last executing test programs: 25.254049691s ago: executing program 4 (id=13428): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x1c, 0x2f, 0x9, 0x70bd27, 0x25dfdbfb, {0x4}, [@nested={0x8, 0x1a, 0x0, 0x1, [@generic="c698c801"]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42014}, 0x80000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa14001980"], 0x44}}, 0x0) 24.800178681s ago: executing program 4 (id=13433): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r2, 0x0, 0x13, 0x0, &(0x7f0000000080)) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20, 0x20}, [@RTA_IIF={0x8}]}, 0x24}}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20, 0x20}, [@RTA_IIF={0x8}]}, 0x24}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="03e1390000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r1, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 24.456293456s ago: executing program 4 (id=13437): r0 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x8, @private0, 0x4, 0x4}, 0x20) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x3, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x23, &(0x7f0000000040)=0x221b, 0x4) r1 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNDELRESOURCE(r1, 0x89ef, &(0x7f0000000080)=0x29b) (async) ioctl$sock_netdev_private(r0, 0x89f6, &(0x7f00000000c0)="8e4f5a8690cad7652dfef09a3860322c6b31cc8ee73767de607ba83ce87b85dd8dd4fc") r2 = socket$l2tp(0x2, 0x2, 0x73) sendto$inet(r2, &(0x7f0000000100)="bef036ef447edc7374adaf45aca75eca2a55f0f88ce3bc1405c495d3321d9069388ee0160b1589a985387a00d0d386589cd42eef5f9703aa36a5d1bb93a659ea2a58fcb8939e5d7344aea80b23f6bcd3f44a46ee0ad84205046ea381b98b042f72adf2ad069da8bde717741983bcc184134f82dec3bfb6462f28f2ee19681d6745ed3e219fcc592b114ec41c5359d9b79fe4d932a4d10956e12754c5ed4b519bee857b62435191c324843bf7e35122381bb044374f2cb7c62c0161309d332f0e4ac26b22cf9b6f", 0xc7, 0x22777c3e4fbadc19, &(0x7f0000000200)={0x2, 0x4e20, @remote}, 0x10) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000240)={0x0, 0x9}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000002c0)={r4, 0x8000}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000340)={r5, 0x5, 0xf57b}, 0x8) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r3, 0x4058587a, &(0x7f0000000580)={{r1, &(0x7f0000000380)='\x00', 0x438e80, &(0x7f00000003c0)={@align=0x9, {0x1000, 0x9, 0x0, 0x4}}, 0x4, &(0x7f0000000400)={@_ha_fsid}, &(0x7f0000000440)=0x59}, {[0x3, 0xfffffff9, 0x401, 0x1]}, 0xae, 0xe4, &(0x7f0000000480)=""/228}) (async) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r6, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x80, r7, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x54, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff2630}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x178}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7ff}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x8008}, 0x18) ioctl$VFAT_IOCTL_READDIR_BOTH(r6, 0x82307201, &(0x7f0000000780)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000009c0)={r4, 0xffffffff}, 0x8) ioctl$OCFS2_IOC_GROUP_ADD(r0, 0x40186f02, &(0x7f0000000a00)={0x9a5b, 0x4, 0x1, 0x4}) (async) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), r6) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ac0)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r6, &(0x7f0000000c00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x9c, r8, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xd}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xf9}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x8}, @ETHTOOL_A_LINKINFO_HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4004004}, 0x44000) (async) ioctl$XFS_IOC_RTGROUP_GEOMETRY(r1, 0xc0805841, &(0x7f0000000c40)={0x8, 0x7, 0x3, 0x8, 0x2}) (async) recvfrom$inet6(r6, &(0x7f0000000cc0)=""/13, 0xd, 0x2021, &(0x7f0000000d00)={0xa, 0x4e24, 0x200, @mcast2, 0x5f0}, 0x1c) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFQNL_MSG_VERDICT(r6, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x20, 0x1, 0x3, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffc, 0x5}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r6, 0x84, 0x71, &(0x7f0000000e40)={r4, 0x6}, 0x8) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000ec0), r6) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000f00)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000013c0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001380)={&(0x7f0000000f40)={0x420, r10, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x3, 0xa}}}}, [@NL80211_ATTR_BSS_BASIC_RATES={0x1b, 0x24, [{0x12, 0x1}, {0x1f, 0x1}, {0x1b}, {0x60}, {0xb, 0x1}, {0xd8}, {0x36}, {0xb}, {0x60, 0x1}, {0x6c}, {0xc}, {0xc, 0x1}, {0x1b}, {0x2, 0x1}, {0x4}, {0x60, 0x1}, {0xb}, {0x48}, {0x1}, {0x4, 0x1}, {0x18, 0x1}, {0x5}, {0x6c}]}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_TX_RATES={0x1e0, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x60, 0x60, 0x18, 0xc, 0xc, 0x6, 0x16, 0x60, 0x6, 0x18, 0x37, 0x12, 0x18, 0x18, 0x6, 0x9, 0x16, 0x36, 0x30, 0xb, 0x5, 0xb, 0x36, 0x3, 0x9]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x0, 0x40, 0x800, 0x9, 0x8, 0x100, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x6, 0x4, 0xd9fa, 0x5, 0x6, 0x3, 0x7]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xee6, 0x8, 0x5, 0x0, 0xb, 0x3, 0x699, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x6c, 0x9, 0xb]}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x64, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xb, 0x1, [0x30, 0x18, 0x60, 0x18, 0x18, 0x9, 0x36]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0xffff, 0x4, 0x1, 0xffdc, 0x3, 0x1f]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x1e, 0x2, [{0x1, 0x6}, {0x4, 0x5}, {0x3, 0x1}, {0x1, 0xa}, {0x0, 0xa}, {0x4, 0x4}, {0x0, 0x2}, {0x0, 0x9}, {0x7}, {0x4, 0x1}, {0x0, 0x5}, {0x7, 0x2}, {0x1, 0xa}, {0x1}, {0x5, 0x6}, {0x2, 0x6}, {0x4, 0xa}, {0x1, 0x3}, {0x0, 0x4}, {0x0, 0x8}, {0x4, 0x3}, {0x0, 0xa}, {0x2, 0x1}, {0x5, 0x8}, {0x7, 0x6}, {0x1, 0x1}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x6c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x2, 0x5, 0x2800, 0x6, 0x101, 0x5, 0x100]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff7, 0x4, 0xfffd, 0x8001, 0x1, 0xd, 0x3]}}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x4, 0x5}, {0x0, 0x1}, {0x1, 0x7}, {0x2, 0x5}, {0x7, 0x7}, {0x4, 0xa}, {0x2, 0x1}, {0x1, 0x6}, {0x1, 0x3}, {0x1, 0x9}, {0x1, 0x4}, {0x7, 0x6}, {0x7, 0x7}, {0x4, 0x3}, {0x7, 0x8}, {}, {0x4, 0x7}, {0x3, 0x5}, {0x0, 0x4}, {0x5, 0x2}, {0x7, 0x3}, {0x4, 0x7}, {0x3, 0xa}, {0x4}, {0x5, 0xa}, {0x1}, {0x1, 0x4}, {0x3, 0x6}, {0x2, 0x5}, {0x7}, {0x2, 0x5}, {0x2, 0x9}, {0x0, 0xa}, {0x7, 0x1}, {0x2, 0x1}, {0x5, 0x2}, {0x0, 0x7}, {0x2, 0xa}, {0x3}, {0x6, 0xa}, {0x0, 0x4}, {0x7, 0x9}, {0x1, 0xa}, {0x4, 0x2}, {0x4, 0x2}, {0x1, 0x7}, {0x7, 0x6}, {0x7, 0x6}, {0x7}, {0x2, 0x1}, {0x4, 0x7}, {0x0, 0x7}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x200e2f2cba2901a7}]}, @NL80211_BAND_5GHZ={0x80, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{0x5, 0x8}, {0x5, 0x8}, {0x5, 0x5}, {0x4, 0x9}, {0x1, 0x3}, {0x2, 0x5}, {0x3, 0x1}, {0x1, 0x8}, {0x2, 0x9}, {0x1, 0x1}, {0x3, 0xa}, {0x4, 0x8}, {0x0, 0x6}, {0x2, 0x4}, {0x7, 0x1}, {0x7, 0x6}, {0x4, 0x1}, {}, {0x0, 0x4}, {0x3, 0x9}, {0x4}, {0x6, 0x4}, {0x5, 0x2}, {0x5, 0x1}, {0x1, 0xa}, {0x7, 0x4}, {0x5, 0x1}, {0x1, 0x1}, {0x7, 0x5}, {0x0, 0x7}, {0x2, 0x2}, {0x6, 0x2}, {0x6, 0x7}, {0x2, 0xa}, {0x6, 0x2}, {0x4, 0x8}, {0x4, 0x8}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x3}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x40, 0xa504, 0x5, 0x81, 0x8, 0x8, 0x6, 0x2]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x1b, 0x69, 0x24, 0x12, 0x0, 0x9, 0x6c, 0xc, 0x8769101a0d79ee72, 0x6c, 0x2, 0x16, 0x71, 0x9, 0x48, 0xc, 0x6, 0x60, 0x4, 0x3, 0x48, 0x2, 0x1, 0x48, 0x2, 0x12, 0xb, 0x24, 0xb]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x1e0, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x84, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xfffb, 0x0, 0x61, 0x7ff, 0x1, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x1f, 0x2, [{0x2, 0x4}, {0x0, 0x7}, {0x6, 0x2}, {0x5, 0x9}, {0x5, 0x5}, {0x6, 0x5}, {0x5, 0x2}, {0x0, 0x4}, {0x0, 0x9}, {0x4}, {0x1, 0x4}, {0x7}, {0x2, 0x6}, {0x7}, {0x0, 0x4}, {0x5, 0x3}, {0x0, 0x1}, {0x3, 0x2}, {0x6}, {0x7, 0x2}, {0x3}, {0x0, 0x1}, {0x1, 0x7}, {0x0, 0x9}, {0x5, 0x7}, {0x7, 0x8}, {0x6, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0x5, 0x9, 0x9, 0x2, 0x4, 0xff01, 0x1]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x7, 0x2, [{0x5, 0xa}, {0x3, 0x3}, {0x6, 0x7}]}]}, @NL80211_BAND_60GHZ={0x70, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x5, 0xc35, 0xc86, 0x100, 0x7ff, 0x332, 0xfff]}}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x2, 0x101, 0x7, 0x1, 0x4, 0xf001, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4dfb, 0x5, 0x4, 0x7, 0x10dd, 0x8, 0x100, 0xb]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x101, 0xfffe, 0xbf, 0x8, 0x9, 0xff01, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0x2c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xb, 0x800, 0xa4be, 0x5, 0x3, 0xad, 0x9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x101, 0x6, 0x8, 0x2, 0x7, 0x4, 0x2, 0x5]}}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x85, 0x2, 0x3ff, 0xf, 0x94, 0x80, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x428, 0x5, 0x7, 0x4, 0x1, 0x56fd, 0x6c4]}}]}, @NL80211_BAND_6GHZ={0x24, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_5GHZ={0x6c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x400, 0x5, 0x4, 0xc3c, 0x9, 0x8, 0x3, 0x400]}}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x7, 0x7}, {0x4, 0x3}, {0x4, 0x9}, {0x7}, {0x7, 0xa}, {0x6, 0x7}, {0x0, 0x7}, {0x1, 0x5}, {0x1, 0x7}, {0x6, 0x1}, {0x2, 0x7}, {0x4, 0x3}, {0x7, 0x4}, {0x1, 0x7}, {0x4, 0x9}, {0x3, 0xa}, {0x6, 0xa}, {0x1, 0x2}, {0x1}, {0x5, 0xa}, {0x3, 0x3}, {0x6, 0x4}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xa9, 0x8, 0xffff, 0x4, 0xf6ca, 0x9, 0x4, 0xa0b]}}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x18, 0x2, 0x2, 0x18, 0x1b, 0x5, 0x60, 0x6, 0x4, 0x4, 0x5, 0x1b, 0x12, 0x3, 0x1, 0xc, 0x36, 0x24, 0x4, 0xb, 0x2]}]}]}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x10}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x420}, 0x1, 0x0, 0x0, 0x20000000}, 0x805) 24.04991484s ago: executing program 4 (id=13442): socket$netlink(0x10, 0x3, 0x15) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xts-twofish-avx,camellia-asm,cbcmac(aes))\x00'}, 0x58) (async, rerun: 64) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c000000420007012bbd700000000000017c"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (rerun: 64) 22.989212577s ago: executing program 4 (id=13444): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'wlan0\x00', &(0x7f0000000040)=@ethtool_ringparam={0xf, 0xac4, 0x2, 0x37d7, 0x9, 0x3, 0x7d, 0x1, 0x10}}) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000030a01020000000000000000010000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d616376746970000000080001400000000514000011000100000000000000000000000064"], 0x88}}, 0x0) r2 = socket(0x840000000002, 0x3, 0xff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000002c0)={0x38, r4, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'pim6reg0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x38}}, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000080)={0x84, @multicast1, 0x4e21, 0x3, 'wlc\x00', 0x1, 0x10000004, 0x6}, 0x2c) r7 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000140)={{0x84, @private=0xa010100, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmmsg$inet(r2, &(0x7f0000000b00)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x1, 0x20048814) r8 = socket(0xa, 0x3, 0x87) sendmmsg$unix(r8, &(0x7f0000004440)=[{{&(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0}}], 0x1, 0x40000a0) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b000000000000000000000000000400000008"], 0x50) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@ipv4_deladdr={0x20, 0x15, 0x1, 0x70bd2a, 0x25dfdbff, {0x2, 0x18, 0x1, 0x0, r12}, [@IFA_ADDRESS={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x38}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008000}, 0x804) poll(&(0x7f0000000000)=[{r9, 0x1000}], 0x1, 0x2) r13 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r13, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYRES8=r3], 0xfffffffffffffff3}, 0x1, 0x7}, 0x0) r14 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r14, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) 22.237009008s ago: executing program 4 (id=13449): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newlink={0x50, 0x10, 0x401, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x44840}, 0xfeffffffffffffff) 6.852068723s ago: executing program 2 (id=13536): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00'}) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@ipv4_getnexthop={0x20, 0x6a, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4c830) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r5, {0x10, 0xffe0}, {}, {0x9, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x4, 0x2, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xf7}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000001100)={@local, @multicast, @void, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x3, @multicast, @empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @private2}}}}, 0x0) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={r8, 0x808000}, 0x8) getsockopt$bt_hci(r1, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) poll(&(0x7f00000030c0)=[{r0, 0x1000}], 0x1, 0x4) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x6}) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$can_j1939(0x1d, 0x2, 0x7) poll(&(0x7f0000000100)=[{r0, 0x106}, {0xffffffffffffffff, 0x4200}, {r9, 0x2510}, {r10, 0x100}, {r11, 0xa300}, {0xffffffffffffffff, 0x428}], 0x6, 0x469) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x16}]}}}]}]}], {0x14}}, 0x70}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001180)={0x1e, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 6.828836189s ago: executing program 3 (id=13537): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=@newneigh={0x4c, 0x1c, 0x2, 0x70bd28, 0x25dfdbfe, {0xa, 0x0, 0x0, 0x0, 0x80, 0x18, 0x1}, [@NDA_DST_IPV4={0x8, 0x1, @local}, @NDA_VLAN={0x6, 0x5, 0x1}, @NDA_VLAN={0x6}, @NDA_MASTER={0x8, 0x9, 0x4}, @NDA_SRC_VNI={0x8, 0xb, 0x85dd}, @NDA_PORT={0x6, 0x6, 0x4e23}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x24008844) (async, rerun: 32) r4 = socket$kcm(0x10, 0x2, 0x4) (rerun: 32) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) (async) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r6, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r5], 0x68}}, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="6404282c166e0814ac7fd7dd320ba7ccd02dda75b665d055d5ef55794381c706e93d4ad8d9b232be1dbe904dead0e8a2cd588178c38c62dd2538628138fb43c8", 0x40}, {&(0x7f00000000c0)="a3c0302aafd434ceb1940b2f062385f07a467c50a314e6f5629c05572d95fda163c6e276db7e1b364230f46055", 0x2d}, {0x0}], 0x3}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4c050) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) (async, rerun: 32) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000300)={0x1, 'dvmrp1\x00', {}, 0x3}) (rerun: 32) r7 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) getsockopt$llc_int(r7, 0x10c, 0x4, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async, rerun: 32) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b040000000000000000020000004c000480480001802a000100696e6e657200000038000280ae98377fa7930d8874ce080002400000008407080004400000000f080001400000000014000580090001006d65746100000000040002800900010073797a30000000000900020073797a32000000001400000011000100"/160], 0xa0}}, 0x0) (async, rerun: 32) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$AUDIT_GET(r8, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x10, 0x3e8, 0x200, 0x70bd29, 0x25dfdbfd, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x1) 6.254743623s ago: executing program 3 (id=13540): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="0500000000000000000d0200000008000300", @ANYRES32=r2, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09"], 0x80}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, 0x0, 0x4014) ioctl$VFAT_IOCTL_READDIR_SHORT(0xffffffffffffffff, 0x82307202, 0x0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x20, 0x0, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x73}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) 5.76768999s ago: executing program 0 (id=13543): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001200)={0x20, 0x1405, 0x1, 0x70bd27, 0x25dfdbfb, "", [{{0x8, 0x1, 0x406}, {0x8}}]}, 0x20}}, 0x0) 5.765675123s ago: executing program 3 (id=13544): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0xfffffffd, 0xca, 0x3, 0x0, 0x1}, 0x50) r1 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="581400002d00010000000000ffdbdf25037c000008000180040004803c140280361402800c"], 0x1458}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmmsg$unix(r5, &(0x7f0000005980)=[{{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000001040)=""/31, 0x1f}], 0x1}}], 0x1, 0x200, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000010000100e81cbcde000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000078000000060a010400000000000000000500000008000b400000000050000480240001800b00010074756e6e656c000014000280080001400000000108000240000000092800018008000100667764001c0002800800024000000017080003400000000a08000140000000090900010073797a30"], 0xec}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="2000000069000b00000000000000000000000000000000e7070001"], 0x20}, 0x1, 0x200000000000000}, 0x0) recvmmsg$unix(r1, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000008c0)=""/200, 0xc8}, {&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000007c0)=""/97, 0x61}, {&(0x7f00000001c0)=""/104, 0x68}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x9}}], 0x1, 0x2080, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r7, 0x1, 0x40, &(0x7f0000000040)=0x8, 0x4) write(r1, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0xf, &(0x7f0000000c80)=ANY=[@ANYBLOB="1802000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="00000000000000002702000014000000b7030000000000008500000039000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008502000086000000b7000000000000009500000000000000c99443ab2684c3c140c70b6c1a06aedbc2657c6caf06f688b3daedaef4e4e28887172f6b85c6a591e6535a832cc136677f2aff2ef34b730c0e9ae34ccd8bafb1496db1dc8aca2647b6474de6142a0ceb43875a9bda3c5a39c1b0db80355078961436e2a88b0a5320e42ba780b74e0812cdd93539eed6548cfc24beb07ff491cde5bac1851437d04db203b71ad3a13224b892ce29a7f124ca48f17a7b02cfa27c50555ec8a96a37c9b8d95c7b9ec937d33be5e18f89436fe1fe461c4973016b8fd7263ee7805ae7afacfe4183a8e8b5a68b18bd"], &(0x7f0000000200)='GPL\x00'}, 0x90) 5.512315204s ago: executing program 2 (id=13545): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100dffffffffffffff607"], 0x14}], 0x1}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$xdp(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x2c, 0x12, 0x0, 0x1e}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000040)="21b8ccd37b937e8c8393a03800c14e0dd9db39f8d516b8351e26e6efe8d30619f23b4675bcf6ea3baf0469ebbad6d6116ba28c5c31fafc767340a358852ed65965cad5335ace6612fe9dce57bd390bf41e0ae7e79eff", 0x56}, {&(0x7f0000000200)="23ef1e079d52733c06d69d8c4aa5ca2d428b5284c3a8aa066921552e733108b6861605f12dfaf1523e533547503451530777dbe3528a3d5f21b102ff382265c833c02db8c2603d84b2d080eddee74cb12b4f5e807b2d3c8c2762bc2d507420ea21c4ac5a45d736b8efcf8ee22e464409b2c8f69b6f12bb546d57240a2efcf3425535ff251119e15260a25917417817c2fff3305f28ed3b182db31f02e0e41e88b310483c0038b97e40a6cc284a7314b0d5c9d7dcb463136d003d0886f48c6b40e01e22b3c3c45c617bef33da4cb78929324c52ab0ad667cc1a7f09d9dee802d70ed7966359bc2cfeb5d2b2ca20415617edf361", 0xf3}], 0x2, 0x0, 0x0, 0x24000001}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100dffffffffffffff607"], 0x14}], 0x1}, 0x0) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$xdp(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x2c, 0x12, 0x0, 0x1e}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000040)="21b8ccd37b937e8c8393a03800c14e0dd9db39f8d516b8351e26e6efe8d30619f23b4675bcf6ea3baf0469ebbad6d6116ba28c5c31fafc767340a358852ed65965cad5335ace6612fe9dce57bd390bf41e0ae7e79eff", 0x56}, {&(0x7f0000000200)="23ef1e079d52733c06d69d8c4aa5ca2d428b5284c3a8aa066921552e733108b6861605f12dfaf1523e533547503451530777dbe3528a3d5f21b102ff382265c833c02db8c2603d84b2d080eddee74cb12b4f5e807b2d3c8c2762bc2d507420ea21c4ac5a45d736b8efcf8ee22e464409b2c8f69b6f12bb546d57240a2efcf3425535ff251119e15260a25917417817c2fff3305f28ed3b182db31f02e0e41e88b310483c0038b97e40a6cc284a7314b0d5c9d7dcb463136d003d0886f48c6b40e01e22b3c3c45c617bef33da4cb78929324c52ab0ad667cc1a7f09d9dee802d70ed7966359bc2cfeb5d2b2ca20415617edf361", 0xf3}], 0x2, 0x0, 0x0, 0x24000001}, 0x0) (async) 5.468590592s ago: executing program 0 (id=13546): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff000000000000000000000081", @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004002000080020"], 0x4c}}, 0x0) 5.28666079s ago: executing program 3 (id=13547): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x83, &(0x7f0000000000)={r2, 0x2}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b20d, 0x15b30}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_macvtap\x00'}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x1}]}]}, @IFLA_MTU={0x8, 0x4, 0x1ff}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc1}, 0x84) 4.761020265s ago: executing program 2 (id=13550): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000000000000000000a00000e0998cee3b28c17c0762054e3f6e4ad7b2800020073797a3100797a31000000004c0004"], 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000a1c800010000000000000000000000000a20000000000a01030000000000affe08957631138a00010073797a310000000054000000030a01020000000000000000010000000900030073797a310000000028000480080002400000000008000140000000051400030076657468315f6d2163767461700000000900010073797a310000000094000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000f8ff5b00044002767fe1e4eba96fb7a4299c43150bef1b1034905c4999fefe7a4cda5894384c96dfeebec780dddbd86156212c0c7a4fd7f92051df46bad61c2c2781ae90f5eecae4bb5323a9f189a5"], 0x130}}, 0x0) 4.744710422s ago: executing program 0 (id=13551): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, &(0x7f0000000100)) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000280)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f00000000c0)={r2, r2, 0x206, 0x0, 0x0, 0x2, 0x72, 0x1, 0x3, 0x7, 0x0, 0x8, 'syz1\x00'}) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0) (async) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0xce20, @remote}, 0x2) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0xc) (async) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r3, 0x800448d2, &(0x7f0000000700)={0x4, &(0x7f0000000480)=[{}, {}, {}, {@fixed}]}) (async) ioctl$XFS_IOC_SET_RESBLKS(0xffffffffffffffff, 0xc0105872, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000030a01010000000000000000010000000900000073797a30000000000900030073797a320000000094000000062d010400000000000000000100000208000b40000000006c000480340001800b0001006578746864720000240002800200000000000000080003400000000208000440000000220500020007000000340001800c00010062697477697365002400028008000340000000020800014000000014080002400000001208000640000000020900010073797a3000000000140000001100010000000000000000000700000aa2099e7fa5705fcb1d7ad30a3506561bd69abd42cbf70ce9d5a866c71a9af3e81ffc3de992d09c77b38b76cca569ae9e0cf52007623de1c28846f1cbf7b6941df6d883c52b"], 0xe8}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0xfffff63d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x258}]}}}]}, 0x3c}}, 0x0) 4.464397866s ago: executing program 2 (id=13552): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000100003040000000000000005dc000000", @ANYRES32=r2, @ANYBLOB="a4280400000000001400350073797a5f74756e000000000077eef46608000a00", @ANYRES32=r1], 0x3c}}, 0x8000) 4.209906228s ago: executing program 3 (id=13553): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) (rerun: 32) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001940)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0x0, 0xffffffff, 0xffffffff, 0x108, 0xffffffff, 0x1a8, 0xffffffff, 0xffffffff, 0x1a8, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0xc0, 0x108, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@empty, 'nicvf0\x00', {0x7ff}}}}, {{@ip={@local, @dev={0xac, 0x14, 0x14, 0x3e}, 0xffffffff, 0x0, 'veth0_to_team\x00', 'team_slave_0\x00', {}, {0xff}, 0x6c, 0x3, 0x41}, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x2, 0x5, 0x3}, {0xffffffffffffffff, 0x5, 0x2}, 0xda, 0xfffffff8}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b702000008000000bfa300000000000007030000ffffffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000000000095000000000000006623848adf1dc9a764ab51a064caff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b81ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6b6981978d51514b00dcc4a2748b376358c33c9753beab62bdf27dc04e4cb4bc598affd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b770009524edd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd88345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1757b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c35af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d9900000011000003971b32fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d677d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc37e5aa23bff8cce0600000000000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68f536a03353a55a8a8e176e5d48887d31c8e0f77f2c1e68ec7c01bd5a2028a8fc107007f5f4c67600a6ade3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d9029f071fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b4492510134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2020ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498dedf0f87c38bbcab7357836f03e8a7c392e535694a3ead2de11e6b1781e2a017ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f6c3652c423ce6ecc1be5d4e8133fc32f68ea86a2df1e7df98a0ae216c405d0ae9eed114ff2d6fe27dfdff1cf9194849c4cc0da9533e5983863e526a7dc0d8728f3b573ca4427bdb44df9341e9b8420e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9467b51d92e0993af4beaf1f3d47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c27c318475802e2c62681bd1a331422a6e47bbd40857d52c4894944fae5c5000000000000000000000000e0c47613e950b6aefeae054fc723f62ac7d13941de11b018f1f48ac50335df91c771729f81929128135b2803562c1171ee00a3f4a31281aa363e087d53d86dd85e3ff979a7e72d16fdd7e1a0f07a1c8e6085d280d760f74975ceb3a5be6cfb4da8e0aeb769b8b75f4aad803ed77d34872eed2711aa40a3b38099dc2752e8ec9b520faf39e416752aa0830206736570f5d41a4df848c9052551cf8dcb1be000000000eb2577188e8e96bd825d462350905d3eb916b397d2a46a64081e85661d7a5a2716cc87cb1976d15d9b6418e94f165911803e43830432226c660f4da67bb7c8ceb3755c07197d8b80b8d16b12c2ec63bebe107aa2350a7ae564bf69a6c52a2da1496016dd66a1c1b112"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000880), 0xfffffffffffffddd, 0x0, 0xffffffffffffffff, 0x28}, 0x48) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000180)={@remote, @empty, @loopback}, 0xc) (async, rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x27, 0xe40, 0x0, &(0x7f0000000040)="3d6ee2e04b91ab10143d9abe86dd", 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='pids.events\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x3) (async) sendto$inet(r0, &(0x7f0000000300)="89", 0x1, 0x4044880, 0x0, 0x0) 4.096014864s ago: executing program 1 (id=13554): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x2, 0x3, 0x1, 0x0, 0x31}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) r1 = socket$netlink(0x10, 0x3, 0x88100540845d7ebc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e000100fdffffff00000000ff00", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\n\x00'], 0x28}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001900), 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000090c0)={'ip_vti0\x00', &(0x7f0000009540)={'syztnl0\x00', 0x0, 0x1, 0x7b0, 0x8, 0x5, {{0x12, 0x4, 0x3, 0x1, 0x48, 0x68, 0x0, 0xf, 0x2f, 0x0, @private=0xa010101, @local, {[@noop, @noop, @ssrr={0x89, 0x13, 0x16, [@dev={0xac, 0x14, 0x14, 0x3a}, @broadcast, @multicast2, @private=0xa010100]}, @ssrr={0x89, 0x1f, 0x72, [@remote, @multicast1, @multicast2, @loopback, @multicast1, @local, @local]}]}}}}}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f3, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000300)={'ip_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x11, 0x0, 0x89, 0x0, @remote, @private}}}}) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000009100), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x12, 0x4, 0x4, 0xa}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000009600)={0x6, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000009640)={r6, 0x200, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000009240)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000091c0), &(0x7f0000009200)=r0}, 0x20) sendmsg$nl_route(r1, &(0x7f0000009940)={&(0x7f0000009140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000009900)={&(0x7f0000009880)=@ipv6_delroute={0x4c, 0x19, 0x2, 0x70bd26, 0x25dfdbfc, {0xa, 0x0, 0x14, 0x7f, 0x0, 0x2, 0xff, 0xb, 0x1000}, [@RTA_GATEWAY={0x14, 0x5, @mcast1}, @RTA_UID={0x8}, @RTA_GATEWAY={0x14, 0x5, @mcast2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000009300)={{0x1, 0xffffffffffffffff}, &(0x7f0000009280), &(0x7f00000092c0)=r0}, 0x20) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000009380)=@generic={&(0x7f0000009340)='./file0\x00', 0x0, 0x10}, 0x18) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000093c0)={0x1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000009480)={0x12, 0x1c, &(0x7f0000008e80)=ANY=[@ANYBLOB="18000000060000000000000004000000b7080000000000007b8af8ff00000000b7080000400000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007eb0000f8ffffffb702000008000000b703000009fc00008500000006000000180000000100000000000000050000008734f4fffcffffff85200000020000009500000000000000"], &(0x7f0000008f80)='syzkaller\x00', 0x61c, 0x7b, &(0x7f0000008fc0)=""/123, 0x40f00, 0x21, '\x00', r2, @fallback=0x6, r4, 0x8, &(0x7f0000009840)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000009180)={0x5, 0xc, 0x5de, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f0000009400)=[r5, r7, r8, r9, r10], &(0x7f0000009440)=[{0x0, 0x5, 0xc, 0xb}, {0x2, 0x1, 0x7, 0x2}, {0x0, 0x4, 0x1}, {0x3, 0x1, 0x5, 0x1}], 0x10, 0xf08}, 0x94) recvmmsg(r1, &(0x7f0000008c40)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/68, 0x44}], 0x1, &(0x7f0000000380)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000001380)=@nfc, 0x80, &(0x7f00000015c0)=[{&(0x7f0000001400)=""/17, 0x11}, {&(0x7f0000001440)=""/186, 0xba}, {&(0x7f0000001500)=""/189, 0xbd}], 0x3, &(0x7f0000001600)=""/214, 0xd6}, 0x9}, {{&(0x7f0000001700)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001780)=""/97, 0x61}, {&(0x7f0000001800)=""/254, 0xfe}, {&(0x7f0000001900)}, {&(0x7f0000001940)=""/51, 0x33}, {&(0x7f0000001980)=""/191, 0xbf}], 0x5, &(0x7f0000001ac0)=""/89, 0x59}, 0x7}, {{&(0x7f0000001b40)=@xdp, 0x80, &(0x7f0000001ec0)=[{&(0x7f0000001bc0)=""/251, 0xfb}, {&(0x7f0000001cc0)=""/219, 0xdb}, {&(0x7f0000001dc0)=""/212, 0xd4}], 0x3, &(0x7f0000001f00)=""/21, 0x15}, 0xfffffbff}, {{&(0x7f0000001f40)=@vsock={0x28, 0x0, 0x0, @local}, 0x80, &(0x7f0000001fc0), 0x0, &(0x7f0000002000)=""/192, 0xc0}, 0xffff}, {{&(0x7f00000020c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f0000004400)=[{&(0x7f0000002140)=""/89, 0x59}, {&(0x7f00000021c0)=""/77, 0x4d}, {&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/96, 0x60}, {&(0x7f00000032c0)=""/98, 0x62}, {&(0x7f0000003340)=""/4096, 0x1000}, {&(0x7f0000004340)=""/160, 0xa0}], 0x7, &(0x7f0000004480)=""/61, 0x3d}, 0x40}, {{0x0, 0x0, &(0x7f0000005680)=[{&(0x7f00000044c0)=""/133, 0x85}, {&(0x7f0000004580)=""/253, 0xfd}, {&(0x7f0000004680)=""/4096, 0x1000}], 0x3, &(0x7f00000056c0)=""/4096, 0x1000}, 0x200000}, {{&(0x7f00000066c0)=@in6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000007bc0)=[{&(0x7f0000006740)=""/4096, 0x1000}, {&(0x7f0000007740)=""/53, 0x35}, {&(0x7f0000007780)=""/9, 0x9}, {&(0x7f00000077c0)=""/161, 0xa1}, {&(0x7f0000007880)=""/196, 0xc4}, {&(0x7f0000007980)=""/164, 0xa4}, {&(0x7f0000007a40)=""/228, 0xe4}, {&(0x7f0000007b40)=""/76, 0x4c}], 0x8, &(0x7f0000009980)=""/4099, 0x1003}, 0xf}], 0x8, 0x2002, &(0x7f0000008e40)={0x0, 0x3938700}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000009800)) r11 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r11, 0x84, 0x74, 0x0, &(0x7f0000000000)=0x43) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x68}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=@delchain={0x8c, 0x65, 0x2, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x8}, {0x5, 0x3}, {0x5, 0xfff3}}, [@TCA_CHAIN={0x8, 0xb, 0x8}, @TCA_CHAIN={0x8, 0xb, 0x6ec9}, @TCA_CHAIN={0x8, 0xb, 0xfff}, @TCA_CHAIN={0x8, 0xb, 0x80}, @TCA_RATE={0x6, 0x5, {0x6, 0x3}}, @TCA_RATE={0x6, 0x5, {0x7c, 0xf}}, @TCA_RATE={0x6, 0x5, {0x1, 0xfe}}, @filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_DIVISOR={0x8, 0x8, 0x6}, @TCA_FLOW_MODE={0x8}, @TCA_FLOW_XOR={0x8, 0x7, 0x6}, @TCA_FLOW_KEYS={0x8, 0x1, 0xcd80}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20044840}, 0x40000) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000097c0)={&(0x7f0000009680)=ANY=[@ANYBLOB="9feb01001800000000001000cb000000cb000000040000000d0052aa1f1d001008000000030000000000001103000000080000001000000000000002020000000b0000000300000f0300000005000000faffffff0000000005000000ffffffff0500000001000000030000000100000091fdd60000000000000003000000000500000001000000ffffffff0b0000000000001010000000000000000800000d000000000c000000030000000d0000000300000009000000010000000c00000002000000000e00000001000000040000000200000000002e5100"/232], &(0x7f0000009780)=""/23, 0xe8, 0x17, 0x1, 0x8}, 0x28) sendmsg$ETHTOOL_MSG_RINGS_SET(r13, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=r14, @ANYBLOB="010300000000000000002d"], 0x14}}, 0x0) 3.230175989s ago: executing program 2 (id=13555): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x200, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6vti={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x14, 0x4, @empty}]}}}]}, 0x48}}, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="d80000001e0081054e81f782060000000000000006007c095dd2466518000e800a00142603600e1208000f0000000406a80016c00800094013000000035c0461c1d67f6f94007134cf6efb8007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791433a5ee4ce1b14d6d930dfe1d9d33dfe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad909d5e1cace81ed0bffece0b42a9eca0200e6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a9410000", 0xd8}], 0x1}, 0x8084) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x4, &(0x7f0000001a40)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xfffffffc}, [@ldst={0x1, 0x0, 0x4, 0x6, 0x1, 0x50}]}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x18, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r4, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000180)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="800000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000003b005000128009000100766c616e000000004000028006000100000000000c00020000000000000000000c00020000000000000000001c0004800c00060004000000000800000a0001"], 0x80}, 0x1, 0xba01}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) socket$kcm(0x29, 0x7, 0x0) ioctl$FS_IOC_RESVSP(r5, 0x4030582b, &(0x7f0000000300)={0x1100, 0x4, 0x10, 0x6}) accept4$alg(r7, 0x0, 0x0, 0x80000) 3.22594771s ago: executing program 0 (id=13556): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r0, &(0x7f0000000080)="40f6746d74ff938864d478385fd5f94f60514cd2ae1fcc40a376fd208889297ab397085cad379c077461faa00bec00"/62}, 0x20) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r1) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000910442000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x200, 0xc0, &(0x7f000000cf3d)=""/192, 0x0, 0x18, '\x00', 0x0, @sk_msg}, 0x94) 2.930779927s ago: executing program 0 (id=13557): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000007c0)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x30, 0xcf, 0x5, 0xfffff000}, {0x6}]}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5c0000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a0500212b00003c0012800b000100697036746e6c00002c0002808bbe603f6adc0bfaa1b917494f14000300200100000000000000000000000000001400020000000000000000000000ffff00000000"], 0x5c}}, 0x24000000) 1.192946383s ago: executing program 1 (id=13558): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x3, 0x7ab0715dca68fed7, 0xfffffffd, {}, {}, {}, 0x4, @canfd={{}, 0x0, 0x2, 0x0, 0x0, "b8ee0816756b62187804752330b2b55830d7228ef1593c0639bd084bba0bfd8db72f70e5b2e7f90e11cbc6ec61a03fc316d5d47970907af5fc4a27f6cf718909"}}, 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) socket$kcm(0x1e, 0x1, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x30, r2, 0x2, 0x60bd2c, 0x0, {{}, {0x0, 0x6}, {0x14}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 1.108858001s ago: executing program 3 (id=13559): r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000140), 0x40800) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_WOWLAN(r0, &(0x7f00000002c0)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r1, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x76}, @void, @val={0xc, 0x99, {0x4, 0x16}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$inet6(0xa, 0x3, 0x7) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x24) bind$rxrpc(r5, &(0x7f0000000100)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x0, @private1}}, 0x24) sendto$inet6(r4, &(0x7f0000000080)="800009e92208a1ce", 0xfdef, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x18) readv(r4, &(0x7f0000000980)=[{&(0x7f00000017c0)=""/4122, 0x101a}, {0x0, 0x18}], 0x2) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) ppoll(0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) close(0x3) 1.058410314s ago: executing program 1 (id=13560): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, 0x0, &(0x7f0000000040)=0x3f) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r1, @ANYRES8=r0, @ANYBLOB="a821000000000000140003000000000010220000018018000c80140001000f000000500b0000070000003a7a000000000055a5590a25954a75695f1bf247acb5f91bd1425ff00d24d647637da9d93f13076e1623f9893c4c066e24c0cf34e05cf2b9047ce9eecac6c77100d92ab4ce5129c5fe61c391e2a0c95efef077b324bba4215bac1a22dd71b3e41ea36c9d4e2d631d52b222bf1bf02c31f1048ccb10715cd7c42c5434755e5d0e8f91adbff3b9d063535c5f69cafd242a8c17ee17024790a69b898ecd6a7db05cd3f9a8e6813662e44627724913ec0f51f6c7f99ea5be872fcd8ec12ff708ddc4d04d94ef8ddb001753ad9f71efb931f6989642a4bda9b5c0339478018a7d31b3b34c1896d498949b118d0c9ba29551a4f203"], 0x54}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 1.00057148s ago: executing program 1 (id=13561): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x15, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1daa000000000000711019000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) 880.418053ms ago: executing program 1 (id=13562): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a00001400028010001980"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x69, 0x10, 0x7d}}, &(0x7f0000000480)='GPL\x00'}, 0x80) 830.099668ms ago: executing program 1 (id=13563): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newlink={0x3c, 0x10, 0x401, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4801, 0x15319}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9, 0xfffe}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44840}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) 48.354207ms ago: executing program 2 (id=13564): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x25dfdbfe, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x1d, 0x0, 0x1}, {0x7c}, {0x3, 0xfd, 0x40}, {0x0, 0x0, 0x0, 0x10000000}, {0x0, 0x0, 0x9}, {0x0, 0x0, 0xf8}, {0x5}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0x0, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="a000000029"], 0xa0}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x20, r2, 0x309, 0x0, 0x0, {0x1d}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}]}]}, 0x20}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031c00d3fc14e5fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x700, 0x1, 0xb, 0x8, {{0x36, 0x4, 0x1, 0x6, 0xd8, 0x64, 0x0, 0xfc, 0x2f, 0x0, @remote, @loopback, {[@noop, @ssrr={0x89, 0x13, 0x4c, [@multicast1, @dev={0xac, 0x14, 0x14, 0xe}, @local, @multicast2]}, @end, @ra={0x94, 0x4}, @noop, @timestamp_prespec={0x44, 0x4c, 0xf2, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x40}, {@empty, 0x3}, {@loopback, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1b}, 0xfffffff9}, {@remote, 0x4}, {@local, 0x6}, {@loopback, 0x6e59}, {@multicast2, 0x2}]}, @timestamp_prespec={0x44, 0x44, 0xa4, 0x3, 0xf, [{@dev={0xac, 0x14, 0x14, 0x37}, 0xffff}, {@local, 0xb326da2}, {@rand_addr=0x64010101, 0x5}, {@multicast2, 0x9}, {@multicast2, 0x1ff}, {@multicast1, 0x40}, {@empty}, {@empty, 0x3}]}, @timestamp={0x44, 0xc, 0x69, 0x0, 0x3, [0x59f83a4, 0xe]}, @timestamp_prespec={0x44, 0xc, 0xa5, 0x3, 0xf, [{@multicast2}]}]}}}}}) r7 = socket(0x10, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r8, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x5c, r2, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20040010}, 0x44000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x25dfdbfe, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x1d, 0x0, 0x1}, {0x7c}, {0x3, 0xfd, 0x40}, {0x0, 0x0, 0x0, 0x10000000}, {0x0, 0x0, 0x9}, {0x0, 0x0, 0xf8}, {0x5}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0x0, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="a000000029"], 0xa0}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x20, r2, 0x309, 0x0, 0x0, {0x1d}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}]}]}, 0x20}}, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'}) (async) sendto$packet(r3, &(0x7f00000002c0)="05031c00d3fc14e5fd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x700, 0x1, 0xb, 0x8, {{0x36, 0x4, 0x1, 0x6, 0xd8, 0x64, 0x0, 0xfc, 0x2f, 0x0, @remote, @loopback, {[@noop, @ssrr={0x89, 0x13, 0x4c, [@multicast1, @dev={0xac, 0x14, 0x14, 0xe}, @local, @multicast2]}, @end, @ra={0x94, 0x4}, @noop, @timestamp_prespec={0x44, 0x4c, 0xf2, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x40}, {@empty, 0x3}, {@loopback, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1b}, 0xfffffff9}, {@remote, 0x4}, {@local, 0x6}, {@loopback, 0x6e59}, {@multicast2, 0x2}]}, @timestamp_prespec={0x44, 0x44, 0xa4, 0x3, 0xf, [{@dev={0xac, 0x14, 0x14, 0x37}, 0xffff}, {@local, 0xb326da2}, {@rand_addr=0x64010101, 0x5}, {@multicast2, 0x9}, {@multicast2, 0x1ff}, {@multicast1, 0x40}, {@empty}, {@empty, 0x3}]}, @timestamp={0x44, 0xc, 0x69, 0x0, 0x3, [0x59f83a4, 0xe]}, @timestamp_prespec={0x44, 0xc, 0xa5, 0x3, 0xf, [{@multicast2}]}]}}}}}) (async) socket(0x10, 0x803, 0x0) (async) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r8, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) (async) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x5c, r2, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20040010}, 0x44000) (async) 0s ago: executing program 0 (id=13565): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x1f4, 0xe, 0x0, &(0x7f00000002c0)="ff412f66b083dcc1010b3efc8864", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYRESOCT=r0], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc6, &(0x7f0000000180)=""/198, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x3a0f}, 0x10, 0x0, r0}, 0x94) kernel console output (not intermixed with test programs): parsing attributes in process `syz.3.11753'. [ 1432.425254][T16369] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11754'. [ 1432.508458][T16372] syzkaller0: entered promiscuous mode [ 1432.535433][T16372] syzkaller0: entered allmulticast mode [ 1432.558165][T16372] 0: reclassify loop, rule prio 0, protocol 800 [ 1432.592990][T16372] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11756'. [ 1432.906543][T16391] bond0: option miimon: invalid value (18446744071829782528) [ 1432.916220][T16391] bond0: option miimon: allowed values 0 - 2147483647 [ 1434.164014][T16451] 8021q: adding VLAN 0 to HW filter on device bond72 [ 1434.217396][T16418] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1434.302763][T16459] netlink: 'syz.1.11779': attribute type 1 has an invalid length. [ 1434.421437][T16459] 8021q: adding VLAN 0 to HW filter on device bond76 [ 1434.543202][T16478] IPVS: Unknown mcast interface: dvmrp0 [ 1434.857107][T16491] nbd: couldn't find a device at index 0 [ 1435.369903][T16509] __nla_validate_parse: 6 callbacks suppressed [ 1435.369922][T16509] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11795'. [ 1435.446765][T16509] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11795'. [ 1435.503687][T16509] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11795'. [ 1435.560893][T16509] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11795'. [ 1435.759709][T16525] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11798'. [ 1435.846714][T16532] netlink: 'syz.1.11799': attribute type 2 has an invalid length. [ 1436.080063][T16544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11801'. [ 1436.145992][T16550] IPVS: length: 24 != 12312 [ 1437.377883][T16600] netlink: 'syz.3.11816': attribute type 83 has an invalid length. [ 1438.080935][T16634] IPv6: sit7: Disabled Multicast RS [ 1438.140111][T16582] netlink: 'syz.4.11810': attribute type 4 has an invalid length. [ 1439.962871][T14851] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x23 [ 1439.988858][T16709] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11843'. [ 1440.261636][T16714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11844'. [ 1440.426974][T16720] netlink: 'syz.3.11846': attribute type 2 has an invalid length. [ 1440.668907][T16729] x_tables: duplicate entry at hook 3 [ 1440.688931][T16728] x_tables: duplicate entry at hook 3 [ 1440.934822][T16739] netlink: 'syz.0.11851': attribute type 16 has an invalid length. [ 1440.990778][T16739] netlink: 'syz.0.11851': attribute type 3 has an invalid length. [ 1441.031606][T16739] netlink: 132 bytes leftover after parsing attributes in process `syz.0.11851'. [ 1441.101888][T16747] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11854'. [ 1441.186480][T16747] netlink: 576 bytes leftover after parsing attributes in process `syz.1.11854'. [ 1441.308265][T16757] netlink: 32 bytes leftover after parsing attributes in process `syz.3.11855'. [ 1441.353814][T16758] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11856'. [ 1441.402612][T16758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1441.567294][T16764] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11858'. [ 1441.688393][T16771] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.11859'. [ 1441.778101][T16780] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11863'. [ 1441.832455][T16780] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11863'. [ 1442.074834][T16793] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11865'. [ 1442.421835][T16812] netlink: 'syz.2.11869': attribute type 13 has an invalid length. [ 1442.470285][T16812] gretap0: refused to change device tx_queue_len [ 1442.511561][T16812] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1442.657265][T16824] mac80211_hwsim hwsim6 syzkaller0: Caught tx_queue_len zero misconfig [ 1443.447175][T16849] xt_CT: No such helper "snmp" [ 1444.304626][T16912] bond81: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1444.318081][T16912] bond81: (slave ip_vti0): Error -95 calling set_mac_address [ 1444.657133][T16927] openvswitch: netlink: Flow key attr not present in new flow. [ 1444.708405][T16930] €Â: renamed from bond_slave_0 [ 1444.871361][T16936] bridge15: entered promiscuous mode [ 1444.955898][T16946] netlink: 'syz.2.11900': attribute type 142 has an invalid length. [ 1445.403507][T16969] x_tables: unsorted underflow at hook 3 [ 1445.479272][T16969] netlink: 'syz.3.11903': attribute type 83 has an invalid length. [ 1446.314396][T17012] tipc: Enabling of bearer rejected, media not registered [ 1446.448301][T17018] 8021q: adding VLAN 0 to HW filter on device bond82 [ 1446.930531][T17054] __nla_validate_parse: 9 callbacks suppressed [ 1446.930551][T17054] netlink: 128 bytes leftover after parsing attributes in process `syz.2.11923'. [ 1446.972522][T17054] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11923'. [ 1449.171583][T17008] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1449.432127][T17086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11927'. [ 1449.473961][T17086] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11927'. [ 1449.750030][T17091] 8021q: adding VLAN 0 to HW filter on device bond83 [ 1449.769006][T17103] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11933'. [ 1449.785173][T17086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11927'. [ 1449.826034][T17106] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11933'. [ 1449.838923][T17086] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11927'. [ 1449.964039][T17103] 8021q: adding VLAN 0 to HW filter on device bond77 [ 1450.003746][T17111] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11934'. [ 1450.027697][T17116] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 1450.098156][T17120] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11936'. [ 1450.289304][T17125] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1450.311102][T17125] openvswitch: netlink: IP tunnel dst address not specified [ 1450.632326][T17142] netlink: 'syz.0.11941': attribute type 1 has an invalid length. [ 1451.014095][T17154] 8021q: adding VLAN 0 to HW filter on device bond81 [ 1451.158081][T17152] tunl0: entered promiscuous mode [ 1451.220097][T17152] tunl0: left allmulticast mode [ 1451.242455][T17152] netlink: 'syz.2.11944': attribute type 3 has an invalid length. [ 1451.582122][T17194] netlink: 'syz.0.11954': attribute type 4 has an invalid length. [ 1451.847875][T17207] openvswitch: netlink: IPv6 tunnel dst address is zero [ 1452.040825][T17224] IPVS: length: 183 != 8 [ 1452.355735][T17227] 8021q: adding VLAN 0 to HW filter on device bond82 [ 1452.447223][T17244] netlink: 'syz.0.11962': attribute type 5 has an invalid length. [ 1452.556446][T17249] __nla_validate_parse: 8 callbacks suppressed [ 1452.556530][T17249] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11964'. [ 1452.573509][T17249] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11964'. [ 1452.761856][T17256] tun1: tun_chr_ioctl cmd 1074025675 [ 1452.767380][T17256] tun1: persist enabled [ 1452.810033][T17258] netlink: 'syz.4.11967': attribute type 4 has an invalid length. [ 1453.708540][T17269] netlink: 'syz.3.11971': attribute type 3 has an invalid length. [ 1453.716649][T17269] netlink: 666 bytes leftover after parsing attributes in process `syz.3.11971'. [ 1453.727977][T17269] netlink: 'syz.3.11971': attribute type 10 has an invalid length. [ 1454.885001][T17218] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1455.316069][T17292] netlink: 48 bytes leftover after parsing attributes in process `syz.2.11976'. [ 1455.326903][T17294] x_tables: duplicate entry at hook 3 [ 1455.335550][T17282] 8021q: adding VLAN 0 to HW filter on device bond78 [ 1455.343738][T17292] netlink: 48 bytes leftover after parsing attributes in process `syz.2.11976'. [ 1455.510765][T17299] netlink: 'syz.2.11978': attribute type 4 has an invalid length. [ 1455.893484][T17313] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11982'. [ 1456.365806][T17344] netlink: 48 bytes leftover after parsing attributes in process `syz.0.11988'. [ 1456.388294][T17344] netlink: 48 bytes leftover after parsing attributes in process `syz.0.11988'. [ 1456.722643][T17355] netlink: 'syz.1.11991': attribute type 32 has an invalid length. [ 1456.755083][T17294] lo speed is unknown, defaulting to 1000 [ 1456.777979][T17361] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11989'. [ 1456.790496][T17358] netlink: 56 bytes leftover after parsing attributes in process `syz.0.11992'. [ 1456.827501][T17358] netlink: 'syz.0.11992': attribute type 2 has an invalid length. [ 1456.957712][T17355] bond79: Setting coupled_control to off (0) [ 1456.992132][T17294] wlan1 speed is unknown, defaulting to 1000 [ 1457.649624][T17392] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1457.681939][T17395] netlink: 'syz.4.11999': attribute type 1 has an invalid length. [ 1457.798687][T17400] __nla_validate_parse: 4 callbacks suppressed [ 1457.798707][T17400] netlink: 48 bytes leftover after parsing attributes in process `syz.2.12002'. [ 1457.822032][T17403] netlink: 'syz.1.12004': attribute type 32 has an invalid length. [ 1457.830134][T17403] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12004'. [ 1458.028641][T17409] netlink: 32 bytes leftover after parsing attributes in process `syz.0.12003'. [ 1458.224197][T17395] 8021q: adding VLAN 0 to HW filter on device bond83 [ 1458.351380][T17403] bond80: Setting coupled_control to off (0) [ 1458.455427][T17410] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1458.578737][T17421] netlink: 64985 bytes leftover after parsing attributes in process `syz.4.12005'. [ 1458.620688][T17427] openvswitch: netlink: Tunnel attr 3 has unexpected len 232 expected 1 [ 1458.717628][T17424] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12006'. [ 1458.835921][T17430] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12008'. [ 1458.882191][T17437] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1459.124056][T17441] netlink: 32 bytes leftover after parsing attributes in process `syz.2.12012'. [ 1459.179808][T17450] vlan3: entered promiscuous mode [ 1459.380721][T17462] FAULT_INJECTION: forcing a failure. [ 1459.380721][T17462] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1459.487482][T17462] CPU: 0 UID: 0 PID: 17462 Comm: syz.1.12018 Not tainted syzkaller #0 PREEMPT(full) [ 1459.487511][T17462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1459.487524][T17462] Call Trace: [ 1459.487533][T17462] [ 1459.487542][T17462] dump_stack_lvl+0xe8/0x150 [ 1459.487579][T17462] should_fail_ex+0x40c/0x560 [ 1459.487609][T17462] _copy_from_user+0x2d/0xb0 [ 1459.487640][T17462] kstrtouint_from_user+0xd6/0x180 [ 1459.487668][T17462] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1459.487711][T17462] proc_fail_nth_write+0x8e/0x210 [ 1459.487739][T17462] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1459.487775][T17462] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1459.487802][T17462] vfs_write+0x296/0xba0 [ 1459.487842][T17462] ? __pfx_vfs_write+0x10/0x10 [ 1459.487873][T17462] ? __fget_files+0x2a/0x420 [ 1459.487904][T17462] ? __fget_files+0x3a2/0x420 [ 1459.487928][T17462] ? __fget_files+0x2a/0x420 [ 1459.487963][T17462] ksys_write+0x150/0x270 [ 1459.487997][T17462] ? __pfx_ksys_write+0x10/0x10 [ 1459.488035][T17462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1459.488058][T17462] do_syscall_64+0x174/0x580 [ 1459.488089][T17462] ? clear_bhb_loop+0x40/0x90 [ 1459.488115][T17462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1459.488142][T17462] RIP: 0033:0x7fa427d5e68e [ 1459.488161][T17462] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1459.488179][T17462] RSP: 002b:00007fa428d17fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1459.488201][T17462] RAX: ffffffffffffffda RBX: 00007fa428d186c0 RCX: 00007fa427d5e68e [ 1459.488216][T17462] RDX: 0000000000000001 RSI: 00007fa428d180a0 RDI: 0000000000000004 [ 1459.488228][T17462] RBP: 00007fa428d18090 R08: 0000000000000000 R09: 0000000000000000 [ 1459.488241][T17462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1459.488253][T17462] R13: 00007fa428026038 R14: 00007fa428025fa0 R15: 00007ffdf6169158 [ 1459.488287][T17462] [ 1459.844489][T17468] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12021'. [ 1459.865333][T17475] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12023'. [ 1460.461718][T17508] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12030'. [ 1460.956766][T17531] netlink: 'syz.1.12036': attribute type 8 has an invalid length. [ 1461.411761][T17555] bond85: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 1461.436809][T17548] syzkaller0: entered promiscuous mode [ 1461.459514][T17548] syzkaller0: entered allmulticast mode [ 1462.610749][T17625] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1464.274191][T17547] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1464.613744][T17644] __nla_validate_parse: 3 callbacks suppressed [ 1464.613766][T17644] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12052'. [ 1464.715163][T17644] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1464.835971][T17649] netlink: 156 bytes leftover after parsing attributes in process `syz.4.12057'. [ 1465.501209][T17686] netlink: 76 bytes leftover after parsing attributes in process `syz.4.12065'. [ 1466.136112][T17707] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12073'. [ 1466.161247][T17709] netlink: 44 bytes leftover after parsing attributes in process `syz.3.12074'. [ 1466.761419][T17746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12082'. [ 1466.771982][T17739] lo: MTU too low for tipc bearer [ 1466.791358][T17739] tipc: Enabling of bearer rejected, failed to enable media [ 1466.819927][T17746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12082'. [ 1466.958769][T17757] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12084'. [ 1467.128336][T17767] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12087'. [ 1467.228253][T17774] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12089'. [ 1467.468283][T17784] openvswitch: netlink: Message has 512 unknown bytes. [ 1468.225922][ T5289] netdevsim netdevsim0 netdevsim3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1468.247289][ T5289] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1468.286332][T17817] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1468.350163][T17817] bond0: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1468.407168][T17822] IPVS: stopping backup sync thread 5789 ... [ 1468.654982][T17831] netlink: 'syz.3.12105': attribute type 4 has an invalid length. [ 1469.843376][T17898] xt_limit: Overflow, try lower: 271964/0 [ 1471.630807][T17832] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1472.265863][T17939] __nla_validate_parse: 11 callbacks suppressed [ 1472.265887][T17939] netlink: 48 bytes leftover after parsing attributes in process `syz.0.12123'. [ 1472.534507][T17944] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12124'. [ 1472.848399][T17964] netlink: 'syz.3.12128': attribute type 1 has an invalid length. [ 1472.884317][T17969] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1472.915273][T17976] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12131'. [ 1472.944974][T17972] bond74: entered allmulticast mode [ 1472.957841][T17979] netlink: 'syz.0.12130': attribute type 4 has an invalid length. [ 1472.958163][T17972] 8021q: adding VLAN 0 to HW filter on device bond74 [ 1473.002400][T17964] workqueue: Failed to create a rescuer kthread for wq "bond84": -EINTR [ 1473.043525][T17972] netlink: 'syz.0.12130': attribute type 4 has an invalid length. [ 1473.666955][T17995] syzkaller0: entered promiscuous mode [ 1473.687380][T17995] syzkaller0: entered allmulticast mode [ 1473.707205][T18017] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12140'. [ 1477.005428][T18046] netlink: 'syz.3.12145': attribute type 1 has an invalid length. [ 1477.435501][T18069] netlink: 44 bytes leftover after parsing attributes in process `syz.0.12153'. [ 1477.691475][T18082] netlink: 256 bytes leftover after parsing attributes in process `syz.0.12158'. [ 1477.808035][T18077] syzkaller0: entered promiscuous mode [ 1477.840920][T18077] syzkaller0: entered allmulticast mode [ 1478.008637][T18103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12163'. [ 1478.094836][T18107] netlink: 1 bytes leftover after parsing attributes in process `syz.2.12165'. [ 1478.142303][T18107] xt_policy: neither incoming nor outgoing policy selected [ 1478.510747][T18109] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12165'. [ 1478.556042][T18128] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12168'. [ 1478.845426][T18138] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12171'. [ 1481.766924][T18128] workqueue: Failed to create a rescuer kthread for wq "bond86": -EINTR [ 1481.960807][T18163] netlink: 'syz.0.12174': attribute type 39 has an invalid length. [ 1481.993818][T18166] netlink: 'syz.3.12173': attribute type 39 has an invalid length. [ 1482.153228][T18178] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12174'. [ 1482.347783][T18178] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 1482.556672][T18192] tipc: Enabled bearer , priority 11 [ 1482.907763][T18207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12184'. [ 1483.115959][T18214] ip6tnl0: left promiscuous mode [ 1483.138791][T18214] bond75: (slave ip6tnl0): The slave device specified does not support setting the MAC address [ 1483.174355][T18207] netlink: 156 bytes leftover after parsing attributes in process `syz.0.12184'. [ 1483.206288][T18214] bond75: (slave ip6tnl0): Error -95 calling set_mac_address [ 1483.653856][T18224] syzkaller0: entered promiscuous mode [ 1483.666087][T18240] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1483.677347][T18224] syzkaller0: entered allmulticast mode [ 1487.443563][T18282] openvswitch: netlink: Actions may not be safe on all matching packets [ 1487.476866][T18282] netlink: 1044 bytes leftover after parsing attributes in process `syz.2.12194'. [ 1487.524523][T18290] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12197'. [ 1487.560995][T18290] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12197'. [ 1487.851565][T18306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1487.887092][T18311] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.12199'. [ 1487.918529][T18306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1487.965304][T18306] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1487.988835][T18312] xt_hashlimit: size too large, truncated to 1048576 [ 1488.025830][T18306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1488.082400][T18306] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1488.135759][T18306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1488.194506][T18306] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12200'. [ 1488.529037][T18331] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12204'. [ 1488.563568][T18331] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12204'. [ 1488.612048][T18331] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12204'. [ 1489.150178][T18342] syzkaller0: entered promiscuous mode [ 1489.186797][T18342] syzkaller0: entered allmulticast mode [ 1489.511727][T18360] netlink: 'syz.1.12209': attribute type 25 has an invalid length. [ 1493.165672][T18390] xt_TCPMSS: Only works on TCP SYN packets [ 1493.277132][T18391] nbd2: detected capacity change from 0 to 63 [ 1493.623442][ T5632] block nbd2: Receive control failed (result -104) [ 1493.925791][T18440] syzkaller0: entered promiscuous mode [ 1493.945750][T18440] syzkaller0: entered allmulticast mode [ 1493.991876][T18443] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12219'. [ 1494.064324][T18448] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12221'. [ 1494.627199][T18474] netlink: 56 bytes leftover after parsing attributes in process `syz.3.12224'. [ 1494.639213][T18474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12224'. [ 1494.648376][T18474] netlink: 31 bytes leftover after parsing attributes in process `syz.3.12224'. [ 1494.666835][T18475] veth0_to_bond: Caught tx_queue_len zero misconfig [ 1494.684195][T18474] netlink: 'syz.3.12224': attribute type 2 has an invalid length. [ 1494.693772][T18474] netlink: 31 bytes leftover after parsing attributes in process `syz.3.12224'. [ 1494.978715][T18485] syzkaller0: entered promiscuous mode [ 1494.988424][T18485] syzkaller0: entered allmulticast mode [ 1496.138207][T18424] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1498.648151][T18495] h: entered promiscuous mode [ 1499.726142][T18554] tipc: Enabled bearer , priority 0 [ 1499.851785][T18563] netlink: 'syz.2.12247': attribute type 49 has an invalid length. [ 1500.126397][T18554] syzkaller0: entered promiscuous mode [ 1500.153489][T18554] syzkaller0: entered allmulticast mode [ 1500.186224][T18554] tipc: Resetting bearer [ 1502.034853][T18627] xt_hashlimit: size too large, truncated to 1048576 [ 1502.158620][T18632] syzkaller0: entered promiscuous mode [ 1502.165380][T18632] syzkaller0: entered allmulticast mode [ 1502.233394][T18630] netlink: 40 bytes leftover after parsing attributes in process `syz.3.12258'. [ 1502.630689][T18566] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1502.717970][T18552] tipc: Resetting bearer [ 1505.504156][T18552] tipc: Disabling bearer [ 1505.775346][T18649] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12264'. [ 1505.917370][T18659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12267'. [ 1505.979441][T18657] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12267'. [ 1506.710298][T18692] tipc: Enabled bearer , priority 0 [ 1506.971410][T18692] syzkaller0: entered promiscuous mode [ 1506.992877][T18692] syzkaller0: entered allmulticast mode [ 1507.029741][T18692] tipc: Resetting bearer [ 1507.478643][T18726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12282'. [ 1509.650528][T18704] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1509.728561][T18691] tipc: Resetting bearer [ 1509.900066][T18748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12284'. [ 1509.918513][T18750] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12285'. [ 1512.788490][T18691] tipc: Disabling bearer [ 1513.519720][T18804] SET target dimension over the limit! [ 1513.565555][T18802] macvlan0: left promiscuous mode [ 1513.600459][T18802] netlink: 'syz.0.12297': attribute type 2 has an invalid length. [ 1513.644868][T18811] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12299'. [ 1513.711500][T18814] netlink: 84 bytes leftover after parsing attributes in process `syz.3.12300'. [ 1514.090017][T18831] netlink: 40 bytes leftover after parsing attributes in process `syz.1.12304'. [ 1514.143496][T18835] netlink: 'syz.3.12303': attribute type 1 has an invalid length. [ 1514.358359][T18835] 8021q: adding VLAN 0 to HW filter on device bond84 [ 1514.461218][T18842] bond84: (slave geneve3): making interface the new active one [ 1514.503350][T18842] bond84: (slave geneve3): Enslaving as an active interface with an up link [ 1514.533359][T14843] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.573885][T11102] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.606563][T11102] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.645239][T11102] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.684178][T18857] xt_hashlimit: size too large, truncated to 1048576 [ 1515.010440][T18870] netlink: 'syz.0.12312': attribute type 2 has an invalid length. [ 1515.031977][T18872] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12313'. [ 1515.126482][T18873] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12313'. [ 1516.155580][T18891] netlink: 'syz.4.12318': attribute type 1 has an invalid length. [ 1516.169382][T18891] netlink: 16179 bytes leftover after parsing attributes in process `syz.4.12318'. [ 1516.221340][T18924] netdevsim netdevsim2 netdevsim2: entered allmulticast mode [ 1516.496946][T18933] netlink: 'syz.2.12330': attribute type 10 has an invalid length. [ 1516.535205][T18933] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12330'. [ 1516.617507][T18933] team0: Port device geneve1 added [ 1516.654572][T13333] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1516.690859][T13333] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1516.840303][T13333] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1516.885663][T13333] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1517.648149][T18966] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1518.202005][T18999] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12346'. [ 1518.246095][T19001] netlink: 'syz.1.12347': attribute type 32 has an invalid length. [ 1518.276523][T19001] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12347'. [ 1518.552602][T19001] bond81: Setting coupled_control to off (0) [ 1519.004850][T19030] netlink: 'syz.3.12352': attribute type 32 has an invalid length. [ 1519.062378][T19030] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12352'. [ 1519.207499][T19038] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12354'. [ 1519.244846][T19030] bond85: option coupled_control: invalid value (128) [ 1519.299770][T19030] bond85 (unregistering): Released all slaves [ 1519.308122][T19038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12354'. [ 1519.369478][T19038] netlink: 'syz.1.12354': attribute type 12 has an invalid length. [ 1519.387430][T19038] netlink: 'syz.1.12354': attribute type 11 has an invalid length. [ 1519.583830][T19047] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1519.657416][T19049] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12356'. [ 1519.866970][T19055] bond82: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1519.878819][T19055] bond82: (slave ip_vti0): Error -95 calling set_mac_address [ 1519.894049][T19063] netlink: 104 bytes leftover after parsing attributes in process `syz.4.12359'. [ 1520.013407][T19052] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12357'. [ 1520.158009][T19061] syzkaller0: entered promiscuous mode [ 1520.184070][T19061] syzkaller0: entered allmulticast mode [ 1521.053026][T19086] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12366'. [ 1523.590062][T19097] netlink: 48 bytes leftover after parsing attributes in process `syz.1.12368'. [ 1523.616617][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 30 seconds [ 1523.631541][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 30 seconds [ 1523.643031][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 30 seconds [ 1523.654291][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 30 seconds [ 1523.666928][T19100] netlink: 44 bytes leftover after parsing attributes in process `syz.3.12369'. [ 1523.816420][T19105] netlink: 104 bytes leftover after parsing attributes in process `syz.4.12370'. [ 1524.043728][T19122] sctp: [Deprecated]: syz.3.12373 (pid 19122) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1524.043728][T19122] Use struct sctp_sack_info instead [ 1524.155407][T19133] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12374'. [ 1524.193103][T19133] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1524.358300][T19139] netlink: 'syz.2.12377': attribute type 23 has an invalid length. [ 1524.767150][T19160] IPv6: sit8: Disabled Multicast RS [ 1525.125415][T19173] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12384'. [ 1525.145493][T19175] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12385'. [ 1525.455135][T19182] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12387'. [ 1525.562568][T19186] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12387'. [ 1526.097770][T19212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12395'. [ 1526.146955][T19212] netlink: 'syz.2.12395': attribute type 18 has an invalid length. [ 1526.169461][T19212] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12395'. [ 1526.191297][T19215] vlan0: Caught tx_queue_len zero misconfig [ 1526.259851][T19221] netlink: 104 bytes leftover after parsing attributes in process `syz.4.12397'. [ 1526.449838][T19224] netlink: 'syz.3.12398': attribute type 29 has an invalid length. [ 1526.620478][T19240] netlink: 'syz.1.12403': attribute type 75 has an invalid length. [ 1526.637696][T19224] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1526.652461][T19242] netlink: 'syz.1.12403': attribute type 75 has an invalid length. [ 1527.293028][T19271] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12410'. [ 1528.014145][T19307] FAULT_INJECTION: forcing a failure. [ 1528.014145][T19307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1528.078758][T19307] CPU: 0 UID: 0 PID: 19307 Comm: syz.3.12419 Not tainted syzkaller #0 PREEMPT(full) [ 1528.078806][T19307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1528.078828][T19307] Call Trace: [ 1528.078838][T19307] [ 1528.078848][T19307] dump_stack_lvl+0xe8/0x150 [ 1528.078888][T19307] should_fail_ex+0x40c/0x560 [ 1528.078920][T19307] _copy_from_user+0x2d/0xb0 [ 1528.078954][T19307] kstrtouint_from_user+0xd6/0x180 [ 1528.078988][T19307] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1528.079032][T19307] proc_fail_nth_write+0x8e/0x210 [ 1528.079062][T19307] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1528.079101][T19307] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1528.079130][T19307] vfs_write+0x296/0xba0 [ 1528.079174][T19307] ? __pfx_vfs_write+0x10/0x10 [ 1528.079210][T19307] ? __fget_files+0x2a/0x420 [ 1528.079244][T19307] ? __fget_files+0x3a2/0x420 [ 1528.079272][T19307] ? __fget_files+0x2a/0x420 [ 1528.079312][T19307] ksys_write+0x150/0x270 [ 1528.079349][T19307] ? __pfx_ksys_write+0x10/0x10 [ 1528.079392][T19307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1528.079418][T19307] do_syscall_64+0x174/0x580 [ 1528.079449][T19307] ? trace_irq_disable+0x3b/0x140 [ 1528.079478][T19307] ? clear_bhb_loop+0x40/0x90 [ 1528.079507][T19307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1528.079537][T19307] RIP: 0033:0x7f19c695e68e [ 1528.079558][T19307] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1528.079579][T19307] RSP: 002b:00007f19c7849fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1528.079603][T19307] RAX: ffffffffffffffda RBX: 00007f19c784a6c0 RCX: 00007f19c695e68e [ 1528.079620][T19307] RDX: 0000000000000001 RSI: 00007f19c784a0a0 RDI: 0000000000000004 [ 1528.079635][T19307] RBP: 00007f19c784a090 R08: 0000000000000000 R09: 0000000000000000 [ 1528.079650][T19307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1528.079663][T19307] R13: 00007f19c6c26038 R14: 00007f19c6c25fa0 R15: 00007ffcb6728178 [ 1528.079701][T19307] [ 1528.514512][T19317] netlink: 'syz.1.12420': attribute type 1 has an invalid length. [ 1528.547469][T19317] 8021q: adding VLAN 0 to HW filter on device bond83 [ 1528.636048][T19327] netlink: 56 bytes leftover after parsing attributes in process `syz.3.12423'. [ 1528.834739][T19335] netlink: 'syz.2.12427': attribute type 32 has an invalid length. [ 1528.995164][T19335] bond84: Setting coupled_control to off (0) [ 1529.422153][T19361] tipc: Enabled bearer , priority 0 [ 1529.548629][T19370] __nla_validate_parse: 6 callbacks suppressed [ 1529.548651][T19370] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12436'. [ 1529.815106][T19369] syzkaller0: entered promiscuous mode [ 1529.843902][T19369] syzkaller0: entered allmulticast mode [ 1529.858114][T19369] tipc: Resetting bearer [ 1529.940938][T19360] tipc: Resetting bearer [ 1530.707850][T19401] netlink: 'syz.3.12443': attribute type 32 has an invalid length. [ 1530.737365][T19401] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12443'. [ 1531.008457][ T30] audit: type=1804 audit(1783934884.543:76): pid=19408 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.12445" name="/newroot/2472/cgroup.controllers" dev="tmpfs" ino=12571 res=1 errno=0 [ 1531.061827][ T30] audit: type=1800 audit(1783934884.573:77): pid=19408 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.12445" name="cgroup.controllers" dev="tmpfs" ino=12571 res=0 errno=0 [ 1531.146765][T19409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12445'. [ 1533.516116][T19360] tipc: Disabling bearer [ 1533.559169][T19396] vlan0: entered promiscuous mode [ 1533.564279][T19396] bridge0: entered promiscuous mode [ 1533.652943][T19401] bond85: Setting coupled_control to off (0) [ 1534.003484][T19424] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12447'. [ 1534.144315][T19429] 8021q: adding VLAN 0 to HW filter on device bond76 [ 1534.485070][T19448] netlink: 64 bytes leftover after parsing attributes in process `syz.0.12455'. [ 1534.561694][T19461] syzkaller1: entered promiscuous mode [ 1534.594942][T19461] syzkaller1: entered allmulticast mode [ 1534.745834][T19466] netlink: 'syz.3.12458': attribute type 32 has an invalid length. [ 1534.814939][T19466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12458'. [ 1534.988372][T19466] bond86: Setting coupled_control to off (0) [ 1535.013071][T19482] netlink: 104 bytes leftover after parsing attributes in process `syz.1.12463'. [ 1535.253668][T19498] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 1535.273337][T19490] 8021q: adding VLAN 0 to HW filter on device bond77 [ 1535.549746][T19510] netlink: 'syz.1.12469': attribute type 9 has an invalid length. [ 1536.008261][T19532] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12476'. [ 1536.122322][T19535] bridge23: entered allmulticast mode [ 1536.138495][T19536] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12477'. [ 1536.344955][T19549] netlink: 256 bytes leftover after parsing attributes in process `syz.0.12478'. [ 1536.437277][T19549] netlink: 236 bytes leftover after parsing attributes in process `syz.0.12478'. [ 1536.472100][T19554] 8021q: adding VLAN 0 to HW filter on device bond86 [ 1536.965229][T19582] netlink: 104 bytes leftover after parsing attributes in process `syz.1.12490'. [ 1537.184361][T19594] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12492'. [ 1537.450909][T19595] 8021q: adding VLAN 0 to HW filter on device bond87 [ 1537.873817][T19628] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12503'. [ 1538.160315][T19620] nbd1: detected capacity change from 0 to 63 [ 1538.172776][T19624] block nbd1: NBD_DISCONNECT [ 1538.212400][T19624] block nbd1: Disconnected due to user request. [ 1538.224542][ T4958] blk_print_req_error: 109 callbacks suppressed [ 1538.224564][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1538.241827][ T4958] buffer_io_error: 138 callbacks suppressed [ 1538.241857][ T4958] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1538.255816][ T4958] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 1538.266676][ T4958] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1538.275573][ T4958] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1538.285626][ T4958] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1538.299609][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.300618][T19624] block nbd1: shutting down sockets [ 1538.308769][ T4958] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1538.322924][ T4958] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1538.330924][ T4958] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1538.338736][ T4958] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1538.350015][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.360142][ T4958] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1538.367959][ T4958] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1538.376335][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.386047][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.396674][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.406426][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.416290][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 1538.426709][T18421] ldm_validate_partition_table(): Disk read failed. [ 1538.433926][ T4958] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1538.447189][T18421] Dev nbd1: unable to read RDB block 0 [ 1538.456428][T18421] nbd1: unable to read partition table [ 1538.561754][T18421] ldm_validate_partition_table(): Disk read failed. [ 1538.601613][T18421] Dev nbd1: unable to read RDB block 0 [ 1538.624668][T18421] nbd1: unable to read partition table [ 1539.118520][T19673] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12513'. [ 1539.822112][T19701] netlink: 'syz.2.12521': attribute type 18 has an invalid length. [ 1539.860509][T19701] netlink: 'syz.2.12521': attribute type 18 has an invalid length. [ 1540.015557][T19709] __nla_validate_parse: 2 callbacks suppressed [ 1540.015579][T19709] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12523'. [ 1540.558322][T19742] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12529'. [ 1540.670851][T19745] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12531'. [ 1540.760325][T19751] netlink: 76 bytes leftover after parsing attributes in process `syz.4.12533'. [ 1540.933926][T19754] netlink: 'syz.1.12534': attribute type 2 has an invalid length. [ 1541.072302][T19762] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12536'. [ 1541.372581][T19773] wg2: left promiscuous mode [ 1541.403899][T19773] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check. [ 1541.457539][ T808] lo speed is unknown, defaulting to 1000 [ 1541.467435][ T808] syú2: Port: 1 Link DOWN [ 1541.504031][T19772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12538'. [ 1541.520476][T19772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12538'. [ 1541.621279][T19784] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1541.866573][T19801] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12543'. [ 1542.028819][T19810] xt_hashlimit: size too large, truncated to 1048576 [ 1542.213147][T19815] netlink: 96 bytes leftover after parsing attributes in process `syz.2.12547'. [ 1542.959618][T19850] netlink: 96 bytes leftover after parsing attributes in process `syz.3.12557'. [ 1543.289697][T19864] netlink: 'syz.4.12560': attribute type 1 has an invalid length. [ 1543.562862][T19875] team0: Device gtp5 is up. Set it down before adding it as a team port [ 1543.619894][T19881] netlink: 'syz.0.12563': attribute type 4 has an invalid length. [ 1543.674110][T19878] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1543.755482][T19883] netlink: 'syz.4.12565': attribute type 2 has an invalid length. [ 1543.805250][T19883] netlink: 'syz.4.12565': attribute type 2 has an invalid length. [ 1543.932290][T19889] FAULT_INJECTION: forcing a failure. [ 1543.932290][T19889] name failslab, interval 1, probability 0, space 0, times 0 [ 1544.004987][T19889] CPU: 0 UID: 0 PID: 19889 Comm: syz.2.12566 Not tainted syzkaller #0 PREEMPT(full) [ 1544.005018][T19889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1544.005033][T19889] Call Trace: [ 1544.005042][T19889] [ 1544.005051][T19889] dump_stack_lvl+0xe8/0x150 [ 1544.005092][T19889] should_fail_ex+0x40c/0x560 [ 1544.005123][T19889] should_failslab+0xa8/0x100 [ 1544.005160][T19889] __kmalloc_noprof+0xfe/0x720 [ 1544.005186][T19889] ? rcu_is_watching+0x15/0xb0 [ 1544.005218][T19889] ? tomoyo_realpath_from_path+0xef/0x640 [ 1544.005241][T19889] ? tomoyo_realpath_from_path+0xef/0x640 [ 1544.005272][T19889] tomoyo_realpath_from_path+0xef/0x640 [ 1544.005306][T19889] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1544.005339][T19889] tomoyo_path_number_perm+0x246/0x5f0 [ 1544.005376][T19889] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1544.005406][T19889] ? __lock_acquire+0x683/0x2cf0 [ 1544.005454][T19889] ? hook_file_ioctl+0x1f0/0x5f0 [ 1544.005511][T19889] ? __fget_files+0x2a/0x420 [ 1544.005544][T19889] ? __fget_files+0x2a/0x420 [ 1544.005570][T19889] ? __fget_files+0x3a2/0x420 [ 1544.005597][T19889] ? __fget_files+0x2a/0x420 [ 1544.005631][T19889] security_file_ioctl+0xc3/0x2a0 [ 1544.005664][T19889] __se_sys_ioctl+0x47/0x170 [ 1544.005685][T19889] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.005711][T19889] do_syscall_64+0x174/0x580 [ 1544.005741][T19889] ? trace_irq_disable+0x3b/0x140 [ 1544.005769][T19889] ? clear_bhb_loop+0x40/0x90 [ 1544.005797][T19889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.005819][T19889] RIP: 0033:0x7f00cdb9de59 [ 1544.005839][T19889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1544.005858][T19889] RSP: 002b:00007f00cea4d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1544.005882][T19889] RAX: ffffffffffffffda RBX: 00007f00cde25fa0 RCX: 00007f00cdb9de59 [ 1544.005898][T19889] RDX: 0000200000000080 RSI: 0000000000008931 RDI: 0000000000000004 [ 1544.005913][T19889] RBP: 00007f00cea4d090 R08: 0000000000000000 R09: 0000000000000000 [ 1544.005926][T19889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1544.005940][T19889] R13: 00007f00cde26038 R14: 00007f00cde25fa0 R15: 00007ffde5bd8c78 [ 1544.005985][T19889] [ 1544.233351][T19889] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1544.392880][T19870] lo speed is unknown, defaulting to 1000 [ 1544.400745][T19870] wlan1 speed is unknown, defaulting to 1000 [ 1544.654579][T19904] FAULT_INJECTION: forcing a failure. [ 1544.654579][T19904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1544.716014][T19904] CPU: 1 UID: 0 PID: 19904 Comm: syz.3.12570 Not tainted syzkaller #0 PREEMPT(full) [ 1544.716045][T19904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1544.716058][T19904] Call Trace: [ 1544.716067][T19904] [ 1544.716077][T19904] dump_stack_lvl+0xe8/0x150 [ 1544.716116][T19904] should_fail_ex+0x40c/0x560 [ 1544.716148][T19904] _copy_from_iter+0x1d3/0x1660 [ 1544.716176][T19904] ? kmem_cache_alloc_node_noprof+0x1a1/0x610 [ 1544.716205][T19904] ? rcu_is_watching+0x15/0xb0 [ 1544.716240][T19904] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1544.716269][T19904] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1544.716296][T19904] ? __pfx__copy_from_iter+0x10/0x10 [ 1544.716324][T19904] ? __alloc_skb+0x276/0x7a0 [ 1544.716353][T19904] ? __alloc_skb+0x276/0x7a0 [ 1544.716389][T19904] ? netlink_sendmsg+0x650/0xb40 [ 1544.716410][T19904] ? skb_put+0x112/0x210 [ 1544.716452][T19904] netlink_sendmsg+0x6c0/0xb40 [ 1544.716485][T19904] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1544.716512][T19904] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1544.716541][T19904] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1544.716565][T19904] sock_sendmsg_nosec+0x13a/0x180 [ 1544.716596][T19904] ____sys_sendmsg+0x54e/0x850 [ 1544.716636][T19904] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1544.716681][T19904] ? import_iovec+0x73/0xa0 [ 1544.716717][T19904] ___sys_sendmsg+0x2a5/0x360 [ 1544.716749][T19904] ? __lock_acquire+0x683/0x2cf0 [ 1544.716803][T19904] ? __pfx____sys_sendmsg+0x10/0x10 [ 1544.716834][T19904] ? __lock_acquire+0x683/0x2cf0 [ 1544.716870][T19904] ? kstrtouint+0x6e/0xe0 [ 1544.716942][T19904] __sys_sendmmsg+0x273/0x4d0 [ 1544.716983][T19904] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1544.717028][T19904] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1544.717077][T19904] ? ksys_write+0x242/0x270 [ 1544.717114][T19904] ? __pfx_ksys_write+0x10/0x10 [ 1544.717155][T19904] __x64_sys_sendmmsg+0xa0/0xc0 [ 1544.717189][T19904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.717219][T19904] do_syscall_64+0x174/0x580 [ 1544.717249][T19904] ? trace_irq_disable+0x3b/0x140 [ 1544.717277][T19904] ? clear_bhb_loop+0x40/0x90 [ 1544.717303][T19904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1544.717324][T19904] RIP: 0033:0x7f19c699de59 [ 1544.717345][T19904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1544.717364][T19904] RSP: 002b:00007f19c784a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1544.717388][T19904] RAX: ffffffffffffffda RBX: 00007f19c6c25fa0 RCX: 00007f19c699de59 [ 1544.717405][T19904] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000005 [ 1544.717420][T19904] RBP: 00007f19c784a090 R08: 0000000000000000 R09: 0000000000000000 [ 1544.717441][T19904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1544.717455][T19904] R13: 00007f19c6c26038 R14: 00007f19c6c25fa0 R15: 00007ffcb6728178 [ 1544.717491][T19904] [ 1544.886719][T19910] netlink: 'syz.2.12571': attribute type 3 has an invalid length. [ 1545.243438][T19905] __nla_validate_parse: 8 callbacks suppressed [ 1545.243461][T19905] netlink: 60 bytes leftover after parsing attributes in process `syz.2.12571'. [ 1545.782276][T19933] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12576'. [ 1545.857428][T19938] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1545.880238][T19936] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12579'. [ 1545.946685][T19932] ip6gre5: entered allmulticast mode [ 1546.107633][T20828] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1547.051324][T19982] x_tables: duplicate underflow at hook 1 [ 1547.724862][T20004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12596'. [ 1547.803820][T20009] netlink: 'syz.1.12597': attribute type 30 has an invalid length. [ 1548.020968][T20019] netlink: 'syz.2.12599': attribute type 32 has an invalid length. [ 1548.044697][T20021] netlink: 144 bytes leftover after parsing attributes in process `syz.4.12600'. [ 1548.063066][T20019] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12599'. [ 1548.148656][T20019] bond85: option coupled_control: invalid value (192) [ 1548.176475][T20019] bond85 (unregistering): Released all slaves [ 1548.469635][T20041] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12603'. [ 1549.027755][T20051] netlink: 388 bytes leftover after parsing attributes in process `syz.4.12604'. [ 1549.362762][T20065] C: renamed from lo (while UP) [ 1549.398524][T20065] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1549.534688][T20077] sch_fq: defrate 9 ignored. [ 1549.547933][T20074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12611'. [ 1549.614999][T20078] bridge0: entered allmulticast mode [ 1549.622062][T20077] IPVS: length: 186 != 8 [ 1549.767451][T20091] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1549.849169][ C1] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1549.931255][T20104] netlink: 'syz.1.12619': attribute type 9 has an invalid length. [ 1550.313069][T20116] can: request_module (can-proto-0) failed. [ 1550.464160][T20122] syzkaller0: entered promiscuous mode [ 1550.484079][T20122] syzkaller0: entered allmulticast mode [ 1550.527835][T20122] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12621'. [ 1550.586219][T20122] 8021q: adding VLAN 0 to HW filter on device bond90 [ 1550.597006][T20123] ipvlan0: Caught tx_queue_len zero misconfig [ 1550.605166][T20134] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1551.055152][T20155] tap0: tun_chr_ioctl cmd 1074025672 [ 1551.090479][T20155] tap0: ignored: set checksum disabled [ 1551.627976][T20190] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1551.667763][T20190] netlink: 'syz.4.12639': attribute type 19 has an invalid length. [ 1551.700001][T20190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12639'. [ 1551.735936][T20190] netlink: 'syz.4.12639': attribute type 19 has an invalid length. [ 1551.790106][T20190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12639'. [ 1552.066441][T20213] sctp: [Deprecated]: syz.4.12646 (pid 20213) Use of int in maxseg socket option. [ 1552.066441][T20213] Use struct sctp_assoc_value instead [ 1552.604428][T20226] netlink: 'syz.4.12649': attribute type 8 has an invalid length. [ 1552.937480][T20236] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12651'. [ 1553.118326][T20237] bond87: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1553.193402][T20237] bond87: (slave ip_vti0): Error -95 calling set_mac_address [ 1553.709301][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 60 seconds [ 1553.720177][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 60 seconds [ 1553.731840][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 60 seconds [ 1553.743696][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 60 seconds [ 1555.335643][ T4994] udevd[4994]: worker [18412] /devices/virtual/block/nbd2 is taking a long time [ 1558.169200][ C1] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1574.169186][ C1] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1576.421087][T21017] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12657'. [ 1576.440024][T21017] openvswitch: netlink: Flow key attr not present in new flow. [ 1576.487085][T21015] bond88: option arp_all_targets: invalid value (18446744073709551613) [ 1576.506271][T21015] bond88 (unregistering): Released all slaves [ 1576.542987][T21014] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1576.544061][T21021] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1576.560076][T21021] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1576.568678][T21014] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1577.037774][T21041] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12667'. [ 1577.211779][T21046] bond84: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1577.255012][T21046] bond84: (slave ip_vti0): Error -95 calling set_mac_address [ 1577.997220][T21069] netlink: 88 bytes leftover after parsing attributes in process `syz.2.12672'. [ 1578.027111][T21070] : renamed from bond0 (while UP) [ 1578.036083][T21074] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 1578.075250][T21079] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12671'. [ 1578.085444][T21075] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1578.088934][T21075] ip6t_REJECT: ECHOREPLY is not supported [ 1578.401377][T21090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12677'. [ 1578.445727][T21093] netlink: 165 bytes leftover after parsing attributes in process `syz.3.12679'. [ 1578.456958][T21090] netlink: 40 bytes leftover after parsing attributes in process `syz.0.12677'. [ 1578.515676][T21090] netlink: 'syz.0.12677': attribute type 3 has an invalid length. [ 1578.591599][T21090] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1578.632585][T21101] netlink: 'syz.2.12680': attribute type 24 has an invalid length. [ 1578.927150][T21116] netlink: 48 bytes leftover after parsing attributes in process `syz.2.12684'. [ 1578.968543][T21120] FAULT_INJECTION: forcing a failure. [ 1578.968543][T21120] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1579.026021][T21120] CPU: 1 UID: 0 PID: 21120 Comm: syz.3.12686 Not tainted syzkaller #0 PREEMPT(full) [ 1579.026052][T21120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1579.026067][T21120] Call Trace: [ 1579.026077][T21120] [ 1579.026087][T21120] dump_stack_lvl+0xe8/0x150 [ 1579.026125][T21120] should_fail_ex+0x40c/0x560 [ 1579.026156][T21120] _copy_from_user+0x2d/0xb0 [ 1579.026194][T21120] ___sys_sendmsg+0x1c6/0x360 [ 1579.026227][T21120] ? __lock_acquire+0x683/0x2cf0 [ 1579.026262][T21120] ? __pfx____sys_sendmsg+0x10/0x10 [ 1579.026337][T21120] ? __fget_files+0x2a/0x420 [ 1579.026365][T21120] ? __fget_files+0x3a2/0x420 [ 1579.026405][T21120] __x64_sys_sendmsg+0x1b1/0x290 [ 1579.026443][T21120] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1579.026498][T21120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.026531][T21120] do_syscall_64+0x174/0x580 [ 1579.026562][T21120] ? trace_irq_disable+0x3b/0x140 [ 1579.026591][T21120] ? clear_bhb_loop+0x40/0x90 [ 1579.026619][T21120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.026641][T21120] RIP: 0033:0x7f19c699de59 [ 1579.026662][T21120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1579.026682][T21120] RSP: 002b:00007f19c784a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1579.026705][T21120] RAX: ffffffffffffffda RBX: 00007f19c6c25fa0 RCX: 00007f19c699de59 [ 1579.026722][T21120] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 1579.026736][T21120] RBP: 00007f19c784a090 R08: 0000000000000000 R09: 0000000000000000 [ 1579.026750][T21120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1579.026764][T21120] R13: 00007f19c6c26038 R14: 00007f19c6c25fa0 R15: 00007ffcb6728178 [ 1579.026805][T21120] [ 1579.441467][T21131] IPVS: Error connecting to the multicast addr [ 1579.456818][T21133] netlink: 'syz.2.12689': attribute type 21 has an invalid length. [ 1579.475178][T21133] netlink: 128 bytes leftover after parsing attributes in process `syz.2.12689'. [ 1579.506674][T21133] netlink: 'syz.2.12689': attribute type 4 has an invalid length. [ 1579.515979][T21133] netlink: 'syz.2.12689': attribute type 5 has an invalid length. [ 1579.532155][T21138] netlink: 'syz.2.12689': attribute type 21 has an invalid length. [ 1579.552420][T21138] netlink: 128 bytes leftover after parsing attributes in process `syz.2.12689'. [ 1579.573852][T21138] netlink: 'syz.2.12689': attribute type 4 has an invalid length. [ 1579.600234][T21138] netlink: 'syz.2.12689': attribute type 5 has an invalid length. [ 1579.796015][T21136] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1580.067884][T21166] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1580.984778][T21205] FAULT_INJECTION: forcing a failure. [ 1580.984778][T21205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1581.042983][T21205] CPU: 1 UID: 0 PID: 21205 Comm: syz.4.12706 Not tainted syzkaller #0 PREEMPT(full) [ 1581.043015][T21205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1581.043031][T21205] Call Trace: [ 1581.043041][T21205] [ 1581.043050][T21205] dump_stack_lvl+0xe8/0x150 [ 1581.043090][T21205] should_fail_ex+0x40c/0x560 [ 1581.043122][T21205] _copy_to_user+0x31/0xb0 [ 1581.043158][T21205] simple_read_from_buffer+0xe1/0x170 [ 1581.043194][T21205] proc_fail_nth_read+0x1bb/0x230 [ 1581.043227][T21205] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1581.043268][T21205] ? rw_verify_area+0x24a/0x4c0 [ 1581.043304][T21205] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1581.043333][T21205] vfs_read+0x213/0xa80 [ 1581.043370][T21205] ? __pfx___mutex_lock+0x10/0x10 [ 1581.043404][T21205] ? __pfx_vfs_read+0x10/0x10 [ 1581.043439][T21205] ? __fget_files+0x2a/0x420 [ 1581.043472][T21205] ? __fget_files+0x3a2/0x420 [ 1581.043499][T21205] ? __fget_files+0x2a/0x420 [ 1581.043537][T21205] ksys_read+0x150/0x270 [ 1581.043573][T21205] ? __pfx_ksys_read+0x10/0x10 [ 1581.043615][T21205] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.043640][T21205] do_syscall_64+0x174/0x580 [ 1581.043670][T21205] ? trace_irq_disable+0x3b/0x140 [ 1581.043698][T21205] ? clear_bhb_loop+0x40/0x90 [ 1581.043726][T21205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.043748][T21205] RIP: 0033:0x7fde3df5e68e [ 1581.043769][T21205] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1581.043788][T21205] RSP: 002b:00007fde3c1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1581.043811][T21205] RAX: ffffffffffffffda RBX: 00007fde3c1f66c0 RCX: 00007fde3df5e68e [ 1581.043828][T21205] RDX: 000000000000000f RSI: 00007fde3c1f60a0 RDI: 0000000000000005 [ 1581.043842][T21205] RBP: 00007fde3c1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1581.043856][T21205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1581.043869][T21205] R13: 00007fde3e226038 R14: 00007fde3e225fa0 R15: 00007fffe3da7728 [ 1581.043906][T21205] [ 1581.403877][T21212] netlink: 'syz.1.12707': attribute type 1 has an invalid length. [ 1581.491184][T21212] netlink: 'syz.1.12707': attribute type 3 has an invalid length. [ 1581.613710][T21212] __nla_validate_parse: 4 callbacks suppressed [ 1581.613732][T21212] netlink: 224 bytes leftover after parsing attributes in process `syz.1.12707'. [ 1581.783031][T21221] FAULT_INJECTION: forcing a failure. [ 1581.783031][T21221] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1581.865961][T21221] CPU: 0 UID: 0 PID: 21221 Comm: syz.4.12711 Not tainted syzkaller #0 PREEMPT(full) [ 1581.865991][T21221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1581.866005][T21221] Call Trace: [ 1581.866015][T21221] [ 1581.866025][T21221] dump_stack_lvl+0xe8/0x150 [ 1581.866063][T21221] should_fail_ex+0x40c/0x560 [ 1581.866096][T21221] _copy_from_user+0x2d/0xb0 [ 1581.866130][T21221] kstrtouint_from_user+0xd6/0x180 [ 1581.866161][T21221] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1581.866208][T21221] proc_fail_nth_write+0x8e/0x210 [ 1581.866240][T21221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1581.866280][T21221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1581.866310][T21221] vfs_write+0x296/0xba0 [ 1581.866353][T21221] ? __pfx_vfs_write+0x10/0x10 [ 1581.866389][T21221] ? __fget_files+0x2a/0x420 [ 1581.866423][T21221] ? __fget_files+0x3a2/0x420 [ 1581.866451][T21221] ? __fget_files+0x2a/0x420 [ 1581.866488][T21221] ksys_write+0x150/0x270 [ 1581.866523][T21221] ? __pfx_ksys_write+0x10/0x10 [ 1581.866564][T21221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.866589][T21221] do_syscall_64+0x174/0x580 [ 1581.866619][T21221] ? trace_irq_disable+0x3b/0x140 [ 1581.866646][T21221] ? clear_bhb_loop+0x40/0x90 [ 1581.866673][T21221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.866696][T21221] RIP: 0033:0x7fde3df5e68e [ 1581.866728][T21221] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1581.866746][T21221] RSP: 002b:00007fde3c1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1581.866769][T21221] RAX: ffffffffffffffda RBX: 00007fde3c1f66c0 RCX: 00007fde3df5e68e [ 1581.866786][T21221] RDX: 0000000000000001 RSI: 00007fde3c1f60a0 RDI: 0000000000000004 [ 1581.866800][T21221] RBP: 00007fde3c1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1581.866814][T21221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1581.866828][T21221] R13: 00007fde3e226038 R14: 00007fde3e225fa0 R15: 00007fffe3da7728 [ 1581.866865][T21221] [ 1582.275076][T21241] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12718'. [ 1582.939194][T21273] netlink: 224 bytes leftover after parsing attributes in process `syz.3.12725'. [ 1582.992278][T21273] IPv6: sit4: Disabled Multicast RS [ 1583.046443][T21280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12728'. [ 1583.404930][T21297] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12731'. [ 1583.773991][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 90 seconds [ 1583.785194][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 90 seconds [ 1583.796908][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 90 seconds [ 1583.808607][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 90 seconds [ 1583.883384][ T978] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1583.924699][ T978] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1583.992864][ T978] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1584.019251][ T978] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1584.158127][T21317] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1584.205446][T21314] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1584.227235][T21319] netlink: 72 bytes leftover after parsing attributes in process `syz.2.12736'. [ 1584.260772][T21314] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12733'. [ 1584.291403][T21317] netlink: 48 bytes leftover after parsing attributes in process `syz.4.12735'. [ 1584.674819][T21344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12740'. [ 1585.038170][T21353] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12744'. [ 1585.664189][T21379] netlink: 'syz.2.12752': attribute type 21 has an invalid length. [ 1586.667301][T21427] __nla_validate_parse: 5 callbacks suppressed [ 1586.667321][T21427] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12764'. [ 1586.914110][T21435] netlink: 220 bytes leftover after parsing attributes in process `syz.2.12767'. [ 1587.124126][T21450] openvswitch: netlink: IPv6 tunnel dst address is zero [ 1587.164083][T21449] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12771'. [ 1587.416851][T21462] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12775'. [ 1587.467552][T21465] netlink: 44 bytes leftover after parsing attributes in process `syz.3.12777'. [ 1587.964574][T21492] netlink: 'syz.1.12783': attribute type 3 has an invalid length. [ 1588.468169][T21523] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12792'. [ 1588.663007][T21526] netlink: 128 bytes leftover after parsing attributes in process `syz.2.12792'. [ 1588.680718][T21526] netlink: 128 bytes leftover after parsing attributes in process `syz.2.12792'. [ 1588.920748][T21538] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1588.962935][T21538] netlink: 104 bytes leftover after parsing attributes in process `syz.0.12794'. [ 1589.091873][T21544] xt_l2tp: invalid flags combination: 0 [ 1589.135750][T21545] xt_l2tp: invalid flags combination: 0 [ 1589.357571][T21561] netlink: 'syz.4.12800': attribute type 1 has an invalid length. [ 1589.674188][T21569] macvtap4: entered allmulticast mode [ 1589.804340][T21581] netlink: 208 bytes leftover after parsing attributes in process `syz.0.12806'. [ 1589.847350][T21581] openvswitch: netlink: Flow key attr not present in new flow. [ 1589.949357][T21599] netlink: 'syz.1.12807': attribute type 29 has an invalid length. [ 1590.124125][T21605] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1590.177148][T21606] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1590.948138][T21652] netlink: 'syz.0.12821': attribute type 2 has an invalid length. [ 1591.918452][T21715] __nla_validate_parse: 4 callbacks suppressed [ 1591.918474][T21715] netlink: 96 bytes leftover after parsing attributes in process `syz.3.12839'. [ 1591.997823][T21715] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12839'. [ 1592.095424][T21723] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12843'. [ 1592.198806][T21725] netlink: 84 bytes leftover after parsing attributes in process `syz.1.12842'. [ 1593.157879][T21777] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12855'. [ 1593.226293][T21777] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12855'. [ 1593.396267][T21784] IPv6: sit5: Disabled Multicast RS [ 1593.656625][T21797] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12859'. [ 1593.723470][T21797] set match dimension is over the limit! [ 1593.732051][T21796] syzkaller0: entered promiscuous mode [ 1593.756245][T21796] syzkaller0: entered allmulticast mode [ 1593.792817][T21797] netlink: 'syz.4.12859': attribute type 19 has an invalid length. [ 1594.404319][T21814] 8021q: adding VLAN 0 to HW filter on device bond85 [ 1594.445862][T21836] gre2: entered promiscuous mode [ 1594.857974][T21853] netlink: 'syz.3.12872': attribute type 39 has an invalid length. [ 1594.927338][T21853] hsr_slave_0: left promiscuous mode [ 1594.990358][T21853] hsr_slave_1: left promiscuous mode [ 1595.381737][T21871] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12878'. [ 1595.807756][T21843] infiniband syz0: set down [ 1595.828526][T21843] infiniband syz0: added bond_slave_0 [ 1595.858335][T21843] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1595.864645][T21843] infiniband syz0: Couldn't open port 1 [ 1595.955950][T21843] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1595.987482][T21843] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1596.028515][T21843] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1596.305192][T21843] RDS/IB: syz0: added [ 1596.334369][T21843] smc: adding ib device syz0 with port count 1 [ 1596.360365][T21843] smc: ib device syz0 port 1 has no pnetid [ 1597.067804][T21917] netlink: 'syz.3.12884': attribute type 32 has an invalid length. [ 1597.188044][T21923] netlink: 'syz.4.12885': attribute type 39 has an invalid length. [ 1597.197673][T21907] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1597.871980][T21942] netlink: 92 bytes leftover after parsing attributes in process `syz.4.12888'. [ 1598.663663][T21966] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12893'. [ 1599.761023][T21990] netlink: 'syz.3.12898': attribute type 1 has an invalid length. [ 1599.971561][T21998] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 1600.002715][T21998] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 1600.092230][T22003] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12901'. [ 1600.178386][T22003] IPVS: Error connecting to the multicast addr [ 1600.317224][T22008] netlink: 14 bytes leftover after parsing attributes in process `syz.0.12902'. [ 1600.392159][T22001] syzkaller1: entered promiscuous mode [ 1600.403794][T22001] syzkaller1: entered allmulticast mode [ 1600.704425][T22015] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12903'. [ 1600.976223][T22027] netlink: 'syz.0.12906': attribute type 3 has an invalid length. [ 1601.293408][T22036] netlink: 'syz.0.12909': attribute type 14 has an invalid length. [ 1601.311807][T22038] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1601.375953][T22036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12909'. [ 1601.725387][T22056] netlink: 244 bytes leftover after parsing attributes in process `syz.3.12914'. [ 1602.227763][T22075] veth1_virt_wifi: Caught tx_queue_len zero misconfig [ 1603.074972][T22104] netlink: 'syz.3.12925': attribute type 32 has an invalid length. [ 1603.130723][T22104] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12925'. [ 1603.223272][T22116] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12929'. [ 1603.294651][T22104] bond92: Setting coupled_control to off (0) [ 1603.360285][T22114] netlink: 56 bytes leftover after parsing attributes in process `syz.0.12928'. [ 1603.505171][T22131] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12929'. [ 1603.585355][T22137] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12930'. [ 1603.708662][T22138] 8021q: adding VLAN 0 to HW filter on device bond78 [ 1603.741679][T22116] netlink: 64 bytes leftover after parsing attributes in process `syz.4.12929'. [ 1603.817390][T22116] netlink: 64 bytes leftover after parsing attributes in process `syz.4.12929'. [ 1603.873166][T22140] tipc: Enabling of bearer rejected, failed to enable media [ 1604.249242][ C1] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1604.352875][T22174] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12940'. [ 1604.413656][T22181] netlink: 'syz.1.12943': attribute type 32 has an invalid length. [ 1604.463775][T22181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12943'. [ 1604.652165][T22181] bond86: Setting coupled_control to off (0) [ 1604.755747][T22194] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 1604.767246][T22192] SET target dimension over the limit! [ 1604.884461][ T5632] block nbd1: Receive control failed (result -32) [ 1604.919391][T22205] netlink: 'syz.1.12949': attribute type 30 has an invalid length. [ 1604.968279][T22205] bond87: option arp_missed_max: invalid value (0) [ 1604.976189][T22205] bond87: option arp_missed_max: allowed values 1 - 255 [ 1604.977635][T22208] netlink: 'syz.1.12949': attribute type 12 has an invalid length. [ 1605.036244][T22205] bond87 (unregistering): Released all slaves [ 1605.162221][T22208] bond87: option primary_reselect: invalid value (255) [ 1605.176110][T22208] bond87 (unregistering): Released all slaves [ 1606.623983][T22290] openvswitch: netlink: Message has 12 unknown bytes. [ 1606.644472][T22290] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1606.691909][T22290] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12966'. [ 1606.877389][T22297] sctp: [Deprecated]: syz.4.12968 (pid 22297) Use of int in max_burst socket option deprecated. [ 1606.877389][T22297] Use struct sctp_assoc_value instead [ 1607.763141][T22335] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1607.791987][T22338] openvswitch: netlink: Flow actions attr not present in new flow. [ 1608.212746][T22360] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1608.282080][T22360] bond0: entered promiscuous mode [ 1608.311912][T22360] veth0_to_bond: entered promiscuous mode [ 1608.341958][T22360] bond0: left promiscuous mode [ 1608.357504][T22360] veth0_to_bond: left promiscuous mode [ 1608.533310][T22379] __nla_validate_parse: 1 callbacks suppressed [ 1608.533332][T22379] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12989'. [ 1608.678091][T22373] 8021q: adding VLAN 0 to HW filter on device bond88 [ 1608.767108][T22390] netlink: 'syz.1.12991': attribute type 1 has an invalid length. [ 1608.798445][T22390] netlink: 224 bytes leftover after parsing attributes in process `syz.1.12991'. [ 1609.207882][T22416] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12997'. [ 1609.442889][T22429] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13000'. [ 1609.619756][T22439] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13003'. [ 1609.860940][T22445] 8021q: adding VLAN 0 to HW filter on device bond93 [ 1609.924735][T22454] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 1609.950765][T22450] netlink: 68 bytes leftover after parsing attributes in process `syz.0.13007'. [ 1610.115236][T22452] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13007'. [ 1610.565821][T22482] syzkaller1: entered promiscuous mode [ 1610.583220][T22482] syzkaller1: entered allmulticast mode [ 1611.696045][T22523] 8021q: adding VLAN 0 to HW filter on device bond94 [ 1612.908844][T22595] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1612.985134][T22599] netlink: 28 bytes leftover after parsing attributes in process `syz.1.13036'. [ 1613.045314][T22600] netlink: 'syz.0.13038': attribute type 2 has an invalid length. [ 1613.265203][T22609] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13041'. [ 1613.319773][T22610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13042'. [ 1613.368330][T22610] netlink: 'syz.0.13042': attribute type 29 has an invalid length. [ 1613.408566][T22615] netlink: 'syz.0.13042': attribute type 29 has an invalid length. [ 1613.850904][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 120 seconds [ 1613.862004][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 120 seconds [ 1613.873178][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 120 seconds [ 1613.884316][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 120 seconds [ 1614.136541][T22653] sctp: [Deprecated]: syz.4.13050 (pid 22653) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1614.136541][T22653] Use struct sctp_sack_info instead [ 1614.470434][T22674] __nla_validate_parse: 3 callbacks suppressed [ 1614.470453][T22674] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13053'. [ 1614.951244][T22692] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13062'. [ 1614.976280][T22690] team0: No ports can be present during mode change [ 1615.323860][T22711] bond95: option all_slaves_active: invalid value (222) [ 1615.344859][T22711] bond95 (unregistering): Released all slaves [ 1615.558485][T22704] macvlan0: entered promiscuous mode [ 1615.579454][T22704] macvlan0: entered allmulticast mode [ 1615.594910][T22704] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1615.623381][T22704] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1615.678245][T22704] team0: Port device macvlan0 added [ 1615.828732][T22737] netlink: 72 bytes leftover after parsing attributes in process `syz.1.13072'. [ 1616.089525][T22748] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 1618.192018][T22847] netlink: 'syz.4.13097': attribute type 21 has an invalid length. [ 1618.219407][T22847] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13097'. [ 1618.745424][T22872] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1619.342848][T22892] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13109'. [ 1619.389780][T22897] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13110'. [ 1619.436103][T22899] netlink: 'syz.1.13112': attribute type 8 has an invalid length. [ 1619.661913][T22907] netlink: 1520 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1619.742368][T22911] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13117'. [ 1619.794118][T22918] netlink: 'syz.0.13115': attribute type 2 has an invalid length. [ 1619.829331][T22907] bond80: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1619.840658][T22918] netlink: 156 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1619.862093][T22907] bond80 (unregistering): Released all slaves [ 1619.897695][T22918] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1619.908370][T22918] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1620.308769][T22931] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13121'. [ 1620.334169][ T50] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1620.351654][ T50] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1620.364201][ T50] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1620.378889][ T50] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1620.387877][ T50] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1620.837079][T22943] 8021q: adding VLAN 0 to HW filter on device bond95 [ 1620.847654][T22954] netlink: 13 bytes leftover after parsing attributes in process `syz.4.13127'. [ 1620.866488][T22950] netlink: 84 bytes leftover after parsing attributes in process `syz.4.13127'. [ 1621.137572][T22967] netlink: 'syz.0.13129': attribute type 1 has an invalid length. [ 1621.146000][T22967] netlink: 224 bytes leftover after parsing attributes in process `syz.0.13129'. [ 1621.458459][ T5639] bond76: (slave syz_tun): Releasing backup interface [ 1621.682574][T22987] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13134'. [ 1621.786154][T22986] tipc: Enabling of bearer rejected, media not registered [ 1622.374671][T23010] 8021q: adding VLAN 0 to HW filter on device bond96 [ 1622.490725][ T5632] Bluetooth: hci5: command tx timeout [ 1622.823308][T22924] lo speed is unknown, defaulting to 1000 [ 1622.863264][T22924] wlan1 speed is unknown, defaulting to 1000 [ 1624.036180][T23068] siw: device registration error -23 [ 1624.173419][T23078] netlink: 'syz.1.13155': attribute type 32 has an invalid length. [ 1624.216488][T23074] 8021q: adding VLAN 0 to HW filter on device bond80 [ 1624.381738][T23078] bond88: Setting coupled_control to off (0) [ 1624.569162][ T5632] Bluetooth: hci5: command tx timeout [ 1625.262663][T23127] sit5: entered promiscuous mode [ 1625.514088][T23142] __nla_validate_parse: 3 callbacks suppressed [ 1625.514110][T23142] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13169'. [ 1625.724980][T22924] bridge0: port 1(bridge_slave_0) entered blocking state [ 1625.750417][T22924] bridge0: port 1(bridge_slave_0) entered disabled state [ 1625.796329][T22924] bridge_slave_0: entered allmulticast mode [ 1625.823877][T22924] bridge_slave_0: entered promiscuous mode [ 1625.851144][T22924] bridge0: port 2(bridge_slave_1) entered blocking state [ 1625.872002][T22924] bridge0: port 2(bridge_slave_1) entered disabled state [ 1625.888180][T22924] bridge_slave_1: entered allmulticast mode [ 1625.921165][T22924] bridge_slave_1: entered promiscuous mode [ 1626.114478][T22924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1626.161448][T22924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1626.357203][T22924] team0: Port device team_slave_0 added [ 1626.405975][T22924] team0: Port device team_slave_1 added [ 1626.426778][T23179] bridge_slave_1: default FDB implementation only supports local addresses [ 1626.483573][T23182] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1626.533361][T23184] netlink: 40 bytes leftover after parsing attributes in process `syz.4.13178'. [ 1626.544398][T22924] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1626.570542][T22924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1626.654541][ T5632] Bluetooth: hci5: command tx timeout [ 1626.664648][T22924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1626.682781][T23188] IPVS: ip_vs_edit_dest(): server weight less than zero [ 1626.699663][T22924] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1626.716924][T22924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1626.793755][T22924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1627.131371][T23202] vlan6: entered promiscuous mode [ 1627.200698][T22924] hsr_slave_0: entered promiscuous mode [ 1627.221227][T23211] openvswitch: netlink: Unknown key attributes 20 [ 1627.229645][T22924] hsr_slave_1: entered promiscuous mode [ 1627.244628][T22924] debugfs: 'hsr0' already exists in 'hsr' [ 1627.258622][T22924] Cannot create hsr debugfs directory [ 1627.455108][T23219] sctp: [Deprecated]: syz.3.13185 (pid 23219) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1627.455108][T23219] Use struct sctp_sack_info instead [ 1627.488763][T23221] openvswitch: netlink: Duplicate key (type 6). [ 1627.524210][T23219] Unsupported ieee802154 address type: 0 [ 1627.535832][T23224] netlink: 'syz.0.13187': attribute type 32 has an invalid length. [ 1627.557924][T23224] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13187'. [ 1627.755330][T23224] bond81: Setting coupled_control to off (0) [ 1628.698418][T22924] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1628.729147][ T5632] Bluetooth: hci5: command tx timeout [ 1628.734238][T22924] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1628.766947][T23276] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13199'. [ 1628.927613][T23274] netlink: 'syz.1.13198': attribute type 3 has an invalid length. [ 1629.011416][T23287] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13202'. [ 1629.204815][T22924] netdevsim netdevsim2 netdevsim2 (unregistering): left allmulticast mode [ 1629.222270][T22924] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1629.233101][T22924] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1629.280952][T23287] workqueue: Failed to create a rescuer kthread for wq "bond82": -EINTR [ 1629.416626][T23295] 8021q: adding VLAN 0 to HW filter on device bond97 [ 1629.564046][T22924] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1629.604224][T22924] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1629.847432][T22924] netdevsim netdevsim2 netdevsim0 (unregistering): left promiscuous mode [ 1629.902196][T23324] netlink: 104 bytes leftover after parsing attributes in process `syz.0.13210'. [ 1629.954971][T23325] nbd: couldn't find a device at index 0 [ 1630.072124][T22924] team0: Port device macvlan0 removed [ 1630.188613][T22924] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1630.215730][T22924] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1630.272277][T23336] veth1_vlan: entered promiscuous mode [ 1630.312069][T23336] macvtap0: entered promiscuous mode [ 1630.349296][T23336] macvtap0: entered allmulticast mode [ 1630.359593][T23336] veth1_vlan: entered allmulticast mode [ 1630.469218][T23346] netlink: 'syz.1.13216': attribute type 1 has an invalid length. [ 1630.515162][T23349] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13217'. [ 1630.524722][T23346] netlink: 224 bytes leftover after parsing attributes in process `syz.1.13216'. [ 1630.970014][T23366] netlink: 132 bytes leftover after parsing attributes in process `syz.4.13221'. [ 1631.231008][T23385] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13223'. [ 1631.543450][T22924] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1631.598138][T22924] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1631.622850][T23396] netlink: 'syz.3.13227': attribute type 9 has an invalid length. [ 1631.631256][T23393] tipc: New replicast peer: 255.255.255.255 [ 1631.653151][T23393] tipc: Enabled bearer , priority 10 [ 1631.673129][T22924] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1631.771572][T22924] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1631.824523][T22924] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1631.856879][T22924] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1631.904268][T22924] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1631.965364][T22924] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1632.353226][T22924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1632.481633][T22924] 8021q: adding VLAN 0 to HW filter on device team0 [ 1632.558430][T14844] bridge0: port 1(bridge_slave_0) entered blocking state [ 1632.565692][T14844] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1632.606822][T11102] bridge0: port 2(bridge_slave_1) entered blocking state [ 1632.614093][T11102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1634.563351][T22924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1634.926706][T22924] veth0_vlan: entered promiscuous mode [ 1635.033572][T22924] veth1_vlan: entered promiscuous mode [ 1635.182255][T22924] veth0_macvtap: entered promiscuous mode [ 1635.245195][T22924] veth1_macvtap: entered promiscuous mode [ 1635.283668][T23546] syzkaller0: entered promiscuous mode [ 1635.324577][T23546] syzkaller0: entered allmulticast mode [ 1635.425452][T22924] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1635.739543][T23565] xt_policy: output policy not valid in PREROUTING and INPUT [ 1636.068511][T23574] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13285'. [ 1636.226484][T22924] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1636.307471][T14844] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1636.331225][T14844] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1636.363565][T14844] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1636.413750][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1636.511072][T23584] tipc: Enabling of bearer rejected, already enabled [ 1636.531163][T23589] syzkaller0: entered promiscuous mode [ 1636.552871][T23589] syzkaller0: entered allmulticast mode [ 1636.993879][T14851] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1637.043401][T14851] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1637.233358][T11106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1637.261439][T11106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1637.647157][T23643] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13300'. [ 1637.785711][ T12] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 1637.845662][T23650] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13114'. [ 1638.214557][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1638.227440][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1638.236072][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1638.248617][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1638.268246][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1638.646492][T23678] netlink: 260 bytes leftover after parsing attributes in process `syz.0.13308'. [ 1638.849670][T23682] netlink: 48 bytes leftover after parsing attributes in process `syz.1.13310'. [ 1638.893858][T23687] netlink: 48 bytes leftover after parsing attributes in process `syz.1.13310'. [ 1638.954714][T23681] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13310'. [ 1638.994155][T23681] syzkaller0: entered promiscuous mode [ 1639.028779][T23681] syzkaller0: entered allmulticast mode [ 1639.175507][T23700] openvswitch: netlink: IP tunnel dst address not specified [ 1639.214257][T23701] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13313'. [ 1639.468190][T23711] netlink: 'syz.1.13316': attribute type 2 has an invalid length. [ 1639.573330][T23709] bond82: entered promiscuous mode [ 1639.638791][ T30] audit: type=1804 audit(1783934993.173:78): pid=23723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.13317" name="/newroot/4/cgroup.controllers" dev="tmpfs" ino=38 res=1 errno=0 [ 1639.691797][ T30] audit: type=1800 audit(1783934993.173:79): pid=23723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.13317" name="cgroup.controllers" dev="tmpfs" ino=38 res=0 errno=0 [ 1639.737671][T23711] : entered promiscuous mode [ 1639.787128][T23719] macvlan5: entered promiscuous mode [ 1639.799225][T23719] macvlan5: entered allmulticast mode [ 1639.839773][T23719] bond82: (slave macvlan5): Opening slave failed [ 1640.046842][T23734] netlink: 48 bytes leftover after parsing attributes in process `syz.1.13320'. [ 1640.329501][ T50] Bluetooth: hci4: command tx timeout [ 1640.733176][T23765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13326'. [ 1640.772348][T23661] lo speed is unknown, defaulting to 1000 [ 1640.805020][T23661] wlan1 speed is unknown, defaulting to 1000 [ 1641.256171][T23777] __nla_validate_parse: 1 callbacks suppressed [ 1641.256194][T23777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13330'. [ 1641.367154][T23781] netlink: 104 bytes leftover after parsing attributes in process `syz.4.13331'. [ 1641.616489][T23738] siw: device registration error -23 [ 1641.901741][T23799] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1642.288512][T23813] netlink: 44 bytes leftover after parsing attributes in process `syz.4.13342'. [ 1642.321907][T23814] netlink: 'syz.1.13341': attribute type 9 has an invalid length. [ 1642.403758][T23818] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13343'. [ 1642.413947][ T50] Bluetooth: hci4: command tx timeout [ 1642.500805][T23822] nbd: nbd2 already in use [ 1642.919735][T23661] bridge0: port 1(bridge_slave_0) entered blocking state [ 1642.929915][T23841] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13348'. [ 1642.973612][T23661] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.996837][T23661] bridge_slave_0: entered allmulticast mode [ 1643.007664][T23661] bridge_slave_0: entered promiscuous mode [ 1643.017168][T23661] bridge0: port 2(bridge_slave_1) entered blocking state [ 1643.039767][T23661] bridge0: port 2(bridge_slave_1) entered disabled state [ 1643.070222][T23661] bridge_slave_1: entered allmulticast mode [ 1643.101633][T23661] bridge_slave_1: entered promiscuous mode [ 1643.318700][T23661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1643.374893][T23661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1643.417264][T23864] netlink: 48 bytes leftover after parsing attributes in process `syz.4.13351'. [ 1643.463380][T23873] team0: Device ipvlan2 is already an upper device of the team interface [ 1643.606544][T23878] netlink: 36 bytes leftover after parsing attributes in process `syz.1.13355'. [ 1643.624100][T23878] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13355'. [ 1643.676335][T23881] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13356'. [ 1643.728101][T23661] team0: Port device team_slave_0 added [ 1643.943849][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 150 seconds [ 1643.954940][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 150 seconds [ 1643.968640][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 150 seconds [ 1643.980220][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 150 seconds [ 1644.036008][T23661] team0: Port device team_slave_1 added [ 1644.155549][T23896] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1644.241486][T23661] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1644.253960][T23661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1644.315219][T23661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1644.393355][T23661] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1644.403735][T23661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1644.430480][T23661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1644.483712][T23911] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13361'. [ 1644.499246][ T50] Bluetooth: hci4: command tx timeout [ 1644.643626][T23911] tipc: Enabling of bearer rejected, failed to enable media [ 1644.652742][T23912] tipc: Enabling of bearer rejected, failed to enable media [ 1644.724715][T23661] hsr_slave_0: entered promiscuous mode [ 1644.762239][T23661] hsr_slave_1: entered promiscuous mode [ 1644.780948][T23661] debugfs: 'hsr0' already exists in 'hsr' [ 1644.790458][T23661] Cannot create hsr debugfs directory [ 1645.505638][T23955] netlink: 'syz.0.13371': attribute type 3 has an invalid length. [ 1645.517307][T23948] IPVS: stopping backup sync thread 13492 ... [ 1645.837240][T23966] netlink: 'syz.4.13374': attribute type 1 has an invalid length. [ 1646.006665][T23661] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1646.035257][T23661] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.118374][T23969] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1646.305358][T23661] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1646.327791][T23661] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.486532][T23998] __nla_validate_parse: 11 callbacks suppressed [ 1646.486553][T23998] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13380'. [ 1646.571256][ T50] Bluetooth: hci4: command tx timeout [ 1646.648429][T23991] 8021q: adding VLAN 0 to HW filter on device bond86 [ 1646.836769][T23661] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1646.895200][T23661] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1647.019657][T24020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13385'. [ 1647.095716][T24021] netlink: 576 bytes leftover after parsing attributes in process `syz.1.13386'. [ 1647.105778][T24020] netlink: 'syz.0.13385': attribute type 16 has an invalid length. [ 1647.165706][T23661] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1647.177667][T23661] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1647.383846][T24031] netlink: 'syz.2.13388': attribute type 1 has an invalid length. [ 1647.866216][T24048] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13394'. [ 1648.105810][T24066] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13395'. [ 1648.303857][T24059] bridge0: port 4(syz_tun) entered blocking state [ 1648.310653][T24059] bridge0: port 4(syz_tun) entered forwarding state [ 1648.372111][T24059] 8021q: adding VLAN 0 to HW filter on device team0 [ 1648.398393][T24059] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1648.497921][T24059] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1648.546768][T24059] veth1_vlan: left promiscuous mode [ 1648.555204][T24059] veth0_vlan: left promiscuous mode [ 1648.564324][T24059] veth0_vlan: entered promiscuous mode [ 1648.595735][T24059] tipc: Resetting bearer [ 1648.616815][T24059] veth1_vlan: entered promiscuous mode [ 1648.625084][T24059] macvlan0: left promiscuous mode [ 1648.700074][T24059] A link change request failed with some changes committed already. Interface geneve3 may have been left with an inconsistent configuration, please check. [ 1648.753230][T23661] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1648.786480][T23661] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1648.820959][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1648.828239][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1648.906147][T23596] bridge0: port 3(vlan3) entered blocking state [ 1648.915543][T23596] bridge0: port 3(vlan3) entered forwarding state [ 1649.039602][T24095] netlink: 52 bytes leftover after parsing attributes in process `syz.4.13403'. [ 1649.063654][T15689] syz2: Port: 1 Link ACTIVE [ 1649.068292][ T3275] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1649.109697][ T3275] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 1649.132967][ T3275] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 19999 - 0 [ 1649.151500][ T808] wlan1 speed is unknown, defaulting to 1000 [ 1649.161599][T23661] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1649.237413][T23661] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1649.292302][ T3275] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1649.318530][ T3275] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 1649.359910][ T3275] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 19999 - 0 [ 1649.389729][T23661] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1649.428053][T23661] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1649.484597][T23661] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1649.518280][T23661] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1649.555124][ T3275] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1649.577232][ T3275] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 1649.617033][ T3275] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 19999 - 0 [ 1649.684539][ T3275] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1649.722190][ T3275] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 1649.761332][ T3275] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 19999 - 0 [ 1649.810707][ T3275] tipc: Subscription rejected, illegal request [ 1649.954885][T24138] netlink: 'syz.4.13409': attribute type 1 has an invalid length. [ 1650.145002][T24142] bond92: (slave veth27): Enslaving as an active interface with a down link [ 1650.212962][T24142] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13409'. [ 1650.231590][T24138] 8021q: adding VLAN 0 to HW filter on device bond92 [ 1650.242925][T24144] gre0: entered promiscuous mode [ 1650.258004][T24144] gre0: entered allmulticast mode [ 1650.266949][T24138] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 1650.267925][T24152] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13413'. [ 1650.531489][T24161] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13416'. [ 1650.574252][T23661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1650.642757][T23661] 8021q: adding VLAN 0 to HW filter on device team0 [ 1650.683763][ T3275] bridge0: port 1(bridge_slave_0) entered blocking state [ 1650.691029][ T3275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1650.778844][ T3275] bridge0: port 2(bridge_slave_1) entered blocking state [ 1650.786210][ T3275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1650.812470][T24169] netlink: 'syz.0.13418': attribute type 21 has an invalid length. [ 1650.835662][T24169] netlink: 'syz.0.13418': attribute type 6 has an invalid length. [ 1650.845695][T24169] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13418'. [ 1651.667483][T24191] __nla_validate_parse: 1 callbacks suppressed [ 1651.667504][T24191] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13421'. [ 1651.714655][T24192] tipc: Enabled bearer , priority 0 [ 1652.346348][T24218] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13428'. [ 1652.404725][T24218] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13428'. [ 1652.441033][T24222] workqueue: Failed to create a rescuer kthread for wq "bond90": -EINTR [ 1652.458509][T24224] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13428'. [ 1652.558060][T23661] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1652.688796][T24232] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13431'. [ 1652.701346][T24237] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13432'. [ 1652.726133][T24232] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13431'. [ 1652.844098][T24244] bond0: Device is already in use. [ 1652.916447][T23661] veth0_vlan: entered promiscuous mode [ 1652.998874][T23661] veth1_vlan: entered promiscuous mode [ 1653.016702][T24246] set match dimension is over the limit! [ 1653.105893][T24246] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13435'. [ 1653.164252][T23661] veth0_macvtap: entered promiscuous mode [ 1653.259381][T23661] veth1_macvtap: entered promiscuous mode [ 1653.378128][T23661] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1653.447624][T23661] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1653.521008][T20828] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.531201][T24277] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13441'. [ 1653.546081][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1653.599180][T20828] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.680609][T24277] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13441'. [ 1653.709996][T20828] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.720416][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1653.752900][T20828] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1653.856450][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1653.946347][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1654.038480][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1654.127326][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1654.201295][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1654.263237][T24278] netlink: 'syz.2.13441': attribute type 16 has an invalid length. [ 1654.412286][T24291] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 1654.591334][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1654.658236][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1654.925503][T24308] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1654.997925][ T3275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1655.059529][ T3275] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1655.972602][T24335] bond87: entered allmulticast mode [ 1656.017973][T24335] 8021q: adding VLAN 0 to HW filter on device bond87 [ 1656.041021][ T5632] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1656.056481][ T5632] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1656.071054][ T5632] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1656.100460][ T5632] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1656.117573][ T5632] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1656.750879][ T5626] bridge0: port 4(syz_tun) entered disabled state [ 1656.814120][T24369] __nla_validate_parse: 39 callbacks suppressed [ 1656.814145][T24369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13459'. [ 1656.887526][ T5626] syz_tun (unregistering): left allmulticast mode [ 1656.918426][ T5626] syz_tun (unregistering): left promiscuous mode [ 1656.965579][ T5626] bridge0: port 4(syz_tun) entered disabled state [ 1657.027305][T24370] tipc: Enabling of bearer rejected, failed to enable media [ 1657.124079][T24382] validate_nla: 1 callbacks suppressed [ 1657.124102][T24382] netlink: 'syz.2.13461': attribute type 32 has an invalid length. [ 1657.185502][T24382] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13461'. [ 1657.373057][T24382] bond2: Setting coupled_control to off (0) [ 1657.730943][T14844] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1657.767714][T14844] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 40346 - 0 [ 1657.806917][T14844] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1657.842271][T14844] netdevsim netdevsim4 eth3 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1658.169197][ T50] Bluetooth: hci2: command tx timeout [ 1658.202157][T24405] bond88: option min_links: invalid value (18446744073709551614) [ 1658.281856][T24405] bond88: option min_links: allowed values 0 - 2147483647 [ 1658.313005][T24405] bond88 (unregistering): Released all slaves [ 1658.515524][T24417] vlan2: entered promiscuous mode [ 1658.538222][T24417] bridge0: entered promiscuous mode [ 1658.609509][T14844] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1658.665202][T14844] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 40346 - 0 [ 1658.699089][T14844] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1658.741605][T14844] netdevsim netdevsim4 eth2 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1659.017621][T14844] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1659.057875][T14844] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 40346 - 0 [ 1659.092824][T14844] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1659.155431][T14844] netdevsim netdevsim4 eth1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1659.402866][T24442] dvmrp1: entered allmulticast mode [ 1659.468312][T14844] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1659.509171][T14844] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 40346 - 0 [ 1659.559850][T14844] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1659.578477][T14844] netdevsim netdevsim4 eth0 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1659.715510][T24344] lo speed is unknown, defaulting to 1000 [ 1659.771432][T24344] wlan1 speed is unknown, defaulting to 1000 [ 1659.906022][T24467] x_tables: duplicate underflow at hook 2 [ 1660.249749][ T50] Bluetooth: hci2: command tx timeout [ 1660.635130][T24487] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13485'. [ 1660.837811][T24493] netlink: 44 bytes leftover after parsing attributes in process `syz.0.13486'. [ 1660.923998][T24500] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13487'. [ 1661.113890][T24506] netlink: 44 bytes leftover after parsing attributes in process `syz.3.13489'. [ 1661.229537][T24506] netlink: 43 bytes leftover after parsing attributes in process `syz.3.13489'. [ 1661.261818][T24506] netlink: 'syz.3.13489': attribute type 6 has an invalid length. [ 1661.285554][T24506] netlink: 'syz.3.13489': attribute type 5 has an invalid length. [ 1661.315667][T24506] netlink: 43 bytes leftover after parsing attributes in process `syz.3.13489'. [ 1661.355322][T24519] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1661.380211][T14844] vlan3: left allmulticast mode [ 1661.402248][T14844] geneve0: left allmulticast mode [ 1661.422608][T14844] vlan3: left promiscuous mode [ 1661.439189][T14844] geneve0: left promiscuous mode [ 1661.449494][T14844] bridge0: port 3(vlan3) entered disabled state [ 1661.477674][T14844] bridge_slave_1: left allmulticast mode [ 1661.485772][T14844] bridge_slave_1: left promiscuous mode [ 1661.515172][T14844] bridge0: port 2(bridge_slave_1) entered disabled state [ 1661.668118][T14844] pimreg: left allmulticast mode [ 1661.691484][T14844] tipc: Resetting bearer [ 1662.023736][T14844] bond22 (unregistering): (slave ip6gretap0): Releasing active interface [ 1662.255609][T14844] tipc: Disabling bearer [ 1662.312167][T14844] erspan0 (unregistering): left promiscuous mode [ 1662.329196][ T50] Bluetooth: hci2: command tx timeout [ 1662.356880][T14844] gretap0 (unregistering): left promiscuous mode [ 1662.392785][T14844] bond1 (unregistering): (slave gretap1): Releasing active interface [ 1662.426202][T14844] bond16 (unregistering): (slave gretap2): Releasing backup interface [ 1662.467056][T14844] bond37 (unregistering): (slave gretap3): Removing an active aggregator [ 1662.485582][T14844] bond37 (unregistering): (slave gretap3): Releasing backup interface [ 1662.521397][T14844] batman_adv: batadv0: Removing interface: gretap4 [ 1662.657212][T14844] bond42 (unregistering): (slave geneve7): Releasing active interface [ 1662.705836][T14844] bond4 (unregistering): (slave geneve4): Releasing active interface [ 1662.842090][T14844] bond7 (unregistering): (slave bridge2): Releasing backup interface [ 1662.858112][T14844] bond8 (unregistering): (slave bridge3): Releasing backup interface [ 1662.881386][T14844] bond10 (unregistering): (slave bridge4): Releasing backup interface [ 1662.899777][T14844] bond11 (unregistering): (slave bridge5): Releasing backup interface [ 1662.935977][T14844] bond32 (unregistering): (slave bridge9): Releasing backup interface [ 1662.981196][T14844] bond50 (unregistering): (slave bridge14): Releasing backup interface [ 1663.037342][T14844] bond1 (unregistering): Released all slaves [ 1663.084831][T14844] bond2 (unregistering): Released all slaves [ 1663.115195][T14844] bond3 (unregistering): (slave veth17): Releasing backup interface [ 1663.124937][T14844] bond3 (unregistering): Released all slaves [ 1663.161870][T14844] bond4 (unregistering): Released all slaves [ 1663.190006][T14844] bond5 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1663.217005][T14844] bond5 (unregistering): (slave bond6): Releasing active interface [ 1663.228367][T14844] bond5 (unregistering): Released all slaves [ 1663.249562][T14844] bond6 (unregistering): Released all slaves [ 1663.266307][T14844] bond7 (unregistering): Released all slaves [ 1663.304786][T14844] bond8 (unregistering): Released all slaves [ 1663.321952][T14844] bond9 (unregistering): Released all slaves [ 1663.362461][T14844] bond10 (unregistering): Released all slaves [ 1663.383340][T14844] bond11 (unregistering): Released all slaves [ 1663.400306][T14844] bond12 (unregistering): Released all slaves [ 1663.416835][T14844] bond13 (unregistering): Released all slaves [ 1663.445211][T14844] bond14 (unregistering): Released all slaves [ 1663.472048][T14844] bond15 (unregistering): Released all slaves [ 1663.497576][T14844] bond16 (unregistering): (slave bond17): Releasing backup interface [ 1663.520155][T14844] bond16 (unregistering): Released all slaves [ 1663.556551][T14844] bond17 (unregistering): Released all slaves [ 1663.576276][T14844] bond18 (unregistering): Released all slaves [ 1663.592960][T14844] bond19 (unregistering): Released all slaves [ 1663.611096][T14844] bond20 (unregistering): Released all slaves [ 1663.635495][T14844] bond21 (unregistering): Released all slaves [ 1663.674232][T14844] bond22 (unregistering): Released all slaves [ 1663.695063][T14844] bond23 (unregistering): Released all slaves [ 1663.714420][T14844] bond24 (unregistering): Released all slaves [ 1663.737137][T14844] bond25 (unregistering): Released all slaves [ 1663.756188][T14844] bond26 (unregistering): Released all slaves [ 1663.770318][ C1] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1663.784783][T14844] bond27 (unregistering): Released all slaves [ 1663.817794][T14844] bond28 (unregistering): Released all slaves [ 1663.836690][T14844] bond29 (unregistering): Released all slaves [ 1663.868655][T14844] bond30 (unregistering): Released all slaves [ 1663.891208][T14844] bond31 (unregistering): Released all slaves [ 1663.910000][T14844] bond32 (unregistering): Released all slaves [ 1663.941330][T14844] bond33 (unregistering): Released all slaves [ 1663.958493][T14844] bond34 (unregistering): Released all slaves [ 1663.977139][T14844] bond35 (unregistering): Released all slaves [ 1663.998676][T14844] bond36 (unregistering): Released all slaves [ 1664.023874][T14844] bond37 (unregistering): Released all slaves [ 1664.042690][T14844] bond38 (unregistering): Released all slaves [ 1664.066244][T14844] bond39 (unregistering): Released all slaves [ 1664.084110][T14844] bond40 (unregistering): Released all slaves [ 1664.100884][T14844] bond41 (unregistering): Released all slaves [ 1664.121820][T14844] bond42 (unregistering): Released all slaves [ 1664.145649][T14844] bond43 (unregistering): Released all slaves [ 1664.163333][T14844] bond44 (unregistering): Released all slaves [ 1664.186139][T14844] bond45 (unregistering): Released all slaves [ 1664.215465][T14844] bond46 (unregistering): Released all slaves [ 1664.237528][T14844] bond47 (unregistering): Released all slaves [ 1664.292806][T14844] bond48 (unregistering): Released all slaves [ 1664.321163][T14844] bond49 (unregistering): Released all slaves [ 1664.359789][T14844] bond50 (unregistering): Released all slaves [ 1664.380399][T14844] bond51 (unregistering): Released all slaves [ 1664.396658][T14844] bond52 (unregistering): Released all slaves [ 1664.412725][ T50] Bluetooth: hci2: command tx timeout [ 1664.437628][T14844] bond53 (unregistering): Released all slaves [ 1664.466627][T14844] bond54 (unregistering): Released all slaves [ 1664.492883][T14844]  (unregistering): Released all slaves [ 1664.513825][T14844] bond55 (unregistering): Released all slaves [ 1664.530842][T14844] bond56 (unregistering): Released all slaves [ 1664.562008][T14844] bond57 (unregistering): Released all slaves [ 1664.579459][T14844] bond58 (unregistering): Released all slaves [ 1664.601241][T14844] bond59 (unregistering): Released all slaves [ 1664.617676][T14844] bond60 (unregistering): Released all slaves [ 1664.637950][T14844] bond61 (unregistering): Released all slaves [ 1664.672040][T14844] bond62 (unregistering): Released all slaves [ 1664.693812][T14844] bond63 (unregistering): Released all slaves [ 1664.731241][T14844] bond64 (unregistering): Released all slaves [ 1664.767737][T14844] bond65 (unregistering): Released all slaves [ 1664.795095][T14844] bond66 (unregistering): Released all slaves [ 1664.822831][T14844] bond67 (unregistering): Released all slaves [ 1664.842163][T14844] bond68 (unregistering): Released all slaves [ 1664.860783][T14844] bond69 (unregistering): Released all slaves [ 1664.883003][T14844] bond70 (unregistering): Released all slaves [ 1664.903857][T14844] bond71 (unregistering): Released all slaves [ 1664.920360][T14844] bond72 (unregistering): Released all slaves [ 1664.945793][T14844] bond73 (unregistering): Released all slaves [ 1664.963990][T14844] bond74 (unregistering): Released all slaves [ 1664.984864][T14844] bond75 (unregistering): Released all slaves [ 1665.005735][T14844] bond76 (unregistering): Released all slaves [ 1665.032801][T14844] bond77 (unregistering): Released all slaves [ 1665.059372][T14844] bond78 (unregistering): Released all slaves [ 1665.090301][T14844] bond79 (unregistering): Released all slaves [ 1665.124964][T14844] bond80 (unregistering): Released all slaves [ 1665.152539][T14844] bond81 (unregistering): Released all slaves [ 1665.178896][T14844] bond82 (unregistering): Released all slaves [ 1665.196077][T14844] bond83 (unregistering): Released all slaves [ 1665.226937][T14844] bond84 (unregistering): Released all slaves [ 1665.245116][T14844] bond85 (unregistering): Released all slaves [ 1665.264693][T14844] bond86 (unregistering): Released all slaves [ 1665.282420][T14844] bond87 (unregistering): Released all slaves [ 1665.333305][T14844] bond0 (unregistering): Released all slaves [ 1665.350350][T14844] bond88 (unregistering): Released all slaves [ 1665.366203][T14844] bond89 (unregistering): Released all slaves [ 1665.390026][T14844] bond90 (unregistering): Released all slaves [ 1665.408903][T14844] bond91 (unregistering): Released all slaves [ 1665.427509][T14844] bond92 (unregistering): (slave veth27): Releasing active interface [ 1665.442792][T14844] bond92 (unregistering): Released all slaves [ 1665.477815][T24500] tipc: Started in network mode [ 1665.484266][T24500] tipc: Node identity ac14142f, cluster identity 4711 [ 1665.495383][T24500] tipc: Enabling of bearer rejected, failed to enable media [ 1665.830717][T24541] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13498'. [ 1665.963542][T24555] netlink: 44 bytes leftover after parsing attributes in process `syz.0.13500'. [ 1666.080099][T24554] bond91: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1666.099754][T24554] bond91: (slave ip_vti0): Error -95 calling set_mac_address [ 1666.505564][T24574] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 1666.608203][T24580] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13505'. [ 1666.652392][T24581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13507'. [ 1666.678680][T24576] IPVS: set_ctl: invalid protocol: 22 172.20.20.170:20001 [ 1666.691466][T24581] netlink: 'syz.2.13507': attribute type 30 has an invalid length. [ 1666.728536][T24581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13507'. [ 1667.134229][T24590] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13509'. [ 1667.160826][T14844] tipc: Disabling bearer [ 1667.174696][T14844] tipc: Disabling bearer [ 1667.215914][T14844] tipc: Left network mode [ 1667.631383][T24616] netlink: 44 bytes leftover after parsing attributes in process `syz.2.13514'. [ 1667.752757][T24344] bridge0: port 1(bridge_slave_0) entered blocking state [ 1667.779602][T24344] bridge0: port 1(bridge_slave_0) entered disabled state [ 1667.818480][T24344] bridge_slave_0: entered allmulticast mode [ 1667.848512][T24344] bridge_slave_0: entered promiscuous mode [ 1667.936980][T24344] bridge0: port 2(bridge_slave_1) entered blocking state [ 1667.981554][T24344] bridge0: port 2(bridge_slave_1) entered disabled state [ 1668.033230][T24344] bridge_slave_1: entered allmulticast mode [ 1668.073404][T24344] bridge_slave_1: entered promiscuous mode [ 1668.388435][T24647] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13519'. [ 1668.440014][T24344] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1668.506727][T24344] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1668.878269][T24344] team0: Port device team_slave_0 added [ 1668.928644][T24344] team0: Port device team_slave_1 added [ 1669.197729][T24667] netlink: 44 bytes leftover after parsing attributes in process `syz.0.13527'. [ 1669.360584][T24344] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1669.386495][T24344] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1669.434359][T24344] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1669.550055][T24344] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1669.566361][T24344] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1669.617675][T24344] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1670.367418][T24702] netlink: 112 bytes leftover after parsing attributes in process `syz.2.13534'. [ 1670.476636][T24344] hsr_slave_0: entered promiscuous mode [ 1670.506577][T24344] hsr_slave_1: entered promiscuous mode [ 1670.520526][T24344] debugfs: 'hsr0' already exists in 'hsr' [ 1670.530918][T24344] Cannot create hsr debugfs directory [ 1671.023967][T24726] __nla_validate_parse: 1 callbacks suppressed [ 1671.023989][T24726] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13538'. [ 1671.343702][T24735] netlink: 44 bytes leftover after parsing attributes in process `syz.3.13540'. [ 1671.354963][T24736] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13541'. [ 1671.397065][ T12] smbdirect: ib_dev[syz1] removed [ 1671.548025][T24729] bond88: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1671.565739][T24729] bond88: (slave ip_vti0): Error -95 calling set_mac_address [ 1671.823980][T24748] netlink: 'syz.3.13544': attribute type 2 has an invalid length. [ 1671.898680][T24748] netlink: 'syz.3.13544': attribute type 1 has an invalid length. [ 1672.073384][T24753] netlink: 'syz.0.13546': attribute type 32 has an invalid length. [ 1672.126651][T24753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13546'. [ 1672.505896][T24753] bond89: Setting coupled_control to off (0) [ 1672.567654][T24764] veth0_macvtap: entered allmulticast mode [ 1672.612842][T24764] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 1672.755034][T24774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13549'. [ 1672.901139][T24778] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 1673.114838][T24786] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13552'. [ 1673.797977][T24787] bond4: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 1673.888521][T24787] bond4: (slave ip_vti0): Error -95 calling set_mac_address [ 1674.065640][ T1628] block nbd2: Possible stuck request ffff8880277c5080: control (read@0,1024B). Runtime 180 seconds [ 1674.076918][ T1628] block nbd2: Possible stuck request ffff8880277c5240: control (read@1024,1024B). Runtime 180 seconds [ 1674.091395][ T1628] block nbd2: Possible stuck request ffff8880277c5400: control (read@2048,1024B). Runtime 180 seconds [ 1674.103117][ T1628] block nbd2: Possible stuck request ffff8880277c55c0: control (read@3072,1024B). Runtime 180 seconds [ 1674.492617][T24814] netlink: 156 bytes leftover after parsing attributes in process `syz.2.13555'. [ 1674.594280][T24814] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13555'. [ 1674.691787][T24789] bridge0: port 2(bridge_slave_1) entered disabled state [ 1674.699628][T24789] bridge0: port 1(bridge_slave_0) entered disabled state [ 1674.737579][T24824] netlink: 40 bytes leftover after parsing attributes in process `syz.0.13557'. [ 1675.480369][T24789] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1675.523288][T24789] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1676.232772][T14844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1676.250997][T14844] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1676.293370][T14844] veth1_vlan: left promiscuous mode [ 1676.304758][T14844] veth0_vlan: left promiscuous mode [ 1676.546267][T24858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13562'. [ 1676.556879][T24858] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1676.794878][T19757] smc: removing ib device syz2 [ 1677.075347][T14844] team0 (unregistering): Port device team_slave_1 removed [ 1677.095771][T14844] team0 (unregistering): Port device team_slave_0 removed [ 1677.305771][ T5289] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1677.314742][T11102] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1677.356791][T11102] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1677.515813][T20176] ================================================================== [ 1677.523963][T20176] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 [ 1677.532827][T20176] Read of size 1 at addr ffff888033472e09 by task kworker/0:9/20176 [ 1677.540817][T20176] [ 1677.543153][T20176] CPU: 0 UID: 0 PID: 20176 Comm: kworker/0:9 Not tainted syzkaller #0 PREEMPT(full) [ 1677.543173][T20176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1677.543184][T20176] Workqueue: infiniband ib_cache_event_task [ 1677.543277][T20176] Call Trace: [ 1677.543286][T20176] [ 1677.543294][T20176] dump_stack_lvl+0xe8/0x150 [ 1677.543319][T20176] print_address_description+0x55/0x1e0 [ 1677.543342][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1677.543360][T20176] print_report+0x58/0x70 [ 1677.543380][T20176] kasan_report+0x117/0x150 [ 1677.543411][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1677.543434][T20176] __ethtool_get_link_ksettings+0x230/0x250 [ 1677.543455][T20176] __ethtool_get_link_ksettings+0x11f/0x250 [ 1677.543475][T20176] ib_get_eth_speed+0x180/0x7f0 [ 1677.543536][T20176] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 1677.543565][T20176] ? do_raw_spin_unlock+0xf5/0x210 [ 1677.543583][T20176] ? rxe_query_port+0x6b/0x3d0 [ 1677.543638][T20176] rxe_query_port+0x93/0x3d0 [ 1677.543663][T20176] ib_query_port+0x16e/0x830 [ 1677.543680][T20176] ib_cache_update+0x1ba/0xc50 [ 1677.543705][T20176] ? do_raw_spin_lock+0x12b/0x2f0 [ 1677.543722][T20176] ? __pfx_ib_cache_update+0x10/0x10 [ 1677.543744][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1677.543762][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1677.543782][T20176] ib_cache_event_task+0xd3/0x1c0 [ 1677.543802][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1677.543819][T20176] process_scheduled_works+0xa8e/0x14e0 [ 1677.543849][T20176] ? __pfx_process_scheduled_works+0x10/0x10 [ 1677.543869][T20176] ? assign_work+0x3cf/0x5d0 [ 1677.543888][T20176] worker_thread+0xa47/0xfb0 [ 1677.543918][T20176] kthread+0x388/0x470 [ 1677.543939][T20176] ? __pfx_worker_thread+0x10/0x10 [ 1677.543956][T20176] ? __pfx_kthread+0x10/0x10 [ 1677.543978][T20176] ret_from_fork+0x514/0xb70 [ 1677.544002][T20176] ? __pfx_ret_from_fork+0x10/0x10 [ 1677.544023][T20176] ? __switch_to+0xc89/0x1420 [ 1677.544043][T20176] ? __pfx_kthread+0x10/0x10 [ 1677.544064][T20176] ret_from_fork_asm+0x1a/0x30 [ 1677.544086][T20176] [ 1677.544092][T20176] [ 1677.748645][T20176] Allocated by task 5626: [ 1677.752990][T20176] kasan_save_track+0x3e/0x80 [ 1677.757690][T20176] __kasan_kmalloc+0x93/0xb0 [ 1677.762305][T20176] __kvmalloc_node_noprof+0x53f/0x860 [ 1677.767708][T20176] alloc_netdev_mqs+0xa9/0x12b0 [ 1677.772584][T20176] rtnl_create_link+0x321/0xd70 [ 1677.777456][T20176] rtnl_newlink_create+0x25f/0xb00 [ 1677.782597][T20176] rtnl_newlink+0x167f/0x1bd0 [ 1677.787313][T20176] rtnetlink_rcv_msg+0x802/0xc00 [ 1677.792281][T20176] netlink_rcv_skb+0x226/0x4a0 [ 1677.797075][T20176] netlink_unicast+0x7bb/0x940 [ 1677.801861][T20176] netlink_sendmsg+0x813/0xb40 [ 1677.806653][T20176] sock_sendmsg_nosec+0x13a/0x180 [ 1677.811715][T20176] __sys_sendto+0x408/0x5a0 [ 1677.816280][T20176] __x64_sys_sendto+0xde/0x100 [ 1677.821080][T20176] do_syscall_64+0x174/0x580 [ 1677.825700][T20176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1677.831625][T20176] [ 1677.833963][T20176] Freed by task 14844: [ 1677.838059][T20176] kasan_save_track+0x3e/0x80 [ 1677.842763][T20176] kasan_save_free_info+0x40/0x50 [ 1677.847826][T20176] __kasan_slab_free+0x5c/0x80 [ 1677.852611][T20176] kfree+0x1c5/0x640 [ 1677.856539][T20176] device_release+0xc4/0x1f0 [ 1677.861150][T20176] kobject_put+0x222/0x550 [ 1677.865604][T20176] netdev_run_todo+0xf56/0x10d0 [ 1677.870473][T20176] default_device_exit_batch+0x966/0x9e0 [ 1677.876131][T20176] ops_undo_list+0x4b4/0x8d0 [ 1677.880819][T20176] cleanup_net+0x572/0x810 [ 1677.885277][T20176] process_scheduled_works+0xa8e/0x14e0 [ 1677.890841][T20176] worker_thread+0xa47/0xfb0 [ 1677.895463][T20176] kthread+0x388/0x470 [ 1677.899559][T20176] ret_from_fork+0x514/0xb70 [ 1677.904175][T20176] ret_from_fork_asm+0x1a/0x30 [ 1677.908955][T20176] [ 1677.911329][T20176] The buggy address belongs to the object at ffff888033472000 [ 1677.911329][T20176] which belongs to the cache kmalloc-cg-4k of size 4096 [ 1677.925684][T20176] The buggy address is located 3593 bytes inside of [ 1677.925684][T20176] freed 4096-byte region [ffff888033472000, ffff888033473000) [ 1677.939683][T20176] [ 1677.942026][T20176] The buggy address belongs to the physical page: [ 1677.948461][T20176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33470 [ 1677.957246][T20176] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1677.965805][T20176] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1677.973392][T20176] page_type: f5(slab) [ 1677.977397][T20176] raw: 00fff00000000040 ffff88801b01b500 dead000000000122 0000000000000000 [ 1677.985999][T20176] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1677.994603][T20176] head: 00fff00000000040 ffff88801b01b500 dead000000000122 0000000000000000 [ 1678.003291][T20176] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1678.011984][T20176] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1678.020670][T20176] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1678.029347][T20176] page dumped because: kasan: bad access detected [ 1678.035788][T20176] page_owner tracks the page as allocated [ 1678.041517][T20176] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5626, tgid 5626 (syz-executor), ts 87866483203, free_ts 66591240332 [ 1678.062900][T20176] post_alloc_hook+0x1f9/0x250 [ 1678.067695][T20176] get_page_from_freelist+0x21fa/0x2270 [ 1678.073269][T20176] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1678.079102][T20176] allocate_slab+0x79/0x5e0 [ 1678.083633][T20176] refill_objects+0x2d5/0x350 [ 1678.088333][T20176] __pcs_replace_empty_main+0x2bf/0x6b0 [ 1678.093908][T20176] __kmalloc_node_track_caller_noprof+0x557/0x730 [ 1678.100350][T20176] kmemdup_noprof+0x2b/0x70 [ 1678.104878][T20176] __addrconf_sysctl_register+0xa7/0x4b0 [ 1678.110603][T20176] addrconf_sysctl_register+0x168/0x1c0 [ 1678.116176][T20176] ipv6_add_dev+0xd26/0x13a0 [ 1678.120784][T20176] addrconf_notify+0x771/0x1050 [ 1678.125654][T20176] notifier_call_chain+0x1a5/0x3d0 [ 1678.130787][T20176] register_netdevice+0x18a4/0x1eb0 [ 1678.136009][T20176] virt_wifi_newlink+0x3be/0x7c0 [ 1678.141032][T20176] rtnl_newlink_create+0x310/0xb00 [ 1678.146173][T20176] page last free pid 5474 tgid 5474 stack trace: [ 1678.152512][T20176] __free_frozen_pages+0xc1e/0xd10 [ 1678.157642][T20176] __slab_free+0x274/0x2c0 [ 1678.162076][T20176] qlist_free_all+0x99/0x100 [ 1678.166685][T20176] kasan_quarantine_reduce+0x148/0x160 [ 1678.172169][T20176] __kasan_slab_alloc+0x22/0x80 [ 1678.177043][T20176] __kmalloc_cache_noprof+0x2ab/0x660 [ 1678.182440][T20176] tomoyo_init_log+0x195/0x1fa0 [ 1678.187312][T20176] tomoyo_supervisor+0x35f/0x1560 [ 1678.192351][T20176] tomoyo_path_permission+0x262/0x3b0 [ 1678.197765][T20176] tomoyo_check_open_permission+0x2b2/0x470 [ 1678.203687][T20176] security_file_open+0xa9/0x240 [ 1678.208659][T20176] do_dentry_open+0x4a0/0x1380 [ 1678.213439][T20176] vfs_open+0x3b/0x340 [ 1678.217529][T20176] path_openat+0x2e44/0x3830 [ 1678.222140][T20176] do_file_open+0x23e/0x4a0 [ 1678.226666][T20176] do_sys_openat2+0x115/0x200 [ 1678.231359][T20176] [ 1678.233695][T20176] Memory state around the buggy address: [ 1678.239342][T20176] ffff888033472d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1678.247429][T20176] ffff888033472d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1678.255504][T20176] >ffff888033472e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1678.263577][T20176] ^ [ 1678.267917][T20176] ffff888033472e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1678.276000][T20176] ffff888033472f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1678.284071][T20176] ================================================================== [ 1678.311310][T20176] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1678.318578][T20176] CPU: 0 UID: 0 PID: 20176 Comm: kworker/0:9 Not tainted syzkaller #0 PREEMPT(full) [ 1678.328065][T20176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1678.338147][T20176] Workqueue: infiniband ib_cache_event_task [ 1678.344084][T20176] Call Trace: [ 1678.347384][T20176] [ 1678.350338][T20176] vpanic+0x56c/0xa60 [ 1678.354373][T20176] ? __pfx_vpanic+0x10/0x10 [ 1678.358922][T20176] panic+0xc5/0xd0 [ 1678.362683][T20176] ? __pfx_panic+0x10/0x10 [ 1678.367143][T20176] ? preempt_schedule_thunk+0x16/0x40 [ 1678.372572][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1678.378693][T20176] ? preempt_schedule_thunk+0x16/0x40 [ 1678.384106][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1678.390214][T20176] check_panic_on_warn+0x89/0xb0 [ 1678.395197][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1678.401306][T20176] end_report+0x73/0x170 [ 1678.405594][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1678.411708][T20176] kasan_report+0x128/0x150 [ 1678.416262][T20176] ? __ethtool_get_link_ksettings+0x230/0x250 [ 1678.422414][T20176] __ethtool_get_link_ksettings+0x230/0x250 [ 1678.428349][T20176] __ethtool_get_link_ksettings+0x11f/0x250 [ 1678.434286][T20176] ib_get_eth_speed+0x180/0x7f0 [ 1678.439187][T20176] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 1678.444609][T20176] ? do_raw_spin_unlock+0xf5/0x210 [ 1678.449761][T20176] ? rxe_query_port+0x6b/0x3d0 [ 1678.454572][T20176] rxe_query_port+0x93/0x3d0 [ 1678.459205][T20176] ib_query_port+0x16e/0x830 [ 1678.463839][T20176] ib_cache_update+0x1ba/0xc50 [ 1678.468652][T20176] ? do_raw_spin_lock+0x12b/0x2f0 [ 1678.473729][T20176] ? __pfx_ib_cache_update+0x10/0x10 [ 1678.479057][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1678.484811][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1678.490568][T20176] ib_cache_event_task+0xd3/0x1c0 [ 1678.495632][T20176] ? process_scheduled_works+0xa20/0x14e0 [ 1678.501391][T20176] process_scheduled_works+0xa8e/0x14e0 [ 1678.506985][T20176] ? __pfx_process_scheduled_works+0x10/0x10 [ 1678.513007][T20176] ? assign_work+0x3cf/0x5d0 [ 1678.517728][T20176] worker_thread+0xa47/0xfb0 [ 1678.522371][T20176] kthread+0x388/0x470 [ 1678.526487][T20176] ? __pfx_worker_thread+0x10/0x10 [ 1678.531617][T20176] ? __pfx_kthread+0x10/0x10 [ 1678.536241][T20176] ret_from_fork+0x514/0xb70 [ 1678.540864][T20176] ? __pfx_ret_from_fork+0x10/0x10 [ 1678.545998][T20176] ? __switch_to+0xc89/0x1420 [ 1678.550694][T20176] ? __pfx_kthread+0x10/0x10 [ 1678.555315][T20176] ret_from_fork_asm+0x1a/0x30 [ 1678.560107][T20176] [ 1678.563755][T20176] Kernel Offset: disabled [ 1678.568090][T20176] Rebooting in 86400 seconds..