: 00007fff8f0f76d8 [ 1415.049037][T13477] [ 1415.399812][T13482] netlink: 'syz.4.10961': attribute type 10 has an invalid length. [ 1415.432972][T13482] team0: Port device dummy0 added [ 1415.544821][T13487] xt_TCPMSS: Only works on TCP SYN packets [ 1415.899308][T13511] FAULT_INJECTION: forcing a failure. [ 1415.899308][T13511] name failslab, interval 1, probability 0, space 0, times 0 [ 1415.930979][T13511] CPU: 0 UID: 0 PID: 13511 Comm: syz.4.10971 Not tainted syzkaller #0 PREEMPT(full) [ 1415.931019][T13511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1415.931033][T13511] Call Trace: [ 1415.931042][T13511] [ 1415.931052][T13511] dump_stack_lvl+0xe8/0x150 [ 1415.931088][T13511] should_fail_ex+0x412/0x560 [ 1415.931119][T13511] should_failslab+0xa8/0x100 [ 1415.931148][T13511] __kmalloc_cache_noprof+0x88/0x660 [ 1415.931172][T13511] ? sctp_add_bind_addr+0x8c/0x370 [ 1415.931205][T13511] sctp_add_bind_addr+0x8c/0x370 [ 1415.931236][T13511] sctp_copy_local_addr_list+0x314/0x4f0 [ 1415.931268][T13511] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1415.931295][T13511] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1415.931328][T13511] ? sctp_v4_is_any+0x35/0x60 [ 1415.931354][T13511] ? sctp_copy_one_addr+0x93/0x360 [ 1415.931384][T13511] sctp_bind_addr_copy+0xb3/0x3c0 [ 1415.931412][T13511] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1415.931439][T13511] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1415.931474][T13511] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1415.931512][T13511] ? __local_bh_enable_ip+0xd0/0x130 [ 1415.931539][T13511] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1415.931563][T13511] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1415.931609][T13511] sctp_sendmsg+0x1528/0x2c10 [ 1415.931656][T13511] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1415.931686][T13511] ? aa_sk_perm+0x15a/0x960 [ 1415.931710][T13511] ? aa_sk_perm+0x82d/0x960 [ 1415.931742][T13511] ? __pfx_aa_sk_perm+0x10/0x10 [ 1415.931769][T13511] ? sock_rps_record_flow+0x19/0x400 [ 1415.931804][T13511] ? inet_sendmsg+0x2f4/0x370 [ 1415.931839][T13511] __sys_sendto+0x627/0x7a0 [ 1415.931872][T13511] ? __pfx___sys_sendto+0x10/0x10 [ 1415.931897][T13511] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1415.931945][T13511] ? __fget_files+0x3a0/0x420 [ 1415.931987][T13511] ? ksys_write+0x242/0x270 [ 1415.932020][T13511] ? __pfx_ksys_write+0x10/0x10 [ 1415.932048][T13511] __x64_sys_sendto+0xde/0x100 [ 1415.932081][T13511] do_syscall_64+0x14d/0xf80 [ 1415.932111][T13511] ? trace_irq_disable+0x3b/0x150 [ 1415.932141][T13511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.932163][T13511] ? clear_bhb_loop+0x40/0x90 [ 1415.932194][T13511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.932216][T13511] RIP: 0033:0x7f9f2499c629 [ 1415.932237][T13511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1415.932256][T13511] RSP: 002b:00007f9f257ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1415.932279][T13511] RAX: ffffffffffffffda RBX: 00007f9f24c15fa0 RCX: 00007f9f2499c629 [ 1415.932295][T13511] RDX: 0000000000000003 RSI: 0000200000000640 RDI: 0000000000000003 [ 1415.932310][T13511] RBP: 00007f9f257ec090 R08: 0000200000000680 R09: 0000000000000010 [ 1415.932324][T13511] R10: 0000000004004084 R11: 0000000000000246 R12: 0000000000000001 [ 1415.932338][T13511] R13: 00007f9f24c16038 R14: 00007f9f24c15fa0 R15: 00007fff8f0f76d8 [ 1415.932374][T13511] [ 1416.401047][T13517] sctp: [Deprecated]: syz.4.10975 (pid 13517) Use of int in maxseg socket option. [ 1416.401047][T13517] Use struct sctp_assoc_value instead [ 1416.801776][T13549] ref_ctr_offset mismatch. inode: 0x64 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x8 [ 1416.912760][T13549] erspan0: entered promiscuous mode [ 1416.921564][T13549] erspan0: entered allmulticast mode [ 1416.929526][T13554] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 1416.937390][T13554] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1417.294447][T13580] netlink: 'syz.3.10992': attribute type 25 has an invalid length. [ 1417.556025][T13585] netlink: 'syz.2.10995': attribute type 16 has an invalid length. [ 1417.728277][T13606] nbd: must specify an index to disconnect [ 1417.876349][T13615] FAULT_INJECTION: forcing a failure. [ 1417.876349][T13615] name failslab, interval 1, probability 0, space 0, times 0 [ 1417.900661][T13615] CPU: 0 UID: 0 PID: 13615 Comm: syz.3.11005 Not tainted syzkaller #0 PREEMPT(full) [ 1417.900691][T13615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1417.900705][T13615] Call Trace: [ 1417.900714][T13615] [ 1417.900724][T13615] dump_stack_lvl+0xe8/0x150 [ 1417.900758][T13615] should_fail_ex+0x412/0x560 [ 1417.900792][T13615] should_failslab+0xa8/0x100 [ 1417.900820][T13615] __kmalloc_cache_noprof+0x88/0x660 [ 1417.900844][T13615] ? sctp_add_bind_addr+0x8c/0x370 [ 1417.900884][T13615] sctp_add_bind_addr+0x8c/0x370 [ 1417.900915][T13615] sctp_copy_local_addr_list+0x314/0x4f0 [ 1417.900945][T13615] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1417.900970][T13615] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1417.901001][T13615] ? sctp_v4_is_any+0x35/0x60 [ 1417.901026][T13615] ? sctp_copy_one_addr+0x93/0x360 [ 1417.901073][T13615] sctp_bind_addr_copy+0xb3/0x3c0 [ 1417.901101][T13615] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1417.901143][T13615] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1417.901178][T13615] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1417.901215][T13615] ? __local_bh_enable_ip+0xd0/0x130 [ 1417.901241][T13615] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1417.901265][T13615] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1417.901302][T13615] sctp_sendmsg+0x1528/0x2c10 [ 1417.901349][T13615] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1417.901376][T13615] ? aa_sk_perm+0x15a/0x960 [ 1417.901402][T13615] ? aa_sk_perm+0x82d/0x960 [ 1417.901432][T13615] ? __pfx_aa_sk_perm+0x10/0x10 [ 1417.901459][T13615] ? sock_rps_record_flow+0x19/0x400 [ 1417.901510][T13615] ? inet_sendmsg+0x2f4/0x370 [ 1417.901546][T13615] __sys_sendto+0x627/0x7a0 [ 1417.901577][T13615] ? __pfx___sys_sendto+0x10/0x10 [ 1417.901603][T13615] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1417.901651][T13615] ? __fget_files+0x3a0/0x420 [ 1417.901693][T13615] ? ksys_write+0x242/0x270 [ 1417.901718][T13615] ? __pfx_ksys_write+0x10/0x10 [ 1417.901747][T13615] __x64_sys_sendto+0xde/0x100 [ 1417.901780][T13615] do_syscall_64+0x14d/0xf80 [ 1417.901811][T13615] ? trace_irq_disable+0x3b/0x150 [ 1417.901843][T13615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1417.901872][T13615] ? clear_bhb_loop+0x40/0x90 [ 1417.901899][T13615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1417.901921][T13615] RIP: 0033:0x7fea4a39c629 [ 1417.901942][T13615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1417.901962][T13615] RSP: 002b:00007fea4b1d7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1417.901985][T13615] RAX: ffffffffffffffda RBX: 00007fea4a615fa0 RCX: 00007fea4a39c629 [ 1417.902001][T13615] RDX: 0000000000000003 RSI: 0000200000000640 RDI: 0000000000000003 [ 1417.902015][T13615] RBP: 00007fea4b1d7090 R08: 0000200000000680 R09: 0000000000000010 [ 1417.902030][T13615] R10: 0000000004004084 R11: 0000000000000246 R12: 0000000000000002 [ 1417.902044][T13615] R13: 00007fea4a616038 R14: 00007fea4a615fa0 R15: 00007ffcd9a260a8 [ 1417.902082][T13615] [ 1418.235417][T13609] netlink: 'syz.2.11002': attribute type 23 has an invalid length. [ 1418.508624][T13630] IPVS: set_ctl: invalid protocol: 60 172.20.20.28:20000 [ 1418.735279][T13648] netlink: 'syz.3.11014': attribute type 1 has an invalid length. [ 1418.797735][T13648] bond5: entered promiscuous mode [ 1418.830450][T13648] bond5: entered allmulticast mode [ 1418.837173][T13648] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1418.869359][T13654] erspan2: entered allmulticast mode [ 1418.929060][T13654] bond5: (slave erspan2): making interface the new active one [ 1418.952859][T13654] erspan2: entered promiscuous mode [ 1418.959942][T13654] [ 1418.962330][T13654] ============================================ [ 1418.968511][T13654] WARNING: possible recursive locking detected [ 1418.974720][T13654] syzkaller #0 Not tainted [ 1418.979168][T13654] -------------------------------------------- [ 1418.985360][T13654] syz.3.11014/13654 is trying to acquire lock: [ 1418.991548][T13654] ffff88807effa958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 1419.001454][T13654] [ 1419.001454][T13654] but task is already holding lock: [ 1419.008854][T13654] ffff88804e255d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 1419.018762][T13654] [ 1419.018762][T13654] other info that might help us debug this: [ 1419.027038][T13654] Possible unsafe locking scenario: [ 1419.027038][T13654] [ 1419.034529][T13654] CPU0 [ 1419.037848][T13654] ---- [ 1419.041166][T13654] lock(&qdisc_xmit_lock_key#4); [ 1419.046252][T13654] lock(&qdisc_xmit_lock_key#4); [ 1419.051340][T13654] [ 1419.051340][T13654] *** DEADLOCK *** [ 1419.051340][T13654] [ 1419.059515][T13654] May be due to missing lock nesting notation [ 1419.059515][T13654] [ 1419.067866][T13654] 9 locks held by syz.3.11014/13654: [ 1419.073181][T13654] #0: ffffffff90131c48 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1419.082739][T13654] #1: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 1419.091824][T13654] #2: ffffffff8e760340 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x38a0 [ 1419.101797][T13654] #3: ffff888057186228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x1002/0x38a0 [ 1419.114465][T13654] #4: ffff88804e255d58 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 1419.124792][T13654] #5: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 [ 1419.133710][T13654] #6: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070 [ 1419.143501][T13654] #7: ffffffff8e760340 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x38a0 [ 1419.153462][T13654] #8: ffff88804a23a228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x1002/0x38a0 [ 1419.166128][T13654] [ 1419.166128][T13654] stack backtrace: [ 1419.172399][T13654] CPU: 1 UID: 0 PID: 13654 Comm: syz.3.11014 Not tainted syzkaller #0 PREEMPT(full) [ 1419.172420][T13654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1419.172433][T13654] Call Trace: [ 1419.172441][T13654] [ 1419.172450][T13654] dump_stack_lvl+0xe8/0x150 [ 1419.172478][T13654] print_deadlock_bug+0x279/0x290 [ 1419.172506][T13654] __lock_acquire+0x253f/0x2cf0 [ 1419.172529][T13654] ? skb_network_protocol+0x23d/0x3f0 [ 1419.172556][T13654] ? netif_skb_features+0x9bc/0xe40 [ 1419.172583][T13654] ? validate_xmit_skb+0xc5f/0x14a0 [ 1419.172610][T13654] lock_acquire+0xf0/0x2e0 [ 1419.172631][T13654] ? sch_direct_xmit+0x15f/0x4c0 [ 1419.172653][T13654] _raw_spin_lock+0x2e/0x40 [ 1419.172674][T13654] ? sch_direct_xmit+0x15f/0x4c0 [ 1419.172691][T13654] sch_direct_xmit+0x15f/0x4c0 [ 1419.172712][T13654] ? __pfx_sch_direct_xmit+0x10/0x10 [ 1419.172737][T13654] ? check_noncircular+0x90/0x150 [ 1419.172765][T13654] __dev_queue_xmit+0x1538/0x38a0 [ 1419.172791][T13654] ? __lock_acquire+0x146e/0x2cf0 [ 1419.172816][T13654] ? __dev_queue_xmit+0x274/0x38a0 [ 1419.172847][T13654] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1419.172873][T13654] ? neigh_resolve_output+0x438/0x750 [ 1419.172895][T13654] ? eth_header+0x11b/0x200 [ 1419.172916][T13654] ? __asan_memcpy+0x40/0x70 [ 1419.172952][T13654] ? ip_finish_output2+0x3c2/0x1070 [ 1419.172975][T13654] ip_finish_output2+0xca9/0x1070 [ 1419.173000][T13654] ? ip_skb_dst_mtu+0x109/0xa50 [ 1419.173023][T13654] ? ip_finish_output+0x33a/0x3f0 [ 1419.173046][T13654] ip_output+0x29f/0x450 [ 1419.173068][T13654] ? ip_output+0x5b/0x450 [ 1419.173089][T13654] iptunnel_xmit+0x59f/0xa00 [ 1419.173113][T13654] ip_tunnel_xmit+0x193a/0x1f20 [ 1419.173146][T13654] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 1419.173172][T13654] ? __pfx_gre_build_header+0x10/0x10 [ 1419.173195][T13654] ? kmem_cache_free+0x187/0x630 [ 1419.173211][T13654] ? pskb_expand_head+0x4bb/0x1320 [ 1419.173239][T13654] __gre_xmit+0x19e/0x240 [ 1419.173260][T13654] ? __pfx___gre_xmit+0x10/0x10 [ 1419.173292][T13654] erspan_xmit+0xa81/0x1670 [ 1419.173321][T13654] ? __pfx_erspan_xmit+0x10/0x10 [ 1419.173343][T13654] ? register_lock_class+0x31/0x2e0 [ 1419.173363][T13654] ? unwind_get_return_address+0x4d/0x90 [ 1419.173393][T13654] dev_hard_start_xmit+0x2d8/0x870 [ 1419.173426][T13654] sch_direct_xmit+0x251/0x4c0 [ 1419.173446][T13654] ? __pfx_sch_direct_xmit+0x10/0x10 [ 1419.173463][T13654] ? bond_select_active_slave+0x890/0xd40 [ 1419.173487][T13654] ? bond_enslave+0x22a5/0x3c40 [ 1419.173513][T13654] __dev_queue_xmit+0x1538/0x38a0 [ 1419.173544][T13654] ? __dev_queue_xmit+0x274/0x38a0 [ 1419.173573][T13654] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1419.173600][T13654] ? rcu_is_watching+0x15/0xb0 [ 1419.173623][T13654] ? trace_kmem_cache_alloc+0x29/0xf0 [ 1419.173650][T13654] ? kmem_cache_alloc_node_noprof+0x3ce/0x690 [ 1419.173684][T13654] ? alb_send_lp_vid+0x14e/0x550 [ 1419.173711][T13654] alb_send_lp_vid+0x348/0x550 [ 1419.173743][T13654] ? dev_addr_mod+0x354/0x520 [ 1419.173769][T13654] ? __pfx_alb_send_lp_vid+0x10/0x10 [ 1419.173797][T13654] ? __pfx_alb_set_slave_mac_addr+0x10/0x10 [ 1419.173825][T13654] alb_send_learning_packets+0x12c/0x300 [ 1419.173853][T13654] ? __pfx_alb_send_learning_packets+0x10/0x10 [ 1419.173882][T13654] ? alb_swap_mac_addr+0x230/0x340 [ 1419.173911][T13654] alb_fasten_mac_swap+0x639/0xf60 [ 1419.173940][T13654] bond_alb_handle_active_change+0xc6d/0xf30 [ 1419.173969][T13654] ? __pfx_bond_alb_handle_active_change+0x10/0x10 [ 1419.174008][T13654] ? __local_bh_enable_ip+0xd0/0x130 [ 1419.174031][T13654] bond_change_active_slave+0x106e/0x35f0 [ 1419.174063][T13654] ? __pfx_bond_change_active_slave+0x10/0x10 [ 1419.174092][T13654] ? __queue_work+0x1a1/0x1020 [ 1419.174115][T13654] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 1419.174138][T13654] ? mod_delayed_work_on+0xdf/0x190 [ 1419.174165][T13654] bond_select_active_slave+0x909/0xd40 [ 1419.174200][T13654] ? __pfx_bond_select_active_slave+0x10/0x10 [ 1419.174226][T13654] ? __pfx_bond_set_carrier+0x10/0x10 [ 1419.174250][T13654] ? netdev_is_rx_handler_busy+0x56/0x120 [ 1419.174267][T13654] ? __pfx_bond_handle_frame+0x10/0x10 [ 1419.174294][T13654] bond_enslave+0x22a5/0x3c40 [ 1419.174317][T13654] ? sock_def_readable+0x2ff/0x580 [ 1419.174348][T13654] ? __pfx_bond_enslave+0x10/0x10 [ 1419.174378][T13654] ? __pfx___dev_notify_flags+0x10/0x10 [ 1419.174401][T13654] ? __dev_change_flags+0x51e/0x690 [ 1419.174425][T13654] ? mutex_is_locked+0x17/0x50 [ 1419.174450][T13654] do_set_master+0x533/0x6d0 [ 1419.174477][T13654] rtnl_newlink_create+0x6af/0xb70 [ 1419.174505][T13654] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1419.174530][T13654] ? __pfx___mutex_lock+0x10/0x10 [ 1419.174550][T13654] ? ns_capable+0x89/0xe0 [ 1419.174572][T13654] rtnl_newlink+0x1666/0x1be0 [ 1419.174599][T13654] ? __pfx_rtnl_newlink+0x10/0x10 [ 1419.174624][T13654] ? __lock_acquire+0x6b5/0x2cf0 [ 1419.174648][T13654] ? __lock_acquire+0x6b5/0x2cf0 [ 1419.174669][T13654] ? __lock_acquire+0x6b5/0x2cf0 [ 1419.174694][T13654] ? unwind_next_frame+0xa5/0x23c0 [ 1419.174734][T13654] ? __lock_acquire+0x6b5/0x2cf0 [ 1419.174756][T13654] ? is_bpf_text_address+0x26/0x2b0 [ 1419.174774][T13654] ? kernel_text_address+0xa5/0xe0 [ 1419.174804][T13654] ? __pfx_rtnl_newlink+0x10/0x10 [ 1419.174823][T13654] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1419.174847][T13654] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1419.174867][T13654] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1419.174888][T13654] ? __lock_acquire+0x6b5/0x2cf0 [ 1419.174914][T13654] netlink_rcv_skb+0x232/0x4b0 [ 1419.174934][T13654] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1419.174955][T13654] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1419.174978][T13654] ? netlink_deliver_tap+0x2e/0x1b0 [ 1419.175003][T13654] netlink_unicast+0x80f/0x9b0 [ 1419.175023][T13654] ? __pfx_netlink_unicast+0x10/0x10 [ 1419.175040][T13654] ? netlink_sendmsg+0x650/0xb40 [ 1419.175059][T13654] ? skb_put+0x11b/0x210 [ 1419.175082][T13654] netlink_sendmsg+0x813/0xb40 [ 1419.175111][T13654] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1419.175133][T13654] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1419.175153][T13654] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1419.175172][T13654] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1419.175190][T13654] ____sys_sendmsg+0xa68/0xad0 [ 1419.175214][T13654] ? futex_unqueue+0x211/0x240 [ 1419.175236][T13654] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1419.175264][T13654] ? import_iovec+0x73/0xa0 [ 1419.175289][T13654] ___sys_sendmsg+0x2a5/0x360 [ 1419.175315][T13654] ? __pfx____sys_sendmsg+0x10/0x10 [ 1419.175343][T13654] ? futex_wait+0x29a/0x380 [ 1419.175381][T13654] ? __fget_files+0x2a/0x420 [ 1419.175405][T13654] ? __fget_files+0x3a0/0x420 [ 1419.175433][T13654] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1419.175459][T13654] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1419.175488][T13654] ? rcu_is_watching+0x15/0xb0 [ 1419.175517][T13654] do_syscall_64+0x14d/0xf80 [ 1419.175543][T13654] ? trace_irq_disable+0x3b/0x150 [ 1419.175569][T13654] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1419.175587][T13654] ? clear_bhb_loop+0x40/0x90 [ 1419.175606][T13654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1419.175624][T13654] RIP: 0033:0x7fea4a39c629 [ 1419.175641][T13654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1419.175657][T13654] RSP: 002b:00007fea4b1b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1419.175677][T13654] RAX: ffffffffffffffda RBX: 00007fea4a616090 RCX: 00007fea4a39c629 [ 1419.175690][T13654] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1419.175701][T13654] RBP: 00007fea4a432b39 R08: 0000000000000000 R09: 0000000000000000 [ 1419.175712][T13654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1419.175723][T13654] R13: 00007fea4a616128 R14: 00007fea4a616090 R15: 00007ffcd9a260a8 [ 1419.175749][T13654] [ 1419.940603][T13654] bond5: (slave erspan2): Enslaving as an active interface with an up link [ 1423.075235][ T1300] lec:lec_start_xmit: lec0:No lecd attached [ 1428.910838][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5830 ms [ 1428.918926][ C0] lec:lec_tx_timeout: lec0