last executing test programs: 4.975630116s ago: executing program 0 (id=3322): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x6c, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x5c, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x13}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz0\x00'}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xc4}}, 0x0) close(0x3) 4.812318694s ago: executing program 0 (id=3323): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8932, &(0x7f0000000040)={'ip6gre0\x00', 0x0}) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000002440)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f00000008c0)=""/242, 0xf2}, {&(0x7f00000009c0)=""/180, 0xb4}, {&(0x7f0000000a80)=""/109, 0x6d}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000000200)=""/74, 0x4a}, {&(0x7f0000000100)=""/35, 0x23}, {&(0x7f0000002080)=""/26, 0x1a}], 0x7}, 0xdf5c}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x1ecc}], 0x4, 0x10020, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x4000000, {}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x2a0}) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f00000005c0)=ANY=[], 0x8) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x6, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r4) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x64000) openat$tun(0xffffffffffffff9c, 0x0, 0x18103, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x9, 0x10001, 0xb, 0x81}, 0x50) r6 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r6, &(0x7f0000000280)=""/31, 0x1f, 0x80, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newchain={0x34, 0x64, 0x300, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x10, 0xfff3}, {0x9, 0x2}, {0xffe0, 0xffe0}}, [@TCA_CHAIN={0x8, 0xb, 0xf183}, @TCA_CHAIN={0x8, 0xb, 0x2}]}, 0x34}}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r5, 0x0, 0x0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x4e) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e000000020013000200000000000000ff0800ed05000600200000000a0006000000000026b900000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmsg$key(r9, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002eb0e00000000000000000105000600200000000a00000040010000000500e50000070000001f00001a000000030000a95a6e870200010000e9ff070040000200000000050005000000cc580a"], 0x80}}, 0x4000000) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={0x0, {0x2, 0x0, @multicast2}, {0x2, 0x0, @multicast2}, {0x2, 0x2, @empty}, 0xab852ebbeefbd6b1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0f, 0x1000000000080e2, 0x2}) epoll_create1(0x80000) 3.768409243s ago: executing program 0 (id=3329): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079109e000000000007000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0xfffffffc, @remote}}]}]}, @IFLA_GROUP={0x8}]}, 0x58}}, 0x0) 3.427422388s ago: executing program 0 (id=3333): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000080)={'ip6_vti0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x5, 0xe, 0x0, &(0x7f0000000000)="251200d800"/14, 0x0, 0x7ff, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000080)={'ip6_vti0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) (async) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x5, 0xe, 0x0, &(0x7f0000000000)="251200d800"/14, 0x0, 0x7ff, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) 3.090313612s ago: executing program 0 (id=3338): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x4, 0x2, 0x9494}) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x8864}, @void, @ipv6=@generic={0xe, 0x6, "e553e8", 0x496, 0x37, 0x1, @mcast1, @loopback, {[@hopopts={0x6c, 0x5, '\x00', [@generic={0x3, 0x27, "42777da8402de9f0c7e7804bc95c5cb0278ba858dd9af188497b2fc60b35cf9da52975650ef99e"}]}, @fragment={0x62, 0x0, 0xf, 0x1, 0x0, 0x1c, 0x65}, @dstopts={0x3b, 0x35, '\x00', [@calipso={0x7, 0x20, {0x3, 0x6, 0x5, 0x7ff, [0xe, 0x80000000, 0x0]}}, @generic={0x7, 0xa3, "615c63ab50c964f1bbc15b6a6dadca154074b82b52e9a5b1b3fc7c81f7aedfdb2d5d5be52fe100fcaaf680b65b1f02cdd9238dcbbb192258cf5a11ce516ff89010cf6fbefc1224132ec211cf6c65caac77383f2324ce9dfc59582bbb3cb7cee8262aa3faaef5c6d268bf7347ad6a4ac3497b32254c6541cf66fda2398c35483648b1cf0d73766474423eb83437d75afbc16d4b3ab91b0cf702704484ae811c579d9f69"}, @enc_lim={0x4, 0x1, 0x3b}, @jumbo={0xc2, 0x4, 0x3}, @generic={0x8, 0xdc, "157fd5d7ec633c21bb790ed3d9c5856e6d7a645a6cd581e4fc788f179594b9b53c8353cce8e92da6f60fe5db29b8c75da38ad907bd50c3768686c58c6fdcbff8bb471bb4c9a7b78543856d9df4c1980447d61df25044abe80de78164a4aa6486a88b42fef001d8a571ed9c6b528e776c7d7f38c382ce3e45daefaae6bdb8df256677e2c0257a89c71a7e30b5fa84be114263e3998fa78665694e1f0d20b1e787c71d3240a69a60d3f8171d276393f80d4cf26f8805df5c6d0503123908d3f0e8384ee481b12c8a02da8ff5b072842b9f79d6d26c49395f77d218cce9"}]}, @dstopts={0x0, 0x25, '\x00', [@generic={0xc4, 0xe2, "e3fdd27e707ecfb5d758a42ed927d1a20cd8f22b4f2cfd3b1c45682aaba6af98dd3d5fd64a63fad170e7b5e6851c98c41e2b232c6bc83a357c7b8cee91f7bb54625ace63c5cb4a91295b8fe7d6cc5b748124b954b164af162d5e670fd041bc35e7f5c859ed45292fb6b124c37bb659b012338734448d45398592e189c8bba5262a9177149f451dcc0eca14029a580af6988400b75d549efb6eb3a84e8960f3770341f99de1b7f9edbc13e7f58608d5a62886e6dbb23a813308e2c8159fe872116da9e3318bdf0abcdad58c246907cc1547f48acdea1d68e00dbac9ea32f43a047ee7"}, @pad1, @hao={0xc9, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}}, @ra={0x5, 0x2, 0x1}, @pad1, @jumbo={0xc2, 0x4, 0x81}, @hao={0xc9, 0x10, @remote}, @hao={0xc9, 0x10, @local}]}, @routing={0x2f, 0xc, 0x2, 0x3, 0x0, [@private0, @remote, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}, @private0, @loopback]}], "dae099627fac311a22b7c25afc810d075ce45863432235f7e9c7c6a8ac03b356d29f521247e7a22ec9c4be788daab6b1f0b3ce8d869ba2967f4763eb9a49c012fd749d30daa96650712a3297547bdf1e80aeec8eb162c71e810a70a15d4f5edc6714cbe1872e4b7204dafadec310d2533c0fd9be1aa46271f53a6edaf83cb270bf891551aa5fb172009855927bc96eab6f5d04ce037e2c1b15ca4a794392d798153525307ce0e3614cc22890bb954381c474c2916ceca726e8a974d1efad1a2ae55e4baecf7e0d47212cc05b459392dc96e995e1b7e8ea3fb37c069e3490f5203e5bfa4f8c055b2e0390f2604ce2d4a1882f9716c007a925e0050ed9e5a3"}}}, 0x4c2) write$cgroup_devices(r0, &(0x7f0000000540)={'b', ' *:* ', 'm\x00'}, 0x8) (async) write$cgroup_devices(r0, &(0x7f0000000540)={'b', ' *:* ', 'm\x00'}, 0x8) ioctl$BTRFS_IOC_SCRUB_CANCEL(r0, 0x941c, 0x0) socket(0x29, 0x1, 0x4) (async) r1 = socket(0x29, 0x1, 0x4) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000580)='veth1_to_bridge\x00') ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f00000005c0)={0x0, 0x4, 0x101, 0x392}) sendmsg$nl_route_sched_retired(r1, &(0x7f00000026c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002680)={&(0x7f0000000640)=@newtaction={0x2040, 0x30, 0x8, 0x70bd29, 0x25dfdbfe, {}, [{0x6ec, 0x1, [@m_ipt={0x70, 0x19, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x7}]}, {0x3e, 0x6, "3891f60d90c13e6e30d2c0d9040ab0962e24a73819765a7bd9156297c3140beb2bdca233a3a291133d03bffd9f92051f69bd681029d46b4d48ee"}, {0xc, 0x7, {0x1}}, {0xc}}}, @m_ipt={0x218, 0x6, 0x0, 0x0, {{0x8}, {0x118, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x3}, @TCA_IPT_TARG={0x10a, 0x6, {0x2, 'raw\x00', 0xc, 0x5, "31ba28f9f92c6229c92c561ab57ea11463efcb380213ea21c5f631c4333f0aebaf5305727e12b5e99acfbfd8f46a86023a8f7d4f62ba78bb3b8b56bc55836ce1dca0469796e1d5ca24d8b60c371d99d7c0f773d56dd3ed3a84dadef4bb704b4750608d2105f1183101dd0b363ead5cc63c05c8b2acd03d20f6ee9b105cd7ffdec90a7118486c0f088458fddd227ecd47216ac0643e71f0ea82a9db1e48da10c752083cf0a5f95740211cd6495003e229878dc95b6987ca4a5c501f3253f4db5b85c96e40f0557d46257ddb0b5c9a99baf388702c21916d046ad75b3bebbc92d9"}}]}, {0xdb, 0x6, "70e438d4e96259303bba84a82e939f972b76c740a04d8f06069751425e81e8de13d329a063ba3caa2cf3e3b8b48e70e4ee3defe786a125c7fc0c639c28af2d14072342e094b14c510cdb1461b812a4917f8464a08fdd54c6b6b6951c83f3b098f99685a6495bdf9be56d92a6e478b67653546fcccd3fc6bfb8c5054cba11b17a7d9e0a997fa1720ea678cfcc0b9a0536a9b29011e3f7b905b376897491f1cd0167cdd82422333acaeb78517658d754bf31d668cebe1e3dc81b1808a6ae6d287f8e9dabd6a90a92f8c6fcfb458ad82054b3f5dbd774fd1e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x5}}}}, @m_ipt={0xa4, 0x6, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}]}, {0x57, 0x6, "65bc38666a0e0618eefd8096333f38608f6089388963458851ec6e80238fdd92a4cebd54f12134037ace22cd7fd2842dcaf14f9c697e5fff923b11560e668cd346a27fa3a96f244b6f542aaf83fe0860a53376"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ipt={0x358, 0x19, 0x0, 0x0, {{0x8}, {0x2d0, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xf1}, @TCA_IPT_TARG={0x60, 0x6, {0x4, 'nat\x00', 0x1, 0x100, "f691eae9c7a318c32719c6abfb199d28760dad43acab8c90eecd7af104bc13a97d4477a85744a40ced19e074bae4e15bef4644e7ff9a"}}, @TCA_IPT_TARG={0x110, 0x6, {0xc0c, 'mangle\x00', 0xc, 0xbb1b, "1aacdf0f64cecb48042e87679c7391a772f5c16a2710c2a5fac2aac84e15d4456a4ad867d16e715e4da8e281272805ccbd71323cfa331b32c2819281d5b91fc2300615a90523c509e1193c3d680439c71a1b432a90bd9291f5c670375137121f26b88dba3a9ab38ff7ef25da9afd750ea360825103256b091a61d030b1aa2b4d49dfdfa2a69f1264d389872bfb84fdd8f4600fa4f5ce08b4b0dfb217afc3c5dba9872b17264b65051108b903f85b2820299b3ddab2d3c2d00f113ed776d1bf6b22dcb7c80be59c4b3cfae6c505167aed6685986cdc62f8bc8b992ecdd82cb223f3e5d1d7d342"}}, @TCA_IPT_TARG={0xdf, 0x6, {0x5, 'security\x00', 0x2, 0x3, "621bde87aae4ba383530d6fbbefea7204e3ecc7d4983bcb3170054273e7f7920c6237cacc80ecc18247c22a95c4e1751fd7ba4b4c1edc480f7775ac904ad10209f4926f7956117e17306c94c74879fd3e0857be37624f945669842cb5af88dc2275de2569e1a80d87b90facb98a9e4c4f1cd84764b80b51917f2c4fdf81849db935bbd8c53a0482e3fa6f5479f0d952ff2fd307caf7a14d02e3f101d726466c5998109eb89ab3b038f489e3d2cff2033dcc632c1ce"}}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8}, @TCA_IPT_INDEX={0x8, 0x3, 0x9}, @TCA_IPT_INDEX={0x8, 0x3, 0x8}, @TCA_IPT_TARG={0x52, 0x6, {0x4, 'mangle\x00', 0x3, 0x9, "1104c44598a8e38f2c8d661a299d8f8d7e3240d4200ab73dea0bfffc576d742628870c783143196d"}}]}, {0x61, 0x6, "50f958efc269fac1be76b4da2b8d2f6740a7ef21a12f84363370a1c023716611bd316a3c8ad008fb33586bebf8a8ed5ed7335e2d769cdffd20e8da802facc0bbae05f0ccb8c1b7d8aaf8f861fd220408a935638bcf887ff55e9bef8ac8"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_ipt={0x64, 0x10, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x4}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}]}, {0xd, 0x6, "f43b3b65a692037630"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}, {0x1724, 0x1, [@m_ipt={0x218, 0x13, 0x0, 0x0, {{0x8}, {0x100, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_TARG={0xd7, 0x6, {0xd5, 'security\x00', 0x5a, 0xff, "3a5e510e5f22c4b408423ee5ffea2dfe75d7bba612afa0bc15af42ab244a1c751f514119ff6f8465eae5f6ec8401afcb5fe20516767541e4bad61b09fe5da10b49a94518da47b79995ac00682235afefddad5028b7ba63b7a5155094454e69cf5bc19a1429b4f5ea61a6468bf2bf36afa9f4809c80909317a6fbf756181c5f118d4ec90110f459eb877d6af68e1873d817b76125098a24d29da0e0fbb839347def6d96d1ed642e543305c0e219"}}]}, {0xf1, 0x6, "59486ff55ca70e407dda92a9191479156eb6ba56c6e581bc1c397917ab37c171b1217d126b6a2f89793a2481be9e1fdc8daa1e1012892ef55a9029014eb45e8b770417bfd70bcb32a55f98f8cc4eeffdfb54e9d5d936a009e9385491ca8adf757a4b624496c17025d40a38b6b3c1c7a50e060d303bd8c9b89d7b608f8c61d92b6fe118124836ef4574c319c521a17ccb50a1ce142217c3f820fed18f80ddb6ba9b6b28ffa76932d25ebf7ff7d8e0a893a2b30ca504ed83f373c505ae59e282eeaae3a2ab1c554c7bbf77f866819e7994e28eb61bafa52cbaa4ece89182ac64f09abcedc7727df6492edecf2cc5"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_ipt={0x19c, 0x7, 0x0, 0x0, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0x49, 0x6, {0x8, 'nat\x00', 0x5, 0x2b90, "cc27f7ee75fa8f78819e4c368c7a1ad33946aa0b90f680588f908f076a3361"}}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}]}, {0xfa, 0x6, "16ad82dfb0ae8c097a32b73dfc2aeb4a8b076bba33fb70e907fbc434fab77e14d4139525bee280704232a902306488b16c84eaa1806985e7766d6d9152f4b066ba63a3cd392fe08e3dd97f4f746b3d8c691c005d3556b37ef257345ec9bce7b012cd10e9e556f072e1f27210cd87a109d94d2b8ad7da6c9715efd6c7488d37b8a38a5baf3691d79b86aca7335299c8dba02cf81dbb7c7cee81222a8b12d07b4ed0b4c9aadf9713ce9b0727600f9a6e4221f2dbf1fd0054c15e4d58f7adf9f7094b15726b0ab4fd4e56a78ed1fbda14b2e849d0c567e44b9339d6bf963649261719df9f6c0f3abec9dcd929e3ab875f2e4fd8644ee112"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ipt={0xc0, 0x11, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0xda0}]}, {0x86, 0x6, "9a4db874e471c156672b2a516fa39bf85e04bac003b725e1930a2cadb13d273813e8177a23015e418f0494b068af48707872b8ca9e50d48b2315bd904f4e11444ff87be8626690a5db6aa4fab0c4882d3eb66f8d552117d033f903faaeffeb7815945d258224d6363016bdfe414479ce59387996bd46eaca0c2cf0babee169d4587e"}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}, @m_ipt={0xe8, 0x18, 0x0, 0x0, {{0x8}, {0xa0, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_HOOK={0x8}, @TCA_IPT_TARG={0x65, 0x6, {0x17d4, 'mangle\x00', 0x7a, 0x1, "85c2250eb733e10f8a550d28819143cd272402dd06d11827d57c12c651510fd98744fa97978a258991f088d995762240fef2834ca7ea0d34f2bbf5"}}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}]}, {0x23, 0x6, "75e83659f90e1969c3fed50653f9e2fafc475204efabc72a1539ef91add4df"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ipt={0x1050, 0x19, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}]}, {0x1004, 0x6, "41afc516b4bd2c07249c4a1542ae1f9f38edd428e70de625b6156149f837f534e31b6e1a30d6859855493d3fa540419e430bf999461823b397b879a6d784af842a7076c84e606dd19d35e70a6946230d6e29242d69832ca4b00a84da209fbd64eaf831f9c708a6d4fb47a183e11a242e344876fdbde9b339b8afe0bf93a58c73e3ef5c221111136b60b289ee57c195388c63c0f413ca65b7f5b6b906d473e5ef7aa98d38886146ef4589a19927bdf7ad334dcd1498b31cca7b663abb239868bdfc13e9d8deb43307140c5fffaa3bf8bb89df6549c46417275f0ec3de4103f94cf0c617df48638cb60496671e37a93ee67009e6433651dcf711a487c72f7f14c2a6d0dd1449ab5cbb7ace0f3e84181a2ebb392aad781b4ed1e38f4144c506374cddef5c627e0925b658b0185bf7f7226d4a7879939c54acbcc86b073b80e9ba0ff87b858f568d03edbfc3a83465b8ee83dca80f441e8e3c7ce4fad40bce59497e0afb8b866b5be7a73d1f628fd637c75c5517a6e554d44b2095ec1c2dfbd57d9814fff487f91071d0441c66739225d2fc94eadf6f37eb02505b62d1ba9ff9250a606b769c92e67f95271dee0ff473f6f8d5e036bf1fc626446ab152dc1eeae20565662edd9feec0444c0ca908e3489a45c3cd2c11ad5ac6fa59661b3886ef3590531304efdbb4ecf0bdd53004dc348645f3dbd44cd20359aec383ea20d455a0981af5dc06b91e8835f11fbef18b2e551a159fb3d81190fe60ab26953953bd07acdc90191d024913316a7060a1a21a98f9a9fd3308c9537bb1f1c9368472a654433c138bc91153d64bafdf32d707d21719354127e01786e3bb3f6df9723d4f243032a1bfc4014a9660182e0f16b9eef8826cdf23729452819dbc9e695bc6cc6cab78c332d7bbda6da069d22bc16e3c74c0a40d983ba01cc30888bec33df842a9fc6d0bb22ed0a5bca085426d3a01c30793348598e020be8a309facf80fafb1d7e1f107d9fec8c69b228b0b3533f74219174ddb64ecc6532779f42dcc3dae70bb7e3520f03d23c1c627ade25573fa1c28c2f3130818ba406ce1a777dc0577c22301ef81145dad18f39f38651c12ddcb02d3e6e80a74bad5e9049b2cdbe189f3eb522eff78928c4598136d0a2540754c79908b41dadd81197072402e4ea2a49b6689c0c1dc7c6c550a804759e86d2db18dc54d2356c11bed4be8ef37a762571b94bdea1356708c74425e8a4eab7d8a577ee0695d4f38df501c7af05a73d51df03ad671c841a27cb908d94ed5f96152e939b623f157cf2b6796350c710eacab294c6c3c2a9ceec8a30a83cb31f329f6e7c586a57c4fd0bc0c21a09a5a4e3b934a42128fbf0b043c0766c74f023bcf46760d2df897ec2dd214e6300ea739300874db2e1641635dfc38236c965aa05f62806c506915902829251122897f9cf46c1f27882d6ab09afe39d594ff9586d0796ebaf8e126413324d35d5d508a423afcc0d0683a14c5aa637b1a36104534bf2a2439af205a1026ed533ff1798943ac30abdccca49031b5926e092d4870322ad62ae15a65950eaf80c603cd03327abdc2ce4aa8ba29290fe0a3223c08ad283290ac36a95d9deb67018bd5ee841f88ff3b92045a70837a5181f28187ea50fb15efb6eae4d3a5d10af5f76bfaa384596c07a72d75caafbb692202b346153f48157fc34281ae640bb475ac5f49f1c5a330781b17f7286440501b536d3acfaa7007298bcdaef1b2329f56bda52365b85d029bb32286f12b6ea80740b450033a69a86c7c357f3bae7c0379c040ac2b5a9899a10c7dda5b1b4361cde5c59765f6b99db873b35c0ec64ad05889697540f7a53581514facffba2409fabff6e96886bd397d16d71e439e008cfd8af50e63dd82e22fe6a36ed0109834e7b47aedd4cefc3dc9586dd0e0aca8ebf5ff50b0a42476aaedf92cd0db79f2bbc773653b3220445788c5a13090c59ee3e5caa7be68e48fb2267cfe64a9d53078ac9a9e42f8aa60fe4bb5238f9c4b61fc6bf265c2b638f29fb0563faba6b0223e60ff77b2538cf2871e956c7a992071d6566deaa37ebda29f3014802c9504d49829b80ae9989c432e88f6fb8155779c20a138cd5d9442808ef864613e773355af595f97f4f85f19b0ecd469467849fa9a0f9e76c1c112e715d1b8e972aad89d44a683440cdd1e838f8166922257aaec006def8660f1b3324de8fb85421c19ca87d8bf50b8787cc6ebac8f7f4844ece8f71de1f00490a2b6c6ae5844ed5fa7fcfdc421f78b68043ce4639c370c846138c15af9d6046c71c3695df1e19a3a9047a625cb934f462bf5f018a7f20df61cad178f25d1b6c6755b4118582ddc44566f015eff00b8039da3bad75f2c1fbfb9fc1dcbec8c18cb3c5790a92882c81fcd00f46a7520ad33e963c9ca91b1a440b45fa30463cd7be4cd4ab555683d27a4c230517a79aaf351a7f0334c67bedeca816bd623fea68f09219c7ec18c506c05cfc91e1223bfb8ae90577044e34935e4483d4aa6c4593b7851cc2157194a33f533b21d9cc3e58c01092766d8133a97d6b58d13f005cd35d1814efcaa985ebb8797fb0753db29550b62bb5cd9b5aa77f54fb921447ee2b671d67e619fce157073b294ef37d231f43ffa4a2343e4d87f9cdcaa75bd05cd22e5019ddef1e0769228c8c206a720903bfb260e7cdd104def618561a02f8e41d346eb6176416854f1c81b26a7d6850e3a3c83aed857ef76717b45e36c8c530d6396857fd2a07bcefd2f57eee3d246d960e7c87a20e917f86275c7b9f6f3ba26c5d2a99350c2f6628c1e337027176a9f009c2925d27af798ceec43a6151c223713d7e05a16af4acc67b4faf91770c2419f39691fe834e41becb866cc341078e575f0a12f08c7848eefe506869d4a1e77acc86ad9eab6c394e454660a098b86666449a3a9587a5940cf9bab4db6cbfbef65d214afd7f2a61ab43224b79c3f2139be988bf0b4c03bf421aa4afe1280db72da168b866b3608158db96e4da48ead94f30626101bdc2c5683583a2151f90111ab4068901e458403cd3d14c830f52d8082ef2e73f77863536a092b0c3a5f8047ba500dd70d06c0b098deb0124489c78a9fdcf34a5c319bddd6187743a78d84df7668d36ae36ed787535e681948dda84b46d1ab31d712cbb233f3bc6edec286096df0c79aacf8b40458a9cb4aff4ce8206575f76a3d2ba8d4dd255b4405151cda3ab07a9a3176dc6a8b21b018c404fddb0ddb91f9c910b6ad3bbab85a36aa3025185e546afa9a7828cea345a98b01179a5c7a121f2e52f4ea38a785b88482367ab70b39d6f5bf38380a50078271b5728af8866e93716343131f84fc42cac0ffd9e84ef0fc35970970d86ae895a5d7d917ea2ce3addd84813c0ac16b8be967733a95fc2d8ce92e16c42d38e64d1257c737e32c8f653ab7a43f8a65391b1c0b1f838ce4aa8a4cac22da48b9c24d50b84137b990cf6e76dc1c31234b729f4a16babbca9a27168e400a1a7ab3c3ed00ac5ba6c57706b15bc3e46aaf1b206ec0686ee4466ce0270ee85fba13b8555d9e6d035a5058523edb154ca6cc74d07321855b225de923d0c12da21a4f2308c8d159238070c02f4c3bad45d999e20f94ea0bde5dc2d555b2e2e00919220374af4df1d0f5f8c2f2a52df0fc054702136cc0f5a0183685a0e49a26ebc2d77c4d9bd4a6ba495198655086408b9fec054a1ff233f711c461a656c8557f30cb8650315242a574ca897ef8c3b925f956def186dfc44e86df5505ce63a118659170cb741770cdd78339a58606436fe65fd8869d190e462c09f8dc6757e0d15872ae1dd65b3d45dd1b17d55f4b87a0448593b7d5cd2c2b1c4e45163aa57ff1aaea9198162df8abadc1f0aa42f2bb978d73b5d514e702be06e72e0725f7dfc6b1a8c4e35164eee9f0d474e0d79f713bc9c43fc58fbc1fb5bdaa5d305f449cc5e4847c8614fce810faff503480015c0b7933c666af5655389ae9432a12bb1334983702fc58719356242f6d062dc4ad933c0ddf715371d4fb3de6bf5c9f9de1f454ae134d13b9a916068d2df0de1042fac9e733c153b0f181f5f9cc3397c762aa17c09c1e0f23ef0e04ed565b70677f03bbeb83e087db8368bed31ef378923be2f49d9b887c87f75eab00f1743321588c510c162850f74dea85e3bd0f9a463f7b7937665af7528c983fb3778b4dcb9bf4f1dc6ef0e7965a172d2c0c130af655f879af6d285caca743164832f2f4be26bcfc6b551d817ea13240aaef7d9371097fc4c65902e86cae39a233779342dc9b1f5117e1df005d837175d57eff2d84c24c8482878c1648fe576f4e79cca73c61cde82ff71cd02bb7a3da942667c2c10b77862df6b3675cb1fcfd12eff586d69f7de4b35871bcc0df789d910f9515152468a6f5623c0fc1752e4c9638fd38b4ea88c1c87f866e9914cb73efb1feb10cb25c49eceffb92acd472f1b529196e440c3b43facf30091a014dd1d943083d50719825be5f332e79ac796081c6c320698e4029f6b1084972280f9431a1d60e5a0c1a63cd59b1fdf6b1963c1d480e96dad2de677f81854d2b499d5da05ace54a34accbf772c9f432a3ccfe1b6ab04d6c41b4e4e58a0f40720fb2d226b4d005696d78b4e6c37ca34f14c79b579507583d6e0efdf9d4cf71cf6b3db429a0fdeeb23aef391ff34b83b3ea2618d8dabde4ab42507d1173a5c5a42741aa5b464b472272e0bb87ac80d4ac8d66565ca3f68597e5899eb3b020b9b691bb8e32b1914ec669d5126a897a9d5aba9d04c1272e7358750ed2de6baf2f92f7633d9aac79842d579cf0d3d4f938357a90fcbc42332ff0e172c9010529f51e8e46e5b35e03cd48279a47346f627a29c70257d3fdf70ccebe4aea5042fb3a40274ea5f20de6661025ee3ef3c44c4c2f2892e9dc2217fe65154d502968eac62ee78a68f0850e0d5f884e99e049e90a93d3a4d8bb3fcca36d3a606b84358b47bc793faa300aa239712a610ebeae01d7cff7fa62e14e08121ae232998649587c181dcd15c7389eabcc2525a2645f84449a88ff28fba265ca986179fd0fff01c4e9555cf8e99a0b6d4a0ad9eb63f3f960901868a63d7a6597298e42a770e97498bebfa160f5447d2da63fd1d5f453eea7749a3beeb5abe5cf18885ee6807889706591d1fa5cb119f6cf7d4d470b472d03af786e58153766fd5a4a362ff045a20be3bfb84a4f12ce5f40b859d5986c4b9fc03e4e1804a2b671274ff5e58cbb7b3e882150eb78dd4f586f0548ba308413f741931c080971d161b4c8b1fac6ec3b35ed7befc1e4fc0d28b99ae9dc2f292215836616a5cb922bf25e134c8e36e35a7abaa8b0b27cebc391ba76bccc41876862d2740f37b69c4cb8d2652cf069cf22990a40f14d8cfeaefdb2ec886f7f116937e731818efa5811fc58ea1b9d9a8cb46709346ec93e9897b00f453d616fd9f34468a653686399e777af0eefbf6563347b7042ea9f5b1d8fcf04a243297afd8cc3bd764b0905fcacba9ba52dcbbab3c5ae12b25e659fa38a97f9f7c16ed9dbfc4d5a8bbaaac51a95c5491fea5ebaa10cc13ae122b99e607e89603b05bdcc712a4e995a0604fe35a85644da471d95b925f2318bbc80d9a5f17ceafc62607f0758d5e925261202974097cd7de81715efa3a6eeb4d0a6b483060ec951c985dfc01470a08e689c14182c0e1a3c53ead1492e3093da4bc9f3df5f6419f86a70fda96d8441bd0084a063f8825ff5511d0f4cb1b89a1129f1359d025ceeb0a410c4b61b51c19d3acd6f94fd0402f04cb1d86"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ipt={0x174, 0x1d, 0x0, 0x0, {{0x8}, {0x94, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x61, 0x6, {0x9, 'security\x00', 0x3, 0x7ff, "9a4e17a9c1231a4a868efb157922b3f08603701db4a08057e130973f4c16deb90e592b784a444d077dfc012fb5e52b4119ce9939760340"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x80}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}]}, {0xba, 0x6, "17460aa9c6d6a622ccf650a0539e2f2d90887be77bb1f82c31c8e00150ab4f35e32f3532f4d0ce5de1b705048ff71b9db71cc082068c8b7aed2776cc66411ec571ce8ee7ee1f2507cba4086b41fedf73c68d7f5a592a87951ffcc679798af91912343f35bb6293373170eb72590ab6b0d0febf8cda16f1fc97ccda69efcdc6bdb0a7f7afe360766143ffab384c135baff41fe31f0fb608a05cc9cf66ba72bf2390f5de423bcd0072fbfcea5cdcf00777d9010454554a"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, {0x21c, 0x1, [@m_ipt={0x218, 0x18, 0x0, 0x0, {{0x8}, {0x124, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x11f, 0x6, {0x101, 'filter\x00', 0x67, 0x7fff, "943c107f635fef3b3e25aff2722735ceac30a15b7676ef1c6a8ccced545d24a2255d49d58e1c7200f697fa46b043e345206ab464ca4d08b5ebd4e3af5c05552366db6ed5738bc370d71a7a58d0f2a7a2b62cbf66e372b8316705cfe854eb11acbb4ab00a28789d58fafc58144ca32a82c5cedb67925d808ef268b2b21708c87363d7337f58ad7e2e2d7bdb5093b13554a000b3563a414bbff4223546cc64ffef17010fe0e5eecebccb43b3eeac7f8055dae15a4221cbd6661efc52d88e1d1d2802217c7b78053e2c3eb7f14d2642ac270e51d8ebfb525b8c7074675a637d0bfb1bfe4051e949fed08f88c5fbd00dd91ec79930e119"}}]}, {0xcd, 0x6, "b82ec959000459d6e643396244f20edc8f641eb6b8575b06f15b04b560d9a078759853824db0f83da70d2f69816a85fcae899cec6aaa51538a1ea1b5dcc33b5f7edc1cbb24aaf4df4cc836dc5449f54cede901d41c7324095ced2e748e31c0627ab97e49d8f9b5b783c65660959657643b66c3a5e77b79eb2ac949a730df87497f97fb5023af926d97ec78aa8f1fcf729a0e54fedec55af52413bf4cf3ecaade7b9f5479a7cc585fa582499e67e9c2c526bd2976ad200ba65f6759b6e555e72ee13ae3e81113cb2d93"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}, 0x2040}}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002700)) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002700)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000002740)=0x800, 0x4) (async) setsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000002740)=0x800, 0x4) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000027c0)={&(0x7f0000002780)='qgroup_num_dirty_extents\x00', r0}, 0x18) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f0000002800)) (async) ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f0000002800)) write$cgroup_devices(r0, &(0x7f0000002840)={'b', ' *:* ', 'rm\x00'}, 0x9) syz_genetlink_get_family_id$nl80211(&(0x7f00000028c0), r0) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000028c0), r0) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000002980)={&(0x7f0000002880)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002940)={&(0x7f0000002900)={0x28, r5, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}, @NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) (async) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000002980)={&(0x7f0000002880)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002940)={&(0x7f0000002900)={0x28, r5, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}, @NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) sendmmsg$alg(r1, &(0x7f00000029c0), 0x0, 0x40004) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname$ax25(r0, &(0x7f0000002a00)={{0x3, @default}, [@netrom, @remote, @rose, @rose, @remote, @rose, @bcast, @rose]}, &(0x7f0000002a80)=0x48) (async) getsockname$ax25(r0, &(0x7f0000002a00)={{0x3, @default}, [@netrom, @remote, @rose, @rose, @remote, @rose, @bcast, @rose]}, &(0x7f0000002a80)=0x48) r7 = accept4$rose(r0, 0x0, &(0x7f0000002ac0), 0x0) sendto$rose(r7, &(0x7f0000002b00)="2ac60e51c6cf19e2f493911d6534eb3d71a4c2139c41f7ef0ccfb443a1c53a5b682389797bb5f8a2dc498fc7154b1ca1460f99c9021fcfa62b9995965e19f4711104e68f0859e3c7a792855a31b1500c8ddbf4437260f54ee4ba034aaf088a5fb33584cb5268bd752f3bffc541beee6247d51f503cd7ce68dc55", 0x7a, 0x20000000, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002d40)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002d00)={&(0x7f0000002bc0)=@gettaction={0x118, 0x32, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x100}, @action_gd=@TCA_ACT_TAB={0x64, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x118}, 0x1, 0x0, 0x0, 0x4000014}, 0x8000) (async) sendmsg$nl_route_sched(r1, &(0x7f0000002d40)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002d00)={&(0x7f0000002bc0)=@gettaction={0x118, 0x32, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x100}, @action_gd=@TCA_ACT_TAB={0x64, 0x1, [{0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x118}, 0x1, 0x0, 0x0, 0x4000014}, 0x8000) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000002dc0)={@empty, 0x0}, &(0x7f0000002e00)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002e40)={{{@in=@private, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000002f40)=0xe8) sendmsg$nl_xfrm(r0, &(0x7f00000030c0)={&(0x7f0000002d80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000003080)={&(0x7f0000002f80)=@newpolicy={0xcc, 0x13, 0x2, 0x70bd2c, 0x25dfdbfe, {{@in6=@empty, @in=@broadcast, 0x4e22, 0x7, 0x4e21, 0x5, 0x2, 0x20, 0x0, 0x3c, r8, r9}, {0x0, 0xcb20, 0x3, 0x3ff, 0x7fffffff, 0x56, 0x7fff, 0x5}, {0x2, 0x2d4, 0x246, 0x7a86}, 0x9e4, 0x0, 0x0, 0x1, 0x3, 0x1}, [@extra_flags={0x8, 0x18, 0x7}, @mark={0xc, 0x15, {0x35075d, 0x100}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) poll(&(0x7f0000003100)=[{r3, 0x80}, {r0, 0x1}, {r6, 0x120}, {r7, 0x4}], 0x4, 0x8f16) ioctl$sock_SIOCBRADDBR(r7, 0x89a0, &(0x7f0000003140)='pimreg\x00') socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000003180)={0x1, [0x0]}, &(0x7f00000031c0)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000003200)={r10, 0xf}, 0x8) 2.856855223s ago: executing program 0 (id=3340): setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000040)=0x7, 0x4) syz_emit_ethernet(0x15, &(0x7f0000000000)={@empty, @empty, @val={@void, {0x8100, 0x4, 0x0, 0x4}}, {@generic={0x8863, "1f7761"}}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c4000000000000000010000000000000000000000000000fe8000000000000000000000000000aaff"], 0x0) recvmmsg(r0, &(0x7f00000012c0)=[{{0x0, 0x0, 0x0}, 0xe}], 0x1, 0x4022, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000000c0)={0x0, 0xa, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000003800018008000600776c630008000800000000000800050000000000080009000000003e6091905875debf6f81e1ef7f601d00060001000a"], 0x4c}}, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000600)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2896733ffc683a5}, 0xc, &(0x7f00000005c0)={&(0x7f0000000280)={0x78, r3, 0x402, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffda}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xe}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x4004840}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000008b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450e002800660000070a9078ace9e548ebc62e43f58972764ded1414bbac1414bb4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50956071907800e7"], 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000400)={@fallback=r1, 0x0, 0x0, 0x10000, &(0x7f0000000300)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f00000004c0)={0x3ff, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000640)=ANY=[@ANYRES32=r6, @ANYRES32=r4, @ANYBLOB="32000000280000000000000042e0fb4dd6d6991db91c521005dd9851e9a4421d1cf210cb73e5ecb523be59517cb6b4737855586d75f72e462f5f2eaaf98d2d230fadb1d38c8cb4b319afd1e78ecf47f01c79af5bc2ffaaed51725574a34934f1461477335374ecca34d9dfc3a861f07f03e1604f6372780542e1a6898fd04c7abeea67a3da0bd128837fbad1d8f9ff24b8764134f055448d674e5f9fb22dc91b519aef5635cd890e5a6b", @ANYRES32=r7, @ANYRES64=r5], 0x20) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r8, 0x0) setsockopt$inet6_int(r8, 0x29, 0xd0, &(0x7f00000001c0)=0x4, 0x4) write$tun(r8, &(0x7f0000000580)=ANY=[@ANYBLOB="000093000a01080006040003aaaaaaaaaabbe00000020000000000007f000030"], 0x20) 1.975509034s ago: executing program 4 (id=3352): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x1c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x97}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) 1.917993318s ago: executing program 3 (id=3354): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000802000021"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800e3ffffff001ad976776941f75f009500000000000000950000fd8bc11b0000000000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) setsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000180)=0x5, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x636a, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000711214000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x24}, 0x94) r4 = socket(0x2a, 0xa, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x4000040, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/99, 0x63}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000001fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000000)=""/77, 0x4d}, {&(0x7f0000000540)=""/162, 0xa2}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r5, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) connect$unix(r6, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) close(r5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x1}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="000000101b12fde600"/20, @ANYRES32=0x0, @ANYRESHEX=r6, @ANYBLOB="0000000000000000c3f51a2e6d162b3b8700"/37], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32=r8, @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB, @ANYRES64=0x0, @ANYRESDEC=0x0, @ANYRESOCT=r8], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) recvmsg$unix(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x22fe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801004800000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r13}, &(0x7f00000006c0), &(0x7f0000000700)=r12}, 0x20) sendmsg$inet(r11, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=':\b', 0x2}], 0x1}, 0x3) sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x1}], 0x1}, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="de", 0x1, 0x4008080, &(0x7f0000000140)={0xa, 0xfffe, 0x0, @private1}, 0x1c) shutdown(r1, 0x1) 1.859586772s ago: executing program 1 (id=3355): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000040)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000000)={&(0x7f0000000580)={0x1d, r1}, 0x10, &(0x7f00000003c0)={&(0x7f0000000140)=@can={{0x1, 0x1, 0x0, 0x1}, 0x7, 0x2}, 0x10}, 0x2, 0x0, 0x0, 0x20004044}, 0x30040898) 1.740889625s ago: executing program 4 (id=3357): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3a, 0x703, 0x270bd24, 0x25dfdbf8, {0xd}}, 0x14}}, 0x4008800) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)={0x3c, r7, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0xacc, 0x78}}}}, [@NL80211_ATTR_STA_AID={0x6, 0x10, 0x227}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0xf9e3}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r5, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r10) getsockname$packet(r10, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x3c, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r11, {}, {0xfff2, 0xffff}, {0xffff, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x74, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0, 0x0, 0x7}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x74}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r13, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r13, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r13, 0x6, 0x1f, &(0x7f00000000c0), 0x4) 1.611320125s ago: executing program 1 (id=3359): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @local, 0x8}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x55007}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_SNOOPING={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x0) close(r7) socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xe, 0xffff}, {0x0, 0xfff1}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x100076}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x1) sendmsg$nl_route_sched(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r10, {}, {0x2, 0xb}, {0xa, 0xfff3}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}}, 0x4008000) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) write$tun(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="0a008841bbbbbbbbbbbbbbbbbbbbbbbb86dd6d101b01001111ff00000000000000000000000000000000ff02000000f9ff0000000000000000014f194e2000119078715c6fd5536167bd28"], 0x4b) socket$can_bcm(0x1d, 0x2, 0x2) socket$kcm(0x10, 0x2, 0x0) 1.553423212s ago: executing program 3 (id=3360): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x439, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e22}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}]}}}]}, 0x40}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000001980), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001980), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r3, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f00000019c0)={0x24, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x24}}, 0x0) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r3, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f00000019c0)={0x24, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x24}}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r7, @ANYRES32=r7], 0x44}}, 0x2000800) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r7, @ANYRES32=r7], 0x44}}, 0x2000800) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000300000000000000010000001801000020756c0000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000009002000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r8, r10, 0x25, 0x0, @void}, 0x10) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r8, r10, 0x25, 0x0, @void}, 0x10) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000140)={@local, @broadcast}, &(0x7f0000000180)=0xc) (async) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000140)={@local, @broadcast, 0x0}, &(0x7f0000000180)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'tunl0\x00', &(0x7f00000001c0)={'ip_vti0\x00', 0x0, 0x8, 0x80, 0x10001, 0xab0d, {{0xe, 0x4, 0x1, 0x35, 0x38, 0x66, 0x0, 0x7, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}, @private=0xa010101, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x1f, 0x7f, [@multicast1, @loopback, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @rand_addr=0x64010100, @remote]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'tunl0\x00', &(0x7f00000001c0)={'ip_vti0\x00', 0x0, 0x8, 0x80, 0x10001, 0xab0d, {{0xe, 0x4, 0x1, 0x35, 0x38, 0x66, 0x0, 0x7, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}, @private=0xa010101, {[@ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x1f, 0x7f, [@multicast1, @loopback, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @rand_addr=0x64010100, @remote]}]}}}}}) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)={0x148, r4, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x15}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xc}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1c}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}]}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x39a5580e0b9bf81b}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffffc055}]}, 0x148}, 0x1, 0x0, 0x0, 0x2000c000}, 0x0) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)={0x148, r4, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x15}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xc}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1c}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r11}]}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x39a5580e0b9bf81b}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffffc055}]}, 0x148}, 0x1, 0x0, 0x0, 0x2000c000}, 0x0) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r15, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r14, @ANYBLOB="04005b0006006500"], 0x28}, 0x1, 0x0, 0x0, 0x20000c00}, 0x0) 1.37540021s ago: executing program 4 (id=3362): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000100)={'broute\x00', 0x0, 0x4, 0x7e, [0x1a2, 0x0, 0x6, 0xfffffffffffffff9, 0x7], 0x6, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000080)=""/126}, &(0x7f0000000180)=0x78) (async) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast2, @empty}, &(0x7f0000000200)=0xc) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a320000000008004300736977001400330077673100"/56], 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x100) 1.259273177s ago: executing program 3 (id=3364): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 64) r2 = socket$unix(0x1, 0x1, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async, rerun: 64) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (rerun: 64) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_DF={0x5, 0xd, 0x1}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0x17c, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x13c, 0x8, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x50, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x6}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "491bc0be1dc1f88092e741a88b64f6dd9218ad21b44b472e44f1d0807ee6675c"}]}, {0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x9, 0x7, @empty, 0x3}}, @WGPEER_A_ALLOWEDIPS={0x24, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x3}}]}, {0x4}]}]}]}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r3}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0xe, 0xfff1}, {0xffff, 0xd}, {0x0, 0x2}}, [@TCA_RATE={0x6, 0x5, {0xfc, 0x7f}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000014}, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x1, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) (async, rerun: 32) r9 = socket$kcm(0x11, 0x3, 0x0) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x15, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000fcff2000000000000034e58085000000a0000000850000009e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0x100b, &(0x7f0000001680)=""/4107}, 0x90) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) (async) close(r10) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$sock_attach_bpf(r9, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r3, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0xffc8}], 0x2}, 0x4) 1.215069988s ago: executing program 4 (id=3365): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], &(0x7f0000000100)=""/141, 0x46, 0x8d, 0x1, 0x7}, 0x28) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, 0x0, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000440)=ANY=[@ANYRESOCT=0x0, @ANYRES32, @ANYBLOB="d52b31fbd08f24ad140b1440d9929c5b6c79be208ff39ce924aa5691405132af1869a18448d54b9272ede5e39483dd48ace9d75b913b209e4fa83db25a30d38bbd701c3320b648f26f34637e36adbc0b3c62439b1de9442cab3efe3af6a64fab143c3038b135c4d88bec6c7288aae4eebcbe4918e69e42cb88f77391e1ec0c0867d556b12189476328ce9148f3c89cc7e845d426d1ed66dfa3396ef334a15d2db0685f0df4b3726ab05ebaa817f540ed2d341174cf0457ccf4abde629e5df70d129dc8510e98d035215b"], 0x68}, 0x1, 0x0, 0x0, 0x24}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000040)={'geneve0\x00'}) write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x72) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], &(0x7f0000000100)=""/141, 0x46, 0x8d, 0x1, 0x7}, 0x28) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) (async) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, 0x0, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000440)=ANY=[@ANYRESOCT=0x0, @ANYRES32, @ANYBLOB="d52b31fbd08f24ad140b1440d9929c5b6c79be208ff39ce924aa5691405132af1869a18448d54b9272ede5e39483dd48ace9d75b913b209e4fa83db25a30d38bbd701c3320b648f26f34637e36adbc0b3c62439b1de9442cab3efe3af6a64fab143c3038b135c4d88bec6c7288aae4eebcbe4918e69e42cb88f77391e1ec0c0867d556b12189476328ce9148f3c89cc7e845d426d1ed66dfa3396ef334a15d2db0685f0df4b3726ab05ebaa817f540ed2d341174cf0457ccf4abde629e5df70d129dc8510e98d035215b"], 0x68}, 0x1, 0x0, 0x0, 0x24}, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) (async) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000040)={'geneve0\x00'}) (async) write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x72) (async) 724.666325ms ago: executing program 1 (id=3367): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x10, 0x4, 0x8, 0x2}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xa, 0x18, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @map_fd={0x18, 0x6, 0x1, 0x0, r0}, @jmp={0x5, 0x0, 0x9, 0x7, 0x7, 0xfffffffffffffff4, 0xffffffffffffffff}, @func={0x85, 0x0, 0x1, 0x0, 0x8}], {{}, {}, {0x85, 0x0, 0x0, 0xce0f9cc5503e1e43}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 602.976819ms ago: executing program 3 (id=3368): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x44, r1, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_RETRY_LONG={0x5, 0x3e, 0xd7}, @NL80211_ATTR_TXQ_MEMORY_LIMIT={0x8, 0x10b, 0x7ff}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xffff}, @NL80211_ATTR_TXQ_LIMIT={0x8, 0x10a, 0x8}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x40}, @NL80211_ATTR_WIPHY_TX_POWER_SETTING={0x8, 0x61, 0xff}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x24008054) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) sendmmsg$inet6(r2, &(0x7f0000000e80)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x59, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000040)="384a65867c0fd28e93ae5d18f6a4cbf3933dd23f6bc219e4e01d11376f1cd24d8e853d325e33355640124857aa4a539d8c4fec45e7516a6852f2216099b9aa", 0x3f}, {&(0x7f0000000080)="10ecca6171e97d0165bc34939ae524a802a7608b4df8adb0b8be61df4f4c03553a66b189476e284bd5852ca94087a61ee3077198789832c0498575824a7d18eb0f568cf066b5446f9890b7874b6083398d1cfb73dada4c843d32833c40d61fb503fe6b39d724471b64c68ae9a402555e6b34c98790697a362180a87e83ac5de97f9928ecaa8647a45a564033725dff0ea64978f7ed61de587254c4710e46ccad1a961ae43bb3957368fc4b160c66f3ce91bfea44b30ffaf883588312b5502c14c21283", 0xc3}, {&(0x7f0000000180)="fec75180c072eb6d20631f7ca298b7ad98ad7b6e74d1eda20da0a3b9ea81dbde7617621bc5ffaa5fa00659a63d5c9d57f369eba262b32efe4c6c9b4cf51ec13338d99217eafaa02f05b8ed36efaf81d71e1254eae8e82151ab82d22c11170062e3e9cdc6627da531094c0ab7bc986aa8eaba0c061293677f95d4406417513e7e039e178918aecee10454389b8671dc900dfa753452186a157de9c3237d34ec60163d7a7d7403b9c5eb9b4c8f3a62792ae8f7e6abf5c5d331e8ea10bf293715008d6dba9978c011a81547a13c9f9a4595a3ec452e", 0xd4}], 0x3, &(0x7f00000002c0)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x10}}, @hopopts={{0x28, 0x29, 0x36, {0x0, 0x1, '\x00', [@pad1, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}]}}}, @rthdrdstopts={{0x28, 0x29, 0x37, {0x6, 0x1, '\x00', [@padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x8000}]}}}], 0x68}}, {{&(0x7f0000000340)={0xa, 0x4e24, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000380)="ea2ab2b41b3b2cee61cd9dadb8df779e8b20f019d7285157f6a15d774403a4ea34d37ca1fa561f34096fa5c33a8e77f4056162ea90672e6a856109ea73e8586b78766822ec39d8796b3e6946c13e15857c2a4b8fb4dbb48e7dc13dee2bfce07ff4213de334cb34b6467f69ebf1efabba3212b7506530f3ce811927b681b9907025ff", 0x82}, {&(0x7f0000000440)="b961a5154102fcf85a5a9272b6aac8ecfe8ebd809024aeca2d9911cefbdc5dc450bd1b2502fe1881d1a176bd7d1355364d7a4fccf18257a1cf48c0d7f2301cc23d2993249e2d2d055089053c7dfdb6a8f3f96e6c7e8d0fe21cce779d1a807c7f98912918c04454a725aef5d7a3873dd170eaf89b3474a7750f3c72da2b29a550653dcf912495e2639cc0cadd406ae627783b3b94aa45949b19bdcf10e0e461281ef5fe728dbc41b3f8991752311f93ad6049eec6c859e97649886f785ee4749fe09342", 0xc3}, {&(0x7f0000000540)="b8c147e71fbdf837da0e595a3b99e7e001fd6fd6c200ea9f1c7d56e9553137acbec90972f8e210e63c8e946c3a10edbdc68849e215a6d5756b7f637d606ace0e4577b5f16a033ceaabe2f2bf1a924b30b27ecf796de75d9f92e93ea9118faca23baf2d1082de955d5a03f55a0a25ddbe978329bb5c82c38fa6bcb5e24e903108d39620d3e7d7600bdeeaa4427eccc0249f0a965d837a70cf1620bd70e2318ffbc1fb43330bf11b8f843645832c76a7faa7cdd20da6dc83984d110359d4095b5dabbd759da92d74a4e9b7f87b8570cec33028f93fad100b9cfd5c5c579dcc2fb287168e79", 0xe4}, {&(0x7f0000000640)="1fa6d39c32b6d88d5dbca98d6b7515a65e8c2847904899e6adffacb20333f09f2c9e5384f11eaf2152fa31e8cad14a6fad52163a48bb08369599e0740d62e3f1047745ceaedff68eaef1c26df3a6cb5f", 0x50}, {&(0x7f00000006c0)="adc976a9b5b0f754ff3ee87608bf05d2adcd03c174b9822ed0206ae06b5fd6e5ba6c2b58fb91f2f09355f69832ed536e9ecc27d3cd9acd378fac05a41c79922537aca18a8fc9b0862ee4ee6f3a14f5d7b0836467b7e78a8d2791f9e688a2ce984c4957bfcfbd1df96528cf3a2438bc14ae7af073563ec6ee95540206ce7954d5f360a92f74bf7c796f48cb23efd8cf9b8b52", 0x92}], 0x5, &(0x7f0000000f40)=ANY=[@ANYBLOB="1400000000000000290000004300000001800000000000001400000000000000290000003e000000030000000000000078000000000000002900000039000000320c010400000000fe8000000000000000000000000000bbfe80000000000000000000000000003afe800000000000000000000000000020fc02000000000000000000000000000100000000000000000000000000000000fe8000000000000000000000000000aa1400000000000000290000004300000000000000000000005800000000000000290000003600000062070000000000000728000000000808030001040000000000000100000000000000000000000000008004000000000000000710000000010207fa0ad2080000000000000401040050000000000000002900000036000000870600000000000006303ff5051339fd8f61c75655e0374f6aaa57f4fd5e7f8b64d6aa878f158a5807269271bd8e475551fa68438bc3e4a59359000000000000af7af3fd5eb5facc7fed86f433205e3fc59621440c10e1c7a765ce3ce01beccb5527598d5cf3a4ad5054336f3eccb2c7b26460de305127bd31b59f4f5084b06e83c4581ee2"], 0x168}}, {{&(0x7f0000000980)={0xa, 0x4e21, 0x1f, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c, &(0x7f0000000b80)=[{&(0x7f00000009c0)="edf4ff18339864287c492ffd8687ee0b42a534cccb8fb39695847ed9e357cf5f491f4fed0cd5a73d7c0b695f5860473d065fdd3579ebfa23e2016039fc53181b3ad9d7eff7324fd203e3c1923bf171c5afd6effe5fc6b1eaf53256e74887dab94c97ab9153530303fd757f16c45106752cb0d6a0c3b3aeb2b23022ef420c18d5e1be2c42106e626e26c9c7f1a5aeca7079", 0x91}, {&(0x7f0000000a80)="9bec35771aa6d2253575ec014bd94410605673f9d0e4d7859e1beda15e6393e63a4d106a5da878fbfe3ca8d3dd036f2a3946e5af95395837eb8b0d714ed2ca5053eec76bebb5ef081b733f3ea9513851ba9383e978402757d262edf82b2f60e9710096a7193f2d82bfd734e172d041696a421a2d26c0c6e493d638e3c97da105bc4f11f64db4f6d08715509e91718a223b05a3a86e4508e3419a3f59ec70b048d4957876d5c955c01f271d65366b88ac709e24b738917c51ac5291df0acf2ed9f6c5aca3a8f6446bc1afb1ed3e1f1fba22", 0xd1}], 0x2, &(0x7f0000000bc0)=[@rthdr={{0x28, 0x29, 0x39, {0x1, 0x2, 0x2, 0x0, 0x0, [@loopback]}}}, @rthdr={{0x48, 0x29, 0x39, {0x33, 0x6, 0x0, 0xff, 0x0, [@ipv4={'\x00', '\xff\xff', @local}, @local, @private2]}}}, @tclass={{0x14}}, @rthdr={{0xb8, 0x29, 0x39, {0x62, 0x14, 0x2, 0x3, 0x0, [@loopback, @private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast1}, @private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}, @local, @private2, @ipv4={'\x00', '\xff\xff', @multicast2}]}}}, @flowinfo={{0x14}}, @hopopts={{0xb8, 0x29, 0x36, {0x6c, 0x13, '\x00', [@generic={0x7f, 0x86, "c1ee991610e2cfdf2f21f3798e68c2401f3f4c884704d759353395f9d4c4433a26974aa29284d87db4c44313629cb97304301b47a8181de026b45fcf6aa199fab515e620ab3601c256f616b8989e996b01447ea5c9fd372c3031630fa95952aa3e98d94a5646b2f65185eec2e37fd30ae862715bed28edd8f4caf2afbbf49372ecea49d6e533"}, @calipso={0x7, 0x10, {0x1, 0x2, 0x3, 0x924, [0x4e]}}]}}}, @dstopts={{0x38, 0x29, 0x37, {0x0, 0x3, '\x00', [@hao={0xc9, 0x10, @empty}, @jumbo={0xc2, 0x4, 0x53}, @pad1, @enc_lim={0x4, 0x1, 0xf0}]}}}, @dstopts={{0x48, 0x29, 0x37, {0x0, 0x6, '\x00', [@pad1, @hao={0xc9, 0x10, @remote}, @pad1, @hao={0xc9, 0x10, @mcast1}, @jumbo={0xc2, 0x4, 0xefa}]}}}, @tclass={{0x14, 0x29, 0x43, 0x5}}], 0x2a8}}], 0x3, 0x45) 601.900639ms ago: executing program 2 (id=3369): bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="8500000031000000760000000000000027000000000004009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8}, 0x23) (async) r0 = accept4(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000100)=0x80, 0x800) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x84, r1, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x42}, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xe, 0x29}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'virt_wifi0\x00'}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'gre0\x00'}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4) (async, rerun: 32) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) (async, rerun: 32) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000024"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) (async, rerun: 64) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x2, 0x1}, 0x50) (rerun: 64) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/176}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000380)={r3, &(0x7f0000000300), &(0x7f0000000340)=""/55}, 0x20) (async) ioctl$sock_ifreq(r0, 0x8930, &(0x7f0000000140)={'ipvlan1\x00', @ifru_names='veth1_virt_wifi\x00'}) 593.115371ms ago: executing program 1 (id=3370): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) listen(r0, 0x3) r1 = socket(0x11, 0x5, 0x8000) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000200)=0x8) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_OCB(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x400, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x23}, @NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xe759}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x4) 568.818237ms ago: executing program 4 (id=3371): r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x23, 0x0, &(0x7f0000000400)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket(0x200000000000011, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=@newtfilter={0x44, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xd, 0xf}, {}, {0x10, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_IP_TTL={0x5, 0x52, 0x9f}, @TCA_FLOWER_KEY_ENC_IP_TTL_MASK={0x5, 0x53, 0xa}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x80) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "1e1c"}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x61ca0, 0x1}, 0x50) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d8000000100081044881f782db44b904021d080b01000000000000001800150006001500000000120800030043000000a800160037fcb659362e2e55e799aac5525ffa000400c020db2d47782a462c9c801f298225c506000d00036010fab94dcf1c0461c1d67f6f94007134cf66e08000a0e40852a9d7c7c0b7c4a700002a76549eae02ede8359f79d073d37af66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d9308e56539322fe7c0aaa27e8ddc64193071e9f8775730d16a4683f1aeb4edbb5", 0xd8}], 0x1}, 0x8040) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2b, 0x25dfdbfd, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}]}}}]}, 0x38}}, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r10, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 418.387939ms ago: executing program 1 (id=3372): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xffffffffffffffff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x48}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x43}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 418.049983ms ago: executing program 2 (id=3373): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) (async) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="300000001800ef01000000004d8000000a150000fe010000002400001400050000000000000000000000000000000001"], 0x30}, 0x1, 0x11}, 0x20000080) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, &(0x7f0000000300)) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000000)=0x55a, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) (async) shutdown(r0, 0x1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r3, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}}, 0x20}}, 0x4000054) (async, rerun: 32) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r3, 0x100, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) (rerun: 32) 415.829348ms ago: executing program 3 (id=3374): syz_emit_ethernet(0x72, &(0x7f0000000400)={@local, @broadcast, @val={@void}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private, @multicast2, {[@cipso={0x86, 0x2a, 0x1, [{0x0, 0xd, "5e000000ff000000000000"}, {0x0, 0x5, "4eb8a6"}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x3}]}}}}}}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000380)=ANY=[@ANYRESDEC=r0], &(0x7f0000000080)='GPL\x00', 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)="e00cbd73001a000000000000a9a8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000007c0)={'rose0\x00', 0x112}) (async) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x30, 0xcf, 0x5, 0xfffff000}, {0x6}]}) 323.421231ms ago: executing program 2 (id=3375): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0xfffffe37}], 0x1}, 0x40004) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'veth0\x00', 0xff7f}) 223.295424ms ago: executing program 1 (id=3376): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x1b}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {0xffff, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x7, 0x8, 0x0, 0x2}, 0xfffffffe, 0x1, 0xffffffff, 0x0, 0xe9, 0x14, 0xc, 0xc, 0x0, 0x7, {0x4, 0xffff, 0x8, 0x3, 0x3, 0xffffffff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r7, 0x1, 0xd8}, 0x14) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r0, @ANYBLOB="06001500030000000c001680080001"], 0x38}}, 0x50) 222.975181ms ago: executing program 2 (id=3377): syz_emit_ethernet(0x5a, &(0x7f0000000240)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0xe, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x1d, 0x12, "d285b6853bc4dc54c6910c1d66f8841a"}, @md5sig={0x1d, 0x12, "adf059fd789278e2fb03dc15d356998a"}]}}}}}}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20008050}, 0x4814) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0xfffffffffffffff8, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0x1, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x48, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x8, 0x3}, @TCA_SKBEDIT_PTYPE={0x6, 0x4}, @TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc, 0x9, {0x47}}}}]}]}, 0x70}}, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x453, 0x4, 0x70bd27, 0x25dfdbfc, "d98b8d359ef78c9525e8cd0455fd41ca1181c3cbd9a0eb3005e40381991c6c8574bfdd952fd6ff208e1e36f28aa88ae79b"}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL802154_CMD_SET_CCA_MODE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x20000) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x35, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000018000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010000000000000000000000000000006050001"], 0x4c}, 0x1, 0x0, 0x0, 0x95}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4000000000016000f1000000000000063000000000000009500050000000000", @ANYRESDEC, @ANYRES32=r3, @ANYRES8=r3], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000380)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 132.386938ms ago: executing program 2 (id=3378): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000540), r0) (async) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x17, 0x0, 0x9, 0x8, 0x0, 0x0, 0x0, [@sadb_x_nat_t_type={0x1, 0x14, 0x3}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x32, 0xc82a5d8ed78858bf, 0x0, @in={0x2, 0x4e21, @local}}]}, 0x40}}, 0x0) (async) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000840)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000880)=ANY=[@ANYBLOB="8016ff2de03afeab1d4b0a998b276d7119fe2ce5394d5df91c19d3f2acc1c7a4c256fc9aa1b2", @ANYRES16=r1, @ANYBLOB="01002abd7000fbdbdf2502000000080001000000000008000100010000000800020002000000080002000200000008000100000000000800010002000000"], 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x1) (async) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r4, &(0x7f0000000040)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000240)="d2a7b3", 0x3}, {&(0x7f0000000400)="e06bd3f745", 0xfcfd}, {&(0x7f0000000500)="86e9a0d8", 0x4}, {&(0x7f00000005c0)="25062456", 0x4}], 0x4}}], 0x1, 0x4000800) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000a40)={0x1, &(0x7f0000000a00)=[{0x9, 0x22, 0x3, 0x7}]}, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LIST(r3, &(0x7f0000000980)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x2c, r1, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x2c}}, 0x1) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f0000000000)={0x40}, 0x4) (async) sendto$inet6(r5, &(0x7f0000000500)="a4", 0x34000, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) (async) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r6, &(0x7f00000002c0)="f9", 0x1, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private0}, 0x1c) (async) shutdown(r6, 0x1) (async) r7 = accept4$x25(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000180)=0x12, 0x80000) ioctl$SIOCX25SSUBSCRIP(r7, 0x89e1, &(0x7f0000000300)={'nicvf0\x00', 0xffffc00000000000}) (async) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(twofish))\x00'}, 0x58) (async, rerun: 32) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async, rerun: 32) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x34, 0x40, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x84;'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x16, 0x0, 0x1, [@typed={0x6, 0x136, 0x0, 0x0, @str='\x84;'}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) r10 = accept4(r8, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_NEW_STATION(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200029bd7000fbdbdf251300000008000300", @ANYRES32=0x0, @ANYBLOB="1200e400a8a2fc642affd8f9877e7ef1eab80ff02f776cb46d93f8248a6e113cb0fe98463c3d56898bceaa8372d2e7ef5e6e0a84a2ab1364320e07d24354bcd9f6b75b600419ec872d82e0cca2e3ac46d8e3c07e3cb493c13541dcc5cfbcf7eb64017137c7b4aecca15a2ea48d03d8d1d7f29aa850ca3837449661977ddb172a58e2d41b4954e579c69abf88dcdc39c3ea2f04234b72e5ca6b20e4d5083192a48ae69ea0f2328d41397f6fd1ed5f82a870561ae79c5dafb7857b55e1c933fafba13130b5f4cce62a766c24f486abc0c1dd0241b87ea72a1e3a102a6d21258fbb0bfc0d92c3a0f0757024b554633b238f44469b1a794a9d95d0347ca6461b994f86fa9341f8e848be7f8842066f270f040ef0a03d8cb5a0a23ccabdd21c092de5c9a11569471d0d66709803217ef782d36131c2c799230492b6a3755b335156eaf017010e6c8ab6055112f600ea303e7082ad923d9daa741a2383f6bb37e91fa97922c650d83a0ba272d0aaa8fca79ce0015048df6bb22f"], 0x24}, 0x1, 0x0, 0x0, 0x20000050}, 0x20000000) (async) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), r10) (async) bpf$TOKEN_CREATE(0x24, &(0x7f00000007c0)={0x0, r7}, 0x8) 85.927596ms ago: executing program 3 (id=3379): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f00000000c0)=0x1, 0x4) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) (async) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x2c, 0x2e, 0x1, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}, {0xfff2, 0x7}}, [{0x8, 0xb, 0xfffffffc}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc001}, 0x4041080) 11.41389ms ago: executing program 2 (id=3380): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@getqdisc={0x24, 0x26, 0x1, 0x2, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0xe}, {0x1, 0x6}, {0x3, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000900)=ANY=[@ANYBLOB="8c0000001000370400"/20, @ANYRES32, @ANYBLOB="00000000000000006c0012800e00010069703665727370616e000000580002801400060020010000000000000000000000000002050016000100000014000700fc0200000000000000000000000000000400120005000800", @ANYRES32=0x0, @ANYBLOB="080004"], 0x8c}}, 0x48001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 0s ago: executing program 4 (id=3381): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000400007012bbd7000fedbdf250400c28004000180040008"], 0x20}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r2 = socket(0x1e, 0x1, 0x0) setsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x8a, &(0x7f0000000040)=0x7e, 0x4) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000001a40)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0x98, 0x8, 0xfa04, 0x1b0, 0x6c02, 0x1b0, 0x194, 0x194, 0x1b0, 0x194, 0x3, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x32}, 0x0, 0x0, 'veth0_to_hsr\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'vlan0\x00', {}, {}, 0x0, 0x1, 0x44}, 0x0, 0xb0, 0x118, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x4, 0x5, 0x3, 0x1, 0x2, 0x4], 0x4}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x5, 0x1, 0x9, 'syz0\x00', 'syz1\x00', {0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a8) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@ipv4_delroute={0x4c, 0x19, 0x901, 0x70bd29, 0x80, {0x2, 0x18, 0x10, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @private0}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) kernel console output (not intermixed with test programs): with an up link [ 201.554418][T10976] netlink: 'syz.4.1378': attribute type 26 has an invalid length. [ 201.594622][T10975] netlink: 'syz.1.1379': attribute type 30 has an invalid length. [ 201.671137][T10975] bond4: option arp_missed_max: invalid value (0) [ 201.680437][T10975] bond4: option arp_missed_max: allowed values 1 - 255 [ 201.742136][T10975] bond4 (unregistering): Released all slaves [ 202.690743][T11022] __nla_validate_parse: 13 callbacks suppressed [ 202.690763][T11022] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1389'. [ 202.699200][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 202.836382][T11016] bond4: (slave ip6gretap1): making interface the new active one [ 202.855652][T11016] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 202.881811][T11016] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 202.891400][T11016] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 203.171456][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.188427][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.206037][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.275870][T11030] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 203.324000][T11030] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 203.421307][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.437307][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.446562][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.471032][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.492678][T11030] hsr0 speed is unknown, defaulting to 1000 [ 203.682142][T11062] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1402'. [ 204.450290][T11090] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 205.260142][T11113] syzkaller0: entered promiscuous mode [ 205.265680][T11113] syzkaller0: entered allmulticast mode [ 205.583433][T10872] Set syz1 is full, maxelem 65536 reached [ 205.640970][T11128] validate_nla: 1 callbacks suppressed [ 205.640992][T11128] netlink: 'syz.3.1422': attribute type 2 has an invalid length. [ 205.697095][T11128] 9: entered promiscuous mode [ 205.737136][T11133] netlink: 232 bytes leftover after parsing attributes in process `syz.0.1424'. [ 205.798884][T11136] netlink: 'syz.2.1425': attribute type 1 has an invalid length. [ 205.832423][T11138] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1424'. [ 205.854572][T11139] netlink: 1196 bytes leftover after parsing attributes in process `syz.1.1426'. [ 205.872941][T11133] batadv0: left allmulticast mode [ 205.880267][T11133] batadv0: left promiscuous mode [ 205.910725][T11133] bridge0: port 3(batadv0) entered disabled state [ 205.929507][T11133] bridge_slave_1: left allmulticast mode [ 205.958395][T11133] bridge_slave_1: left promiscuous mode [ 205.965521][T11133] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.985938][T11133] bridge_slave_0: left allmulticast mode [ 205.992318][T11133] bridge_slave_0: left promiscuous mode [ 205.999225][T11133] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.091694][T11142] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 206.342463][T11162] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1436'. [ 206.387490][T11164] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 206.591919][T11170] vlan2: entered promiscuous mode [ 206.859908][T11190] bond7: option min_links: invalid value (18446744073709551614) [ 206.875905][T11190] bond7: option min_links: allowed values 0 - 2147483647 [ 206.887035][T11190] bond7 (unregistering): Released all slaves [ 206.945784][T11197] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1444'. [ 207.015995][T11197] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 207.060137][T11197] bond3 (unregistering): Released all slaves [ 207.226878][T11200] bond3: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 207.295828][T11200] bond3 (unregistering): Released all slaves [ 207.934395][ T50] nci: nci_rsp_packet: unsupported rsp opcode 0xf06 [ 207.954117][ T50] nci: nci_rsp_packet: unsupported rsp opcode 0xf06 [ 207.979259][T11270] !: renamed from bond_slave_0 [ 208.851415][T11307] netlink: 'syz.2.1466': attribute type 11 has an invalid length. [ 208.870089][T11307] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.1466'. [ 209.117504][ T30] audit: type=1800 audit(1762739805.545:3): pid=11321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1472" name="memory.events" dev="tmpfs" ino=1451 res=0 errno=0 [ 209.172635][ T30] audit: type=1804 audit(1762739805.555:4): pid=11321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1472" name="/newroot/284/memory.events" dev="tmpfs" ino=1451 res=1 errno=0 [ 209.652882][T11354] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1478'. [ 209.686200][T11351] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1477'. [ 210.001755][T11368] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1481'. [ 210.317863][T11389] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1487'. [ 210.400387][T11396] netlink: 'syz.4.1488': attribute type 1 has an invalid length. [ 210.414934][T11396] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1488'. [ 210.956777][T11426] tipc: New replicast peer: 255.255.255.255 [ 210.970430][T11426] tipc: Enabled bearer , priority 10 [ 211.074750][T11430] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1494'. [ 211.088129][T11430] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1494'. [ 211.116914][T11434] tipc: Enabling of bearer rejected, failed to enable media [ 211.127213][T11433] netlink: 356 bytes leftover after parsing attributes in process `syz.3.1495'. [ 211.267447][T11441] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1497'. [ 211.313943][T11443] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.369515][T11447] gretap0: entered promiscuous mode [ 211.380723][T11447] 0{X: renamed from gretap0 [ 211.410950][T11447] 0{X: left promiscuous mode [ 211.416062][T11447] 0{X: entered allmulticast mode [ 211.455549][T11447] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 211.868432][T11480] netlink: 'syz.2.1509': attribute type 1 has an invalid length. [ 211.949974][T11480] 8021q: adding VLAN 0 to HW filter on device bond3 [ 211.980946][ T5833] Bluetooth: hci0: command 0x0406 tx timeout [ 211.987128][ T5833] Bluetooth: hci2: command 0x0406 tx timeout [ 211.994089][ T5833] Bluetooth: hci1: command 0x0406 tx timeout [ 212.000492][ T5833] Bluetooth: hci3: command 0x0406 tx timeout [ 212.037274][T11493] bond3: (slave veth3): Enslaving as an active interface with a down link [ 212.238228][T11514] x_tables: duplicate underflow at hook 2 [ 212.344214][T11493] veth5: entered promiscuous mode [ 213.049609][T11551] batman_adv: batadv0: adding TT local entry ba:e1:05:00:07:00 to non-existent VLAN 1280 [ 213.321319][T11570] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 214.070050][T11605] netlink: 'syz.0.1545': attribute type 23 has an invalid length. [ 214.099605][T11606] netlink: 'syz.0.1545': attribute type 23 has an invalid length. [ 214.450684][T11623] tipc: Enabled bearer , priority 0 [ 214.472465][T11623] syzkaller0: entered promiscuous mode [ 214.501198][T11623] syzkaller0: entered allmulticast mode [ 214.525134][T11623] __nla_validate_parse: 9 callbacks suppressed [ 214.525155][T11623] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.1552'. [ 214.584874][T11629] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 214.600325][T11623] tipc: Resetting bearer [ 214.627622][T11621] tipc: Resetting bearer [ 214.649069][T11621] tipc: Disabling bearer [ 214.822624][T11642] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1558'. [ 214.948498][T11648] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1559'. [ 214.966583][T11646] hsr0 speed is unknown, defaulting to 1000 [ 215.003319][T11649] bridge3: entered promiscuous mode [ 215.011886][T11649] bridge3: entered allmulticast mode [ 215.044564][T11650] bridge4: entered promiscuous mode [ 215.050364][T11650] bridge4: entered allmulticast mode [ 215.238572][T11658] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1563'. [ 215.389270][ T24] IPVS: starting estimator thread 0... [ 215.395207][T11662] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 215.524819][T11668] IPVS: using max 25 ests per chain, 60000 per kthread [ 215.704594][T11683] dvmrp6: entered allmulticast mode [ 215.772727][T11685] netlink: 'syz.2.1568': attribute type 29 has an invalid length. [ 216.122722][T11696] xt_TPROXY: Can be used only with -p tcp or -p udp [ 216.132410][T11695] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1573'. [ 216.144529][T11696] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1575'. [ 216.510789][T11715] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1581'. [ 216.551909][T11718] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1582'. [ 216.610067][T11721] netlink: 'syz.0.1583': attribute type 27 has an invalid length. [ 216.755659][T11734] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1586'. [ 216.767837][T11729] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1583'. [ 216.778441][T11737] netlink: 'syz.0.1583': attribute type 27 has an invalid length. [ 217.428879][T11761] syzkaller0: entered promiscuous mode [ 217.447977][T11761] syzkaller0: entered allmulticast mode [ 217.574738][T11764] tipc: Enabled bearer , priority 0 [ 217.587210][T11770] tipc: Enabling of bearer rejected, already enabled [ 217.716614][T11760] tipc: Resetting bearer [ 217.793244][T11760] tipc: Disabling bearer [ 218.180308][T11809] block nbd1: Unsupported socket: should be TCP or UNIX. [ 218.392753][T11820] block nbd3: NBD_DISCONNECT [ 219.062613][T11861] netlink: 'syz.2.1622': attribute type 10 has an invalid length. [ 219.142886][T11861] team0: Port device geneve0 added [ 219.204986][T11863] ieee802154 phy0 wpan0: encryption failed: -22 [ 219.281885][T11863] bond0: entered promiscuous mode [ 219.305369][T11863] bond_slave_0: entered promiscuous mode [ 219.329118][T11863] bond_slave_1: entered promiscuous mode [ 219.362546][T11863] batadv0: entered promiscuous mode [ 219.385501][T11863] debugfs: 'hsr0' already exists in 'hsr' [ 219.403355][T11863] Cannot create hsr debugfs directory [ 219.411053][T11863] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 219.422520][T11863] hsr0: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 219.434338][T11863] 8021q: adding VLAN 0 to HW filter on device hsr0 [ 220.019062][T11898] 8021q: adding VLAN 0 to HW filter on device bond7 [ 220.322052][T11914] tipc: Enabled bearer , priority 0 [ 220.332837][T11914] syzkaller0: entered promiscuous mode [ 220.338630][T11914] syzkaller0: entered allmulticast mode [ 220.355854][T11914] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 220.424508][T11925] __nla_validate_parse: 10 callbacks suppressed [ 220.424527][T11925] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1634'. [ 220.460087][T11914] tipc: Resetting bearer [ 220.478198][T11922] syzkaller1: entered allmulticast mode [ 220.494080][T11911] tipc: Resetting bearer [ 220.512587][T11911] tipc: Disabling bearer [ 220.556740][T11930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1639'. [ 220.567657][T11930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1639'. [ 220.690590][T11931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1640'. [ 220.728036][T11931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1640'. [ 220.739581][T11931] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1640'. [ 220.875286][T11944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1645'. [ 221.181508][T11958] erspan0: entered promiscuous mode [ 221.188753][T11961] nbd: couldn't find device at index 61440 [ 221.320909][T11973] netlink: 'syz.3.1656': attribute type 10 has an invalid length. [ 221.325560][T11974] netlink: 'syz.1.1654': attribute type 178 has an invalid length. [ 221.353620][T11972] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 221.719144][T11998] bond0: mtu less than device minimum [ 221.848308][T12004] netlink: 'syz.3.1665': attribute type 83 has an invalid length. [ 221.876338][T12004] netlink: 'syz.3.1665': attribute type 83 has an invalid length. [ 221.937240][T12000] hsr0 speed is unknown, defaulting to 1000 [ 222.140260][T12021] netlink: 'syz.3.1668': attribute type 10 has an invalid length. [ 222.258584][T12024] tipc: Enabled bearer , priority 0 [ 222.279027][T12025] syzkaller0: entered promiscuous mode [ 222.286449][T12025] syzkaller0: entered allmulticast mode [ 222.656221][T12023] tipc: Resetting bearer [ 222.712061][T12023] tipc: Disabling bearer [ 222.866536][T12041] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1676'. [ 223.008822][T12045] vlan2: entered promiscuous mode [ 223.081994][T12053] pim6reg: entered allmulticast mode [ 223.100063][T12053] pim6reg: left allmulticast mode [ 223.282319][T12057] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 223.299748][T12057] bond3 (unregistering): Released all slaves [ 223.303706][T12064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1684'. [ 223.810367][T12093] veth0: entered promiscuous mode [ 223.878957][T12097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1692'. [ 224.084764][T12117] syzkaller0: entered promiscuous mode [ 224.092907][T12117] syzkaller0: entered allmulticast mode [ 224.156185][T12121] dvmrp0: entered allmulticast mode [ 224.287017][T12129] bond3: Unable to set up delay as MII monitoring is disabled [ 224.297264][T12129] bond3 (unregistering): Released all slaves [ 224.351058][T12133] bond3: (slave vxcan5): The slave device specified does not support setting the MAC address [ 224.363073][T12133] bond3: (slave vxcan5): Error -95 calling set_mac_address [ 224.546576][T12087] veth0: left promiscuous mode [ 224.924818][T12161] tipc: Enabled bearer , priority 0 [ 224.932882][T12152] syzkaller0: entered promiscuous mode [ 224.938871][T12152] syzkaller0: entered allmulticast mode [ 224.975431][T12152] tipc: Resetting bearer [ 224.993409][T12151] tipc: Resetting bearer [ 225.038857][T12151] tipc: Disabling bearer [ 225.390064][T12180] bond4 (unregistering): Released all slaves [ 225.822343][T12196] bond4: peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 225.871139][T12196] bond4: entered promiscuous mode [ 225.889077][T12196] bond4: entered allmulticast mode [ 225.911293][T12196] 8021q: adding VLAN 0 to HW filter on device bond4 [ 226.106967][T12220] __nla_validate_parse: 38 callbacks suppressed [ 226.106987][T12220] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1725'. [ 226.119556][T12221] syzkaller0: entered promiscuous mode [ 226.144347][T12221] syzkaller0: entered allmulticast mode [ 226.367287][T12246] netlink: 'syz.0.1729': attribute type 2 has an invalid length. [ 226.405117][T12246] netlink: 'syz.0.1729': attribute type 2 has an invalid length. [ 226.565163][T12251] netlink: 51 bytes leftover after parsing attributes in process `syz.3.1732'. [ 226.908498][T12268] netem: change failed [ 227.032345][T12272] IPv6: sit3: Disabled Multicast RS [ 227.237723][T12284] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1746'. [ 227.312148][T12296] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 227.390594][T12298] IPv6: sit2: Disabled Multicast RS [ 227.415737][T12298] sit2: entered allmulticast mode [ 227.727718][T12309] netlink: 'syz.1.1752': attribute type 1 has an invalid length. [ 227.736566][T12314] netlink: 504 bytes leftover after parsing attributes in process `syz.0.1753'. [ 227.978859][T12322] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1755'. [ 228.128445][T12329] block nbd1: Unsupported socket: should be TCP or UNIX. [ 228.205707][T12335] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 228.239977][T12337] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1762'. [ 228.659658][T12359] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1769'. [ 228.668822][T12359] openvswitch: netlink: Flow actions attr not present in new flow. [ 228.768949][T12366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1772'. [ 228.871338][T12372] delete_channel: no stack [ 229.041990][T12380] netlink: 'syz.0.1776': attribute type 2 has an invalid length. [ 229.068192][T12380] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1776'. [ 229.246458][T12390] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.1779'. [ 229.603860][T12411] bridge0: entered promiscuous mode [ 229.612581][T12411] bridge0: entered allmulticast mode [ 230.341493][T12461] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 230.591248][T12470] syzkaller1: entered promiscuous mode [ 230.596879][T12470] syzkaller1: entered allmulticast mode [ 230.605501][T12469] netlink: 'syz.1.1797': attribute type 11 has an invalid length. [ 230.832828][T12482] netlink: 'syz.2.1802': attribute type 9 has an invalid length. [ 230.984492][T12462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.170636][T12504] netlink: 'syz.2.1807': attribute type 2 has an invalid length. [ 231.209164][T12504] netlink: 'syz.2.1807': attribute type 8 has an invalid length. [ 231.216964][T12504] __nla_validate_parse: 4 callbacks suppressed [ 231.216982][T12504] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1807'. [ 231.327947][T12510] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1809'. [ 231.393316][T12512] tap0: tun_chr_ioctl cmd 1074025678 [ 231.416639][T12512] tap0: group set to 0 [ 231.797117][T12529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1818'. [ 231.894574][T12533] veth0: entered promiscuous mode [ 231.917836][T12531] veth0: left promiscuous mode [ 231.994769][T12542] ieee802154 phy0 wpan0: encryption failed: -22 [ 232.071054][T12544] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1823'. [ 232.128079][T12552] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1824'. [ 232.148546][T12539] netlink: 'syz.3.1821': attribute type 2 has an invalid length. [ 232.161345][T12544] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1823'. [ 232.232358][T12552] 8021q: adding VLAN 0 to HW filter on device bond8 [ 232.283678][T12559] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1827'. [ 232.293817][T12559] netlink: 'syz.0.1827': attribute type 12 has an invalid length. [ 232.302624][T12559] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1827'. [ 232.422829][T12559] bond3: option primary_reselect: invalid value (255) [ 232.550897][T12559] bond3 (unregistering): Released all slaves [ 232.731922][T12562] hsr0 speed is unknown, defaulting to 1000 [ 232.904957][T12584] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1835'. [ 233.095424][T12591] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1838'. [ 233.169686][T12595] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 233.234087][T12598] netlink: 'syz.1.1841': attribute type 1 has an invalid length. [ 233.258771][T12598] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 233.292825][T12590] netlink: 'syz.3.1839': attribute type 5 has an invalid length. [ 233.527913][T12615] netlink: 'syz.4.1844': attribute type 4 has an invalid length. [ 233.730084][T12627] xt_TCPMSS: Only works on TCP SYN packets [ 233.794245][T12627] syzkaller1: entered promiscuous mode [ 233.825321][T12627] syzkaller1: entered allmulticast mode [ 234.164336][ T30] audit: type=1107 audit(1762739830.595:5): pid=12651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='b.TP,P럎/Hȁ' [ 235.579294][T12728] netlink: 'syz.0.1877': attribute type 83 has an invalid length. [ 236.215059][T12763] ieee802154 phy0 wpan0: encryption failed: -22 [ 237.463622][T12773] bond4: invalid ARP target 0.0.0.0 specified for addition [ 237.471468][T12773] bond4: option arp_ip_target: invalid value (0) [ 237.484965][T12773] bond4 (unregistering): Released all slaves [ 238.054691][T12804] tc_dump_action: action bad kind [ 238.358260][T12824] __nla_validate_parse: 13 callbacks suppressed [ 238.358280][T12824] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1903'. [ 238.427061][T12824] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1903'. [ 238.448895][T12831] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1907'. [ 238.592490][T12837] syzkaller0: entered promiscuous mode [ 238.598416][T12837] syzkaller0: entered allmulticast mode [ 238.775082][T12846] netlink: 'syz.4.1912': attribute type 11 has an invalid length. [ 238.786298][T12846] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1912'. [ 238.930245][T12852] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1914'. [ 238.945443][T12854] netlink: 'syz.1.1915': attribute type 12 has an invalid length. [ 238.975824][T12854] netlink: 'syz.1.1915': attribute type 29 has an invalid length. [ 238.987252][T12854] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1915'. [ 239.005506][T12854] netlink: 'syz.1.1915': attribute type 2 has an invalid length. [ 239.014801][T12854] netlink: 23 bytes leftover after parsing attributes in process `syz.1.1915'. [ 239.391306][T12872] syzkaller0: entered promiscuous mode [ 239.411345][T12872] syzkaller0: entered allmulticast mode [ 239.542843][T12872] tipc: Enabled bearer , priority 0 [ 239.565680][T12866] tipc: Resetting bearer [ 239.650644][T12866] tipc: Disabling bearer [ 239.700107][T12884] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1923'. [ 239.822207][T12884] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1923'. [ 239.824178][T12897] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1927'. [ 239.855100][T12897] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 240.668788][T12898] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 240.923438][T12943] tun0: tun_chr_ioctl cmd 1074025675 [ 240.946119][T12943] tun0: persist disabled [ 241.390045][T12976] !: renamed from bond_slave_0 (while UP) [ 241.552497][T12983] bond9: option xmit_hash_policy: invalid value (64) [ 241.562584][T12983] bond9 (unregistering): Released all slaves [ 241.799368][T13007] tipc: New replicast peer: 255.255.255.255 [ 241.832529][T13007] tipc: Enabled bearer , priority 10 [ 241.982965][T13014] netlink: 'syz.1.1961': attribute type 3 has an invalid length. [ 242.019155][T13017] delete_channel: no stack [ 242.563691][T13051] netlink: 'syz.3.1970': attribute type 11 has an invalid length. [ 242.585557][T13051] netlink: 'syz.3.1970': attribute type 11 has an invalid length. [ 242.958249][T13078] nbd: illegal input index 2958377 [ 244.104731][T13095] bond0: (slave bridge_slave_1): Releasing backup interface [ 244.124575][T13095] bond0: (slave bond_slave_0): Releasing backup interface [ 244.169501][T13095] bond0: (slave bond_slave_1): Releasing backup interface [ 244.264868][T13095] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 244.293352][T13091] veth0: entered promiscuous mode [ 244.358747][T13134] __nla_validate_parse: 13 callbacks suppressed [ 244.358766][T13134] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1984'. [ 244.406035][T13097] veth0: left promiscuous mode [ 244.413554][T13134] netlink: 'syz.3.1984': attribute type 33 has an invalid length. [ 244.606910][T13141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1987'. [ 244.634335][T13142] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1988'. [ 244.809657][T13163] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1989'. [ 244.909691][T13167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1994'. [ 245.123084][T13173] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1995'. [ 245.576885][T13185] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 245.927852][T13202] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2000'. [ 246.025795][T13209] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2000'. [ 246.045566][T13208] netlink: 'syz.3.2001': attribute type 11 has an invalid length. [ 246.076175][T13208] netlink: 'syz.3.2001': attribute type 12 has an invalid length. [ 246.233083][T13218] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2004'. [ 246.245835][T13218] netlink: 'syz.0.2004': attribute type 1 has an invalid length. [ 246.254200][T13218] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2004'. [ 246.432084][T13231] netlink: 'syz.4.2008': attribute type 1 has an invalid length. [ 246.673333][T13237] bond9: (slave vti0): The slave device specified does not support setting the MAC address [ 246.718982][T13237] bond9: (slave vti0): Error -95 calling set_mac_address [ 246.800400][T13249] netlink: 'syz.0.2013': attribute type 1 has an invalid length. [ 246.851208][T13249] 8021q: adding VLAN 0 to HW filter on device bond3 [ 246.955885][T13249] veth7: entered promiscuous mode [ 246.969825][T13249] bond3: (slave veth7): Enslaving as an active interface with an up link [ 247.231544][T13267] xt_hashlimit: overflow, rate too high: 0 [ 247.399950][T13273] bond4: Unable to set up delay as MII monitoring is disabled [ 247.451915][T13273] bond4 (unregistering): Released all slaves [ 247.513578][T13289] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 249.577402][T13405] netlink: 'syz.4.2046': attribute type 8 has an invalid length. [ 249.951303][T13422] netlink: 'syz.1.2049': attribute type 8 has an invalid length. [ 249.986310][T13425] tipc: Enabling of bearer rejected, failed to enable media [ 250.907187][T13479] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 251.005090][T13487] netlink: 'syz.1.2058': attribute type 2 has an invalid length. [ 251.015475][T13487] __nla_validate_parse: 3 callbacks suppressed [ 251.015495][T13487] netlink: 204 bytes leftover after parsing attributes in process `syz.1.2058'. [ 251.304651][T13499] netlink: 184 bytes leftover after parsing attributes in process `syz.4.2063'. [ 251.537008][T13513] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2069'. [ 251.553827][T13513] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2069'. [ 251.618192][T13513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2069'. [ 251.640241][T13513] xfrm1: entered promiscuous mode [ 251.645421][T13513] xfrm1: entered allmulticast mode [ 251.654850][T13522] tipc: Enabled bearer , priority 0 [ 251.661054][T13513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2069'. [ 251.663358][T13522] syzkaller0: entered promiscuous mode [ 251.676465][T13522] syzkaller0: entered allmulticast mode [ 251.748308][T13522] tipc: Resetting bearer [ 251.769048][T13522] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2072'. [ 251.845002][T13521] tipc: Resetting bearer [ 251.861177][T13535] xt_policy: output policy not valid in PREROUTING and INPUT [ 251.904041][T13521] tipc: Disabling bearer [ 252.141026][T13549] netlink: 'syz.4.2079': attribute type 4 has an invalid length. [ 252.154796][T13550] netlink: 'syz.0.2078': attribute type 16 has an invalid length. [ 252.166967][T13550] netlink: 'syz.0.2078': attribute type 17 has an invalid length. [ 252.210100][T13550] 0{X: left allmulticast mode [ 252.294823][T13550] 8021q: adding VLAN 0 to HW filter on device bond0 [ 252.331284][T13550] 8021q: adding VLAN 0 to HW filter on device team0 [ 252.358477][T13550] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 252.366983][T13563] netlink: 27 bytes leftover after parsing attributes in process `syz.2.2082'. [ 252.380391][T13564] ieee802154 phy0 wpan0: encryption failed: -22 [ 252.390674][T13563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2082'. [ 252.440841][ T5832] hsr0 speed is unknown, defaulting to 1000 [ 252.447268][ T6748] hsr0 speed is unknown, defaulting to 1000 [ 252.615336][T13575] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2087'. [ 252.625673][T13577] netlink: 'syz.0.2086': attribute type 29 has an invalid length. [ 253.380541][T13625] syzkaller0: entered promiscuous mode [ 253.392194][T13629] netlink: 'syz.3.2099': attribute type 21 has an invalid length. [ 253.401086][T13625] syzkaller0: entered allmulticast mode [ 253.448475][T13626] tipc: Enabled bearer , priority 0 [ 253.470254][T13628] netlink: 'syz.1.2101': attribute type 21 has an invalid length. [ 253.528503][T13626] tipc: Resetting bearer [ 253.572506][T13626] tipc: Disabling bearer [ 253.817990][T13654] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 254.040528][T13669] block nbd1: Unsupported socket: should be TCP or UNIX. [ 254.225142][T13681] netlink: 'syz.4.2116': attribute type 4 has an invalid length. [ 254.285376][T13683] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 254.310459][T13683] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 254.554598][T13691] geneve2: entered promiscuous mode [ 254.566860][T13691] geneve2: entered allmulticast mode [ 254.590006][T12582] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 254.617821][T12582] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 254.626446][T12582] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 254.658415][T12582] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 19999 - 0 [ 254.678694][T13691] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.687705][T13698] delete_channel: no stack [ 254.691852][T13691] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.705286][T13691] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 254.798180][T13691] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.812907][T13691] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.850736][T13691] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 254.996553][T13714] skbuff: bad partial csum: csum=65535/127 headroom=178 headlen=65664 [ 255.009474][T13691] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.019600][T13691] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.028781][T13714] netlink: 'syz.0.2127': attribute type 1 has an invalid length. [ 255.030287][T13691] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 255.201875][T13720] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 255.680270][T13691] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.692307][T13691] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.703504][T13691] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 255.910204][ T50] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.934439][ T50] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 255.966426][ T50] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 255.988088][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.994676][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.023148][ T50] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 256.047809][ T50] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 256.056247][ T50] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 256.097492][T12582] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 256.107394][T12582] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 256.132200][T12582] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 256.165554][T12582] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 256.174104][T12582] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 256.183636][T12582] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 256.287357][T13761] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 256.406315][T13769] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:20001 [ 256.589364][T13780] netlink: 'syz.1.2145': attribute type 10 has an invalid length. [ 256.597317][T13780] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 256.610163][T13780] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 256.637330][T13782] bond4: Unable to set peer notification delay as MII monitoring is disabled [ 256.648240][T13782] bond4 (unregistering): Released all slaves [ 256.681523][T13784] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 256.690149][T13780] __nla_validate_parse: 12 callbacks suppressed [ 256.690167][T13780] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2145'. [ 256.732263][T13780] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2145'. [ 257.042876][T13804] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2151'. [ 257.076849][T13803] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2154'. [ 257.105442][T13803] netem: invalid attributes len -24 [ 257.123186][T13803] netem: change failed [ 257.245627][T13820] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2157'. [ 257.294030][T13824] netlink: 'syz.1.2159': attribute type 3 has an invalid length. [ 257.763241][T13850] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2167'. [ 257.776517][T13850] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 257.953006][T13856] netlink: 45 bytes leftover after parsing attributes in process `syz.4.2169'. [ 258.018044][T13863] tipc: Enabled bearer , priority 0 [ 258.025261][T13856] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2169'. [ 258.026092][T13863] syzkaller0: entered promiscuous mode [ 258.040472][T13863] syzkaller0: entered allmulticast mode [ 258.109320][T13863] tipc: Resetting bearer [ 258.122238][T13862] tipc: Resetting bearer [ 258.156626][T13869] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 258.173721][T13862] tipc: Disabling bearer [ 258.267952][T13879] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.2175'. [ 258.277215][T13879] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 258.286304][T13879] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2175'. [ 258.569924][T13896] x_tables: duplicate underflow at hook 2 [ 258.570600][T13897] x_tables: duplicate underflow at hook 2 [ 258.698334][ T5149] Bluetooth: hci0: command tx timeout [ 259.168506][T13908] netlink: 'syz.4.2183': attribute type 2 has an invalid length. [ 259.195245][T13909] gre1: entered promiscuous mode [ 259.232908][T13909] gre1: entered allmulticast mode [ 259.544818][T13930] IPVS: set_ctl: invalid protocol: 136 0.0.0.0:20003 [ 259.569719][T13929] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 259.598705][T13929] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 259.858759][T13949] netlink: 'syz.0.2197': attribute type 11 has an invalid length. [ 259.992292][T13959] netlink: 'syz.0.2199': attribute type 11 has an invalid length. [ 260.123082][T13965] veth0_macvtap: left promiscuous mode [ 260.533299][T13975] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 260.839635][T13993] hsr0 speed is unknown, defaulting to 1000 [ 260.953467][T14007] netlink: 'syz.0.2214': attribute type 21 has an invalid length. [ 261.069512][T14011] syzkaller0: entered promiscuous mode [ 261.075840][T14011] syzkaller0: entered allmulticast mode [ 262.084080][T14076] tipc: Enabled bearer , priority 0 [ 262.109593][T14076] syzkaller0: entered promiscuous mode [ 262.115473][T14076] syzkaller0: entered allmulticast mode [ 262.145235][T14083] IPVS: set_ctl: invalid protocol: 44 172.20.20.170:20002 [ 262.181185][T14083] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 262.216419][T14076] tipc: Resetting bearer [ 262.283551][T14074] tipc: Resetting bearer [ 262.371158][T14074] tipc: Disabling bearer [ 262.691628][T14101] __nla_validate_parse: 16 callbacks suppressed [ 262.691650][T14101] netlink: 528 bytes leftover after parsing attributes in process `syz.0.2243'. [ 262.718016][T14101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2243'. [ 262.810917][T14108] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2245'. [ 262.821224][T14108] netlink: 'syz.2.2245': attribute type 11 has an invalid length. [ 262.832097][T14108] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2245'. [ 264.716127][ T5199] udevd[5199]: worker [5839] /devices/virtual/block/nbd0 is taking a long time [ 285.769940][ T5199] udevd[5199]: worker [5839] /devices/virtual/block/nbd0 timeout; kill it [ 285.778816][ T5199] udevd[5199]: seq 11435 '/devices/virtual/block/nbd0' killed [ 314.135140][T14125] netlink: 'syz.0.2250': attribute type 1 has an invalid length. [ 314.153869][T14125] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2250'. [ 314.263629][T14143] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2255'. [ 314.273265][T14125] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2250'. [ 314.616123][T14157] sctp: [Deprecated]: syz.4.2260 (pid 14157) Use of struct sctp_assoc_value in delayed_ack socket option. [ 314.616123][T14157] Use struct sctp_sack_info instead [ 314.678221][T14158] xt_policy: output policy not valid in PREROUTING and INPUT [ 314.736116][T14159] bond11: entered promiscuous mode [ 314.741828][T14159] bond11: entered allmulticast mode [ 314.748958][T14159] 8021q: adding VLAN 0 to HW filter on device bond11 [ 314.786792][T14166] 8021q: VLANs not supported on syzkaller1 [ 314.923203][T14176] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2265'. [ 314.972542][T14172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2264'. [ 315.049869][T14172] netlink: 'syz.0.2264': attribute type 1 has an invalid length. [ 315.076635][T14172] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2264'. [ 315.212298][T14193] netlink: 'syz.4.2268': attribute type 1 has an invalid length. [ 315.305203][T14195] bond12: (slave xfrm1): The slave device specified does not support setting the MAC address [ 315.316182][T14195] bond12: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 315.317595][T14193] Unsupported ieee802154 address type: 0 [ 315.331871][T14195] bond12: (slave xfrm1): making interface the new active one [ 315.340833][T14195] bond12: (slave xfrm1): Enslaving as an active interface with an up link [ 315.351418][T14193] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2268'. [ 315.406951][T14193] bond12 (unregistering): (slave xfrm1): Releasing backup interface [ 315.433500][T14193] bond12 (unregistering): Released all slaves [ 315.465691][T14202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2270'. [ 315.543038][T14209] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2272'. [ 315.752591][T14224] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2273'. [ 316.027367][T14238] netdevsim netdevsim1: Direct firmware load for /. failed with error -2 [ 316.045642][T14238] netdevsim netdevsim1: Falling back to sysfs fallback for: /. [ 316.354826][T14255] ip6t_srh: unknown srh invflags 4000 [ 316.366482][T14257] sctp: [Deprecated]: syz.2.2288 (pid 14257) Use of struct sctp_assoc_value in delayed_ack socket option. [ 316.366482][T14257] Use struct sctp_sack_info instead [ 316.763209][T14277] xt_hashlimit: size too large, truncated to 1048576 [ 316.851115][T14286] gretap0: entered promiscuous mode [ 317.117298][T14297] syzkaller1: entered promiscuous mode [ 317.133663][T14297] syzkaller1: entered allmulticast mode [ 317.580390][T14315] netlink: 'syz.2.2308': attribute type 12 has an invalid length. [ 317.598785][T14318] tipc: Enabled bearer , priority 2 [ 317.674203][T14315] bond5: option primary_reselect: invalid value (255) [ 317.684667][T14315] bond5 (unregistering): Released all slaves [ 317.706643][T14325] syz.1.2312: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 317.722744][T14325] CPU: 1 UID: 0 PID: 14325 Comm: syz.1.2312 Not tainted syzkaller #0 PREEMPT(full) [ 317.722772][T14325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 317.722783][T14325] Call Trace: [ 317.722790][T14325] [ 317.722798][T14325] dump_stack_lvl+0x189/0x250 [ 317.722836][T14325] ? __pfx_dump_stack_lvl+0x10/0x10 [ 317.722857][T14325] ? __pfx__printk+0x10/0x10 [ 317.722874][T14325] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 317.722895][T14325] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 317.722918][T14325] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 317.722942][T14325] warn_alloc+0x214/0x310 [ 317.722965][T14325] ? stack_depot_save_flags+0x40/0x860 [ 317.722993][T14325] ? __pfx_warn_alloc+0x10/0x10 [ 317.723015][T14325] ? kasan_save_track+0x3e/0x80 [ 317.723034][T14325] ? __kasan_kmalloc+0x93/0xb0 [ 317.723060][T14325] ? xsk_setsockopt+0x4dc/0x8d0 [ 317.723078][T14325] ? do_sock_setsockopt+0x17c/0x1b0 [ 317.723091][T14325] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 317.723105][T14325] ? do_syscall_64+0xfa/0xfa0 [ 317.723129][T14325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.723154][T14325] __vmalloc_node_range_noprof+0x125/0x12d0 [ 317.723205][T14325] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 317.723230][T14325] ? __kasan_kmalloc+0x93/0xb0 [ 317.723257][T14325] vmalloc_user_noprof+0xad/0xf0 [ 317.723278][T14325] ? xskq_create+0xbf/0x170 [ 317.723297][T14325] xskq_create+0xbf/0x170 [ 317.723320][T14325] xsk_init_queue+0xb0/0x110 [ 317.723341][T14325] xsk_setsockopt+0x4dc/0x8d0 [ 317.723361][T14325] ? __pfx_xsk_setsockopt+0x10/0x10 [ 317.723382][T14325] ? __pfx_aa_sk_perm+0x10/0x10 [ 317.723405][T14325] ? aa_sock_opt_perm+0xff/0x1b0 [ 317.723439][T14325] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 317.723453][T14325] ? __pfx_xsk_setsockopt+0x10/0x10 [ 317.723472][T14325] do_sock_setsockopt+0x17c/0x1b0 [ 317.723492][T14325] __x64_sys_setsockopt+0x13f/0x1b0 [ 317.723514][T14325] do_syscall_64+0xfa/0xfa0 [ 317.723534][T14325] ? lockdep_hardirqs_on+0x9c/0x150 [ 317.723560][T14325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.723575][T14325] ? clear_bhb_loop+0x60/0xb0 [ 317.723594][T14325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.723608][T14325] RIP: 0033:0x7fe4da38f6c9 [ 317.723623][T14325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 317.723636][T14325] RSP: 002b:00007fe4db21f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 317.723654][T14325] RAX: ffffffffffffffda RBX: 00007fe4da5e5fa0 RCX: 00007fe4da38f6c9 [ 317.723665][T14325] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 317.723675][T14325] RBP: 00007fe4da411f91 R08: 0000000000000004 R09: 0000000000000000 [ 317.723684][T14325] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 317.723693][T14325] R13: 00007fe4da5e6038 R14: 00007fe4da5e5fa0 R15: 00007ffe98ff3df8 [ 317.723721][T14325] [ 317.723759][T14325] Mem-Info: [ 318.023014][T14325] active_anon:6324 inactive_anon:0 isolated_anon:0 [ 318.023014][T14325] active_file:2442 inactive_file:39948 isolated_file:0 [ 318.023014][T14325] unevictable:768 dirty:53 writeback:0 [ 318.023014][T14325] slab_reclaimable:11072 slab_unreclaimable:127898 [ 318.023014][T14325] mapped:31864 shmem:1851 pagetables:1258 [ 318.023014][T14325] sec_pagetables:0 bounce:0 [ 318.023014][T14325] kernel_misc_reclaimable:0 [ 318.023014][T14325] free:1303227 free_pcp:14855 free_cma:0 [ 318.069361][T14325] Node 0 active_anon:26196kB inactive_anon:0kB active_file:9768kB inactive_file:159592kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128456kB dirty:212kB writeback:0kB shmem:6768kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13796kB pagetables:4864kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 318.127598][T14325] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 318.252583][T14325] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 318.320089][T14325] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 318.326032][T14325] Node 0 DMA32 free:1295108kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:32628kB inactive_anon:0kB active_file:9768kB inactive_file:159592kB unevictable:1536kB writepending:212kB zspages:0kB present:3129332kB managed:2565160kB mlocked:0kB bounce:0kB free_pcp:41692kB local_pcp:21252kB free_cma:0kB [ 318.403964][T14325] lowmem_reserve[]: 0 0 0 0 0 [ 318.442911][T14325] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 318.519436][T14325] lowmem_reserve[]: 0 0 0 0 0 [ 318.524249][T14325] Node 1 Normal free:3896996kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17156kB local_pcp:12768kB free_cma:0kB [ 318.564229][ T52] block nbd1: Receive control failed (result -107) [ 318.599178][T14350] netlink: 'syz.2.2316': attribute type 1 has an invalid length. [ 318.637930][T14350] netlink: 'syz.2.2316': attribute type 3 has an invalid length. [ 318.645897][T14350] NCSI netlink: No device for ifindex 813332851 [ 318.657909][T14325] lowmem_reserve[]: 0 0 0 0 0 [ 318.662710][T14325] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 318.727016][T14325] Node 0 DMA32: 956*4kB (UME) 586*8kB (UM) 420*16kB (UME) 185*32kB (UME) 133*64kB (UME) 12*128kB (UE) 30*256kB (UME) 13*512kB (UME) 9*1024kB (UME) 4*2048kB (UM) 298*4096kB (UM) = 1283552kB [ 318.823713][T14325] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 318.867443][T14325] Node 1 Normal: 165*4kB (UE) 40*8kB (UME) 43*16kB (UME) 99*32kB (UME) 27*64kB (UME) 10*128kB (UME) 6*256kB (UME) 3*512kB (ME) 3*1024kB (UME) 0*2048kB 948*4096kB (M) = 3896996kB [ 318.894255][T14325] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 318.931585][T14325] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 318.970921][T14325] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 318.988614][T14325] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 318.998809][T14325] 46617 total pagecache pages [ 319.003711][T14325] 0 pages in swap cache [ 319.008724][T14325] Free swap = 124996kB [ 319.012913][T14325] Total swap = 124996kB [ 319.020039][T14325] 2097051 pages RAM [ 319.024452][T14325] 0 pages HighMem/MovableOnly [ 319.029754][T14325] 424119 pages reserved [ 319.034155][T14325] 0 pages cma reserved [ 319.050906][T14371] sctp: [Deprecated]: syz.3.2321 (pid 14371) Use of struct sctp_assoc_value in delayed_ack socket option. [ 319.050906][T14371] Use struct sctp_sack_info instead [ 319.333855][T14385] __nla_validate_parse: 10 callbacks suppressed [ 319.333877][T14385] netlink: 192 bytes leftover after parsing attributes in process `syz.3.2324'. [ 319.703979][T14409] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2329'. [ 319.802998][T14413] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2331'. [ 319.812210][T14418] netlink: 'syz.4.2333': attribute type 11 has an invalid length. [ 319.812234][T14418] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.2333'. [ 319.818087][T14418] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2333'. [ 319.874934][T14420] netlink: 'syz.4.2333': attribute type 11 has an invalid length. [ 319.885231][T14420] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.2333'. [ 320.126122][T14438] netlink: 'syz.4.2338': attribute type 29 has an invalid length. [ 320.135886][T14438] netlink: 'syz.4.2338': attribute type 29 has an invalid length. [ 320.149247][T14438] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2338'. [ 320.522388][T14445] netlink: 'syz.4.2338': attribute type 29 has an invalid length. [ 320.605244][T14447] netlink: 'syz.1.2340': attribute type 1 has an invalid length. [ 320.617718][T14445] netlink: 'syz.4.2338': attribute type 29 has an invalid length. [ 320.707966][T14445] netlink: 'syz.4.2338': attribute type 29 has an invalid length. [ 320.819007][T14454] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2343'. [ 320.933661][T14457] gtp0: entered promiscuous mode [ 320.943893][T14457] gtp0: entered allmulticast mode [ 321.107103][T14471] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2346'. [ 321.296567][T14481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2351'. [ 321.412207][T14487] netlink: 'syz.3.2354': attribute type 1 has an invalid length. [ 321.481580][T14487] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 321.500824][T14491] syzkaller0: entered promiscuous mode [ 321.506858][T14491] syzkaller0: entered allmulticast mode [ 321.537996][T14487] veth11: entered promiscuous mode [ 321.548621][T14487] bond4: (slave veth11): Enslaving as a backup interface with a down link [ 321.563624][T14487] 8021q: adding VLAN 0 to HW filter on device bond4 [ 321.569028][T14364] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 321.611992][T14487] : entered promiscuous mode [ 321.697924][T14364] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 321.762572][T14504] netlink: 'syz.3.2357': attribute type 2 has an invalid length. [ 321.773840][T14501] syzkaller0: entered promiscuous mode [ 321.782009][T14501] syzkaller0: entered allmulticast mode [ 321.799375][T14501] 0: reclassify loop, rule prio 0, protocol 800 [ 322.066759][T14520] netlink: 'syz.3.2360': attribute type 1 has an invalid length. [ 323.000086][T14572] netlink: 'syz.2.2377': attribute type 1 has an invalid length. [ 323.028824][ T30] audit: type=1107 audit(1762739919.455:6): pid=14571 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 323.209765][ T5964] IPVS: starting estimator thread 0... [ 323.499424][T14579] IPVS: using max 23 ests per chain, 55200 per kthread [ 323.786748][T14601] xt_hashlimit: invalid rate [ 323.872446][T14605] tipc: Enabling of bearer rejected, failed to enable media [ 324.105485][T14615] openvswitch: netlink: Flow key attribute not present in set flow. [ 324.331862][T14634] C: renamed from team_slave_0 (while UP) [ 324.343045][T14634] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 324.562239][T14642] syzkaller1: entered promiscuous mode [ 324.568058][T14642] syzkaller1: entered allmulticast mode [ 325.358699][T14646] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 325.618631][T14693] __nla_validate_parse: 10 callbacks suppressed [ 325.618652][T14693] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2407'. [ 325.811953][T14702] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2413'. [ 325.930948][T14702] bond0: entered allmulticast mode [ 325.936140][T14702] bond_slave_0: entered allmulticast mode [ 325.943344][T14702] bond_slave_1: entered allmulticast mode [ 326.308689][T14732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2421'. [ 326.474979][T14738] syzkaller0: entered promiscuous mode [ 326.491787][T14738] syzkaller0: entered allmulticast mode [ 353.342359][T14799] x_tables: unsorted entry at hook 1 [ 353.356223][T14799] validate_nla: 3 callbacks suppressed [ 353.356243][T14799] netlink: 'syz.3.2436': attribute type 1 has an invalid length. [ 353.410894][T14798] syzkaller0: entered promiscuous mode [ 353.438839][T14798] syzkaller0: entered allmulticast mode [ 353.465713][T14807] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 353.585046][T14812] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2442'. [ 353.627244][T14817] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2444'. [ 353.690096][T14815] tipc: Enabled bearer , priority 0 [ 353.698366][T14815] syzkaller0: entered promiscuous mode [ 353.728467][T14815] syzkaller0: entered allmulticast mode [ 353.922368][T14835] netlink: 'syz.1.2450': attribute type 1 has an invalid length. [ 353.972506][T14835] netlink: 'syz.1.2450': attribute type 1 has an invalid length. [ 353.990305][T14836] netlink: 'syz.1.2450': attribute type 1 has an invalid length. [ 354.009075][T14842] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2448'. [ 354.021730][T14836] netlink: 'syz.1.2450': attribute type 1 has an invalid length. [ 354.057197][T14843] netlink: 'syz.2.2451': attribute type 1 has an invalid length. [ 354.067237][T14843] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.119883][T14849] netlink: 212 bytes leftover after parsing attributes in process `syz.1.2452'. [ 354.183816][T14850] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2452'. [ 354.193945][T14813] tipc: Resetting bearer [ 354.200544][T14850] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2452'. [ 354.268668][T14813] tipc: Disabling bearer [ 354.376973][T14862] syzkaller1: entered promiscuous mode [ 354.394950][T14862] syzkaller1: entered allmulticast mode [ 354.409894][T14858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2455'. [ 354.433755][T14858] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2455'. [ 354.459570][T14858] netlink: 'syz.4.2455': attribute type 6 has an invalid length. [ 354.468925][T14866] netlink: 'syz.2.2458': attribute type 1 has an invalid length. [ 354.555309][T14858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2455'. [ 354.565564][T14364] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 354.574553][T14858] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2455'. [ 354.589865][T14364] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 354.599580][T14364] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 354.610489][T14858] netlink: 'syz.4.2455': attribute type 6 has an invalid length. [ 354.620008][T14364] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 355.422514][T14928] xt_CT: You must specify a L4 protocol and not use inversions on it [ 355.491716][T14938] netlink: 'syz.1.2479': attribute type 39 has an invalid length. [ 355.570253][T14939] sctp: [Deprecated]: syz.0.2478 (pid 14939) Use of struct sctp_assoc_value in delayed_ack socket option. [ 355.570253][T14939] Use struct sctp_sack_info instead [ 356.203020][T14978] tipc: Enabled bearer , priority 0 [ 356.286334][T14972] bond5 (unregistering): Released all slaves [ 356.350577][T14978] tipc: Disabling bearer [ 356.487166][T14972] ip6tnl3: entered promiscuous mode [ 356.496734][T14972] ip6tnl3: entered allmulticast mode [ 356.533241][T14996] tipc: Enabled bearer , priority 0 [ 356.542487][T14996] syzkaller0: entered promiscuous mode [ 356.549365][T14996] syzkaller0: entered allmulticast mode [ 356.563475][T14996] tipc: Resetting bearer [ 356.576243][T14995] tipc: Resetting bearer [ 356.597350][T14995] tipc: Disabling bearer [ 356.866913][T15019] bridge12: entered promiscuous mode [ 356.873433][T15019] bridge12: entered allmulticast mode [ 357.870858][T14364] nci: nci_rx_work: unknown MT 0x1 [ 359.574385][T15111] validate_nla: 41 callbacks suppressed [ 359.574407][T15111] netlink: 'syz.4.2527': attribute type 21 has an invalid length. [ 359.599675][T15110] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 359.653130][T15110] netlink: 'syz.0.2525': attribute type 3 has an invalid length. [ 359.680466][T15110] __nla_validate_parse: 15 callbacks suppressed [ 359.680486][T15110] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2525'. [ 359.697346][T15111] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2527'. [ 359.858998][T15119] hsr0 speed is unknown, defaulting to 1000 [ 360.172864][T15147] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2535'. [ 360.585814][T15156] syzkaller0: entered promiscuous mode [ 360.592950][T15156] syzkaller0: entered allmulticast mode [ 360.608482][T15156] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 362.233658][T15181] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2544'. [ 362.277431][T15183] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2545'. [ 362.287169][T15183] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2545'. [ 362.293751][T15185] 8021q: VLANs not supported on ip_vti0 [ 362.392042][T15187] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2547'. [ 362.505229][T15198] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2551'. [ 362.724561][T15209] syzkaller0: entered promiscuous mode [ 362.730306][T15209] syzkaller0: entered allmulticast mode [ 362.854286][T15214] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 362.934730][T15217] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 363.490614][T15251] bond0: entered promiscuous mode [ 363.495939][T15251] bond_slave_0: entered promiscuous mode [ 363.514263][T15253] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2569'. [ 363.526805][T15251] bond_slave_1: entered promiscuous mode [ 363.538424][T15251] team0: entered promiscuous mode [ 363.556922][T15251] team_slave_0: entered promiscuous mode [ 363.566098][T15251] team_slave_1: entered promiscuous mode [ 363.592943][T15251] dummy0: entered promiscuous mode [ 363.606480][T15251] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 363.713542][T15262] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2573'. [ 363.845144][T15268] geneve1: mtu less than device minimum [ 363.868316][T15275] syzkaller0: entered promiscuous mode [ 363.873999][T15275] syzkaller0: entered allmulticast mode [ 364.180879][T15288] bond4: down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 364.192368][T15291] netlink: 'syz.4.2580': attribute type 14 has an invalid length. [ 364.239656][T15291] netlink: 'syz.4.2580': attribute type 39 has an invalid length. [ 364.784295][T15334] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 364.808695][T15334] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 364.892391][T15334] __nla_validate_parse: 3 callbacks suppressed [ 364.892412][T15334] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2591'. [ 364.909125][T15334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2591'. [ 364.946484][T15341] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2595'. [ 364.961332][T15342] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2595'. [ 364.978891][T15341] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2595'. [ 364.998012][T15342] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2595'. [ 365.055549][T15347] netlink: 'syz.1.2597': attribute type 1 has an invalid length. [ 365.065080][T15347] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.196914][T15357] bond0: entered allmulticast mode [ 365.240039][T15352] netlink: 'syz.1.2601': attribute type 12 has an invalid length. [ 365.261620][T15352] netlink: 'syz.1.2601': attribute type 29 has an invalid length. [ 365.292506][T15352] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2601'. [ 365.341919][T15352] netlink: 51 bytes leftover after parsing attributes in process `syz.1.2601'. [ 365.695932][T15389] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2610'. [ 365.783723][T15395] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2611'. [ 366.053377][T15407] tipc: Enabled bearer , priority 0 [ 366.088441][T15407] tipc: Resetting bearer [ 366.109963][T15406] tipc: Disabling bearer [ 366.218253][T15416] pim6reg1: entered promiscuous mode [ 366.232869][T15416] pim6reg1: entered allmulticast mode [ 366.329361][T15428] netlink: 'syz.0.2621': attribute type 1 has an invalid length. [ 366.395131][T15428] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 366.399141][T15427] syzkaller0: entered promiscuous mode [ 366.431892][T15427] syzkaller0: entered allmulticast mode [ 366.524662][T15446] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 366.758472][T15459] syzkaller1: entered promiscuous mode [ 366.764011][T15459] syzkaller1: entered allmulticast mode [ 367.173549][T15483] bond5: entered allmulticast mode [ 367.196935][T15483] 8021q: adding VLAN 0 to HW filter on device bond5 [ 367.475690][T15506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.489824][T15507] netlink: 'syz.2.2639': attribute type 1 has an invalid length. [ 367.517164][T15506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.574959][T15502] netlink: 'syz.3.2636': attribute type 9 has an invalid length. [ 367.584076][T15502] netlink: 'syz.3.2636': attribute type 6 has an invalid length. [ 367.584311][T15506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.650378][T15506] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 368.287883][T15543] x_tables: duplicate underflow at hook 1 [ 368.325078][T15551] veth3: entered promiscuous mode [ 368.437171][T15555] veth3: entered promiscuous mode [ 368.508792][T15557] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 368.521762][T15557] bond5 (unregistering): Released all slaves [ 368.579891][T15563] syzkaller0: entered promiscuous mode [ 368.585437][T15563] syzkaller0: entered allmulticast mode [ 368.833624][T15570] can: request_module (can-proto-0) failed. [ 368.909889][T15588] veth0_to_team: entered promiscuous mode [ 369.166137][T15595] netlink: 'syz.4.2660': attribute type 4 has an invalid length. [ 369.175363][T15595] netlink: 'syz.4.2660': attribute type 4 has an invalid length. [ 392.635663][T15611] tipc: Enabled bearer , priority 0 [ 392.643623][T15611] syzkaller0: entered promiscuous mode [ 392.650560][T15611] syzkaller0: entered allmulticast mode [ 392.664187][T15611] tipc: Resetting bearer [ 392.687837][T15610] tipc: Resetting bearer [ 392.748691][T15610] tipc: Disabling bearer [ 392.780537][T15622] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 392.965336][T15637] __nla_validate_parse: 14 callbacks suppressed [ 392.965426][T15637] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2670'. [ 393.060873][T15640] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 393.135005][T15654] netlink: 'syz.2.2675': attribute type 6 has an invalid length. [ 393.291662][T15663] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2679'. [ 393.527292][T15683] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2685'. [ 393.732846][T15702] netlink: 'syz.0.2690': attribute type 2 has an invalid length. [ 393.744875][T15702] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2690'. [ 393.865419][T15712] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2693'. [ 393.882469][T15712] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2693'. [ 393.905765][T15712] x_tables: duplicate underflow at hook 3 [ 394.591453][T15752] ipvlan2: entered promiscuous mode [ 394.608339][T15750] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2708'. [ 394.617257][T15750] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 394.645313][T15750] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 394.671656][T15750] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 394.680310][T15750] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 394.839535][T15764] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2712'. [ 395.099221][T15775] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2714'. [ 395.173512][T15781] netlink: 'syz.2.2717': attribute type 11 has an invalid length. [ 395.271540][T15773] syzkaller0: entered promiscuous mode [ 395.277082][T15773] syzkaller0: entered allmulticast mode [ 395.300155][T15786] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2719'. [ 395.571881][T15804] netlink: 'syz.4.2724': attribute type 11 has an invalid length. [ 395.580859][T15800] veth0: entered promiscuous mode [ 395.586075][T15804] netlink: 'syz.4.2724': attribute type 11 has an invalid length. [ 395.658780][T15807] netlink: 'syz.4.2724': attribute type 39 has an invalid length. [ 395.690807][T15799] veth0: left promiscuous mode [ 395.709313][T15802] bridge0: port 1(batadv1) entered blocking state [ 395.716066][T15802] bridge0: port 1(batadv1) entered disabled state [ 395.723222][T15802] batadv1: entered allmulticast mode [ 395.732045][T15802] batadv1: entered promiscuous mode [ 396.207970][T14365] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 396.217338][T14365] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 396.256796][T15846] netlink: 'syz.0.2735': attribute type 1 has an invalid length. [ 396.365438][T15850] bond5: (slave bridge3): making interface the new active one [ 396.380648][T15850] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 397.555916][T15920] netlink: 'syz.4.2752': attribute type 33 has an invalid length. [ 397.588770][T15930] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 397.763786][T15920] bond13: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 397.841301][T15920] bond13 (unregistering): Released all slaves [ 397.934861][T15922] bridge0: port 2(batadv2) entered blocking state [ 397.956260][T15922] bridge0: port 2(batadv2) entered disabled state [ 397.971208][T15922] batadv2: entered allmulticast mode [ 397.983225][T15922] batadv2: entered promiscuous mode [ 398.106145][T15967] syzkaller0: entered promiscuous mode [ 398.127953][T15967] syzkaller0: entered allmulticast mode [ 398.178170][T15972] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 398.205523][T15971] veth1_macvtap: left promiscuous mode [ 398.211733][T15971] macsec0: entered promiscuous mode [ 398.429556][T14365] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 398.439332][T14365] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 398.568840][T15993] xt_CT: You must specify a L4 protocol and not use inversions on it [ 398.708811][T16001] __nla_validate_parse: 4 callbacks suppressed [ 398.708832][T16001] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2770'. [ 398.882719][T16008] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2774'. [ 398.945275][T16015] netlink: 'syz.0.2775': attribute type 12 has an invalid length. [ 398.953309][T16015] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2775'. [ 398.964816][T16015] netlink: 'syz.0.2775': attribute type 12 has an invalid length. [ 398.973316][T16015] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2775'. [ 399.209621][T16030] 8021q: VLANs not supported on ip6_vti0 [ 399.219423][T16026] netlink: 'syz.0.2778': attribute type 5 has an invalid length. [ 399.322347][T16037] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2782'. [ 399.341241][T16037] netlink: 176 bytes leftover after parsing attributes in process `syz.3.2782'. [ 399.375046][T16039] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2783'. [ 399.385067][T16040] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2778'. [ 399.454846][T16039] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2783'. [ 399.470019][T16039] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2783'. [ 399.737091][T16055] 8021q: adding VLAN 0 to HW filter on device bond13 [ 399.749797][T16056] bond13: entered allmulticast mode [ 400.084195][T16088] openvswitch: netlink: Tunnel attr 15060 out of range max 16 [ 400.131556][T16095] netlink: 'syz.4.2798': attribute type 1 has an invalid length. [ 400.302895][T16103] SET target dimension over the limit! [ 400.519869][T16114] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 400.546597][T16116] sctp: [Deprecated]: syz.4.2805 (pid 16116) Use of struct sctp_assoc_value in delayed_ack socket option. [ 400.546597][T16116] Use struct sctp_sack_info instead [ 400.566469][T16116] sctp: [Deprecated]: syz.4.2805 (pid 16116) Use of int in maxseg socket option. [ 400.566469][T16116] Use struct sctp_assoc_value instead [ 400.620322][T16119] bond5: Unable to set peer notification delay as MII monitoring is disabled [ 400.630240][T16121] netlink: 'syz.1.2807': attribute type 29 has an invalid length. [ 400.648824][T16119] bond5 (unregistering): Released all slaves [ 400.700496][T16123] syzkaller0: entered promiscuous mode [ 400.706250][T16123] syzkaller0: entered allmulticast mode [ 400.758887][T16127] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 400.848293][T16130] tipc: Enabling of bearer rejected, failed to enable media [ 400.977758][T16140] netlink: 'syz.2.2814': attribute type 8 has an invalid length. [ 401.400601][T16163] nbd: nbd1 already in use [ 401.500427][T16171] veth0: entered promiscuous mode [ 401.570024][T16168] netlink: 'syz.0.2825': attribute type 1 has an invalid length. [ 401.816038][T16190] xt_CT: You must specify a L4 protocol and not use inversions on it [ 401.852715][T16194] netlink: 'syz.2.2832': attribute type 3 has an invalid length. [ 402.189342][T16159] veth0: left promiscuous mode [ 402.349940][T16221] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.391780][T16228] netlink: 'syz.4.2844': attribute type 2 has an invalid length. [ 402.444949][T16228] netlink: 'syz.4.2844': attribute type 2 has an invalid length. [ 402.697086][T16250] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 402.940563][T16260] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 403.076823][T16269] team0: Device wireguard0 is of different type [ 403.330588][T16289] bond5: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 403.345779][T16289] bond5 (unregistering): Released all slaves [ 403.641311][T16307] dvmrp0: left allmulticast mode [ 403.752397][T16310] syzkaller0: entered promiscuous mode [ 403.780060][T16310] syzkaller0: entered allmulticast mode [ 404.081959][T16332] validate_nla: 5 callbacks suppressed [ 404.081981][T16332] netlink: 'syz.4.2871': attribute type 4 has an invalid length. [ 405.094821][T16390] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 405.457765][T16402] syzkaller0: entered promiscuous mode [ 405.463434][T16402] syzkaller0: entered allmulticast mode [ 405.835382][T16421] bond6: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 405.849855][T16421] bond6 (unregistering): Released all slaves [ 405.913244][T16426] sit4: entered promiscuous mode [ 405.918576][T16426] sit4: entered allmulticast mode [ 406.020172][T16437] __nla_validate_parse: 27 callbacks suppressed [ 406.020195][T16437] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2900'. [ 406.345917][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.368121][T16457] pim6reg1: entered promiscuous mode [ 406.373569][T16457] pim6reg1: entered allmulticast mode [ 406.385288][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.396000][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.406425][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.418249][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.436891][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.452308][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.461996][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.479609][T16459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2905'. [ 406.961749][T16489] netlink: 'syz.3.2917': attribute type 2 has an invalid length. [ 407.069042][T16499] netlink: 'syz.0.2920': attribute type 1 has an invalid length. [ 407.077377][T16499] netlink: 'syz.0.2920': attribute type 4 has an invalid length. [ 407.595635][ T5149] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 407.606481][ T5149] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 407.616315][ T5149] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 407.630497][ T5149] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 407.638664][ T5149] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 407.723283][T16519] hsr0 speed is unknown, defaulting to 1000 [ 407.766398][T16534] netlink: 'syz.3.2929': attribute type 5 has an invalid length. [ 407.804885][T16534] geneve3: entered promiscuous mode [ 407.808285][T16531] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 407.810729][T16534] geneve3: entered allmulticast mode [ 407.826021][T16525] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 407.833729][T10594] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 407.846923][T10594] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 407.863726][T10594] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 407.936698][T16538] netlink: 'syz.2.2930': attribute type 1 has an invalid length. [ 407.956423][T10594] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 407.972183][T16538] netlink: 'syz.2.2930': attribute type 23 has an invalid length. [ 408.248319][T16519] chnl_net:caif_netlink_parms(): no params data found [ 408.453387][T16559] tipc: Enabled bearer , priority 0 [ 408.624580][T16564] macsec0: left promiscuous mode [ 408.644639][T16564] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 408.686908][T16557] tipc: Disabling bearer [ 408.727766][T10594] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.741963][T16519] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.770055][T16519] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.777411][T16519] bridge_slave_0: entered allmulticast mode [ 408.793108][T16519] bridge_slave_0: entered promiscuous mode [ 408.812633][T10594] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.825892][T10594] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.836071][T16519] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.844409][T16519] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.852602][T16519] bridge_slave_1: entered allmulticast mode [ 408.863064][T16519] bridge_slave_1: entered promiscuous mode [ 408.872320][T10594] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.926195][T16573] C: renamed from lo [ 409.006579][T16519] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 409.037770][T16581] erspan0: entered allmulticast mode [ 409.057309][T16519] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 409.159987][T16519] team0: Port device team_slave_0 added [ 409.172907][T16519] team0: Port device team_slave_1 added [ 409.369020][T16519] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.376247][T16519] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.403856][T16519] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.428799][T16519] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.435846][T16519] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.468431][T16519] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 409.562456][T16611] syzkaller0: entered promiscuous mode [ 409.578489][T16611] syzkaller0: entered allmulticast mode [ 409.606989][T16613] veth1_macvtap: left promiscuous mode [ 409.613112][T16613] macsec0: entered promiscuous mode [ 409.619023][T16613] macsec0: entered allmulticast mode [ 409.633268][T16519] hsr_slave_0: entered promiscuous mode [ 409.640535][T16519] hsr_slave_1: entered promiscuous mode [ 409.647204][T16519] debugfs: 'hsr0' already exists in 'hsr' [ 409.654402][T16519] Cannot create hsr debugfs directory [ 409.661237][T16613] veth1_macvtap: entered promiscuous mode [ 409.667176][T16613] veth1_macvtap: entered allmulticast mode [ 409.674653][T16613] macsec0: left promiscuous mode [ 409.683529][T16613] macsec0: left allmulticast mode [ 409.695376][T16613] veth1_macvtap: left allmulticast mode [ 409.726261][T16619] veth1_macvtap: left promiscuous mode [ 409.732067][T16619] macsec0: entered promiscuous mode [ 409.737320][T16619] macsec0: entered allmulticast mode [ 409.743497][ T5149] Bluetooth: hci2: command tx timeout [ 409.873773][T16629] netlink: 'syz.2.2955': attribute type 22 has an invalid length. [ 409.950865][T16629] netlink: 'syz.2.2955': attribute type 22 has an invalid length. [ 410.153510][T16519] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.165834][T16519] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.289743][T16519] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.303490][T16519] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.581656][T16519] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.617951][T16519] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.710052][T16670] netlink: 'syz.4.2968': attribute type 4 has an invalid length. [ 410.769377][T16671] netlink: 'syz.4.2968': attribute type 4 has an invalid length. [ 410.821445][T16669] netlink: 'syz.4.2968': attribute type 4 has an invalid length. [ 410.880802][T16519] bond0: (slave netdevsim0): Releasing backup interface [ 410.912473][T16519] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.943969][T16519] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.481948][T16713] __nla_validate_parse: 40 callbacks suppressed [ 411.481971][T16713] netlink: 596 bytes leftover after parsing attributes in process `syz.3.2976'. [ 411.487298][T16711] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2975'. [ 411.511354][T16519] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 411.541095][T16713] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2976'. [ 411.555580][T16519] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 411.580947][T16718] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.591359][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.598475][T16519] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 411.658304][T16722] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2978'. [ 411.672499][T16519] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 411.680775][T16722] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2978'. [ 411.751941][T16728] netlink: 'syz.0.2978': attribute type 83 has an invalid length. [ 411.817772][ T5149] Bluetooth: hci2: command tx timeout [ 411.874718][T16740] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2983'. [ 411.935783][T16741] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2983'. [ 411.990384][ T6337] udevd[6337]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 412.178691][T16751] SET target dimension over the limit! [ 412.183873][T16519] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.219874][T16759] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 412.223497][T16751] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2987'. [ 412.234542][T16519] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.271772][T14365] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.278732][T16752] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2987'. [ 412.278996][T14365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.303405][T14365] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.310863][T14365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.322428][T16763] netlink: 'syz.3.2986': attribute type 4 has an invalid length. [ 412.332943][T16753] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2986'. [ 412.682446][T16782] netlink: 'syz.4.2994': attribute type 1 has an invalid length. [ 412.854492][T16782] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 413.053939][T16519] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.203020][T16519] veth0_vlan: entered promiscuous mode [ 413.238440][T16519] veth1_vlan: entered promiscuous mode [ 413.282371][T16814] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 413.383180][T16519] veth0_macvtap: entered promiscuous mode [ 413.401069][T16519] veth1_macvtap: entered promiscuous mode [ 413.452873][T16519] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 413.486936][T16821] nbd: must specify a size in bytes for the device [ 413.493095][T16519] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 413.607372][T10594] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.628905][T10594] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.666854][T10594] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.680400][T10594] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.897967][ T5149] Bluetooth: hci2: command tx timeout [ 413.911358][T10594] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.936701][T10594] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.030735][T16842] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 414.054072][T10594] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.071511][T10594] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.109364][T16850] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 414.699806][ T1146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.708742][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.944955][T16893] netlink: 'syz.4.3026': attribute type 2 has an invalid length. [ 415.004856][T16892] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 415.059320][T16892] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 415.332592][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 415.347096][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 415.364593][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 415.393119][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 415.409580][T16901] 8021q: VLANs not supported on ip_vti0 [ 415.416944][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 415.487325][T16900] hsr0 speed is unknown, defaulting to 1000 [ 415.979909][ T52] Bluetooth: hci2: command tx timeout [ 416.019611][T16930] openvswitch: netlink: nsh attr 0 has unexpected len 32768 expected 0 [ 416.038786][T16930] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 416.109974][T16900] chnl_net:caif_netlink_parms(): no params data found [ 416.426039][T16900] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.443263][T16900] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.463054][T16900] bridge_slave_0: entered allmulticast mode [ 416.487957][T16900] bridge_slave_0: entered promiscuous mode [ 416.506297][T16900] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.523952][T16900] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.535235][T16900] bridge_slave_1: entered allmulticast mode [ 416.544548][T16900] bridge_slave_1: entered promiscuous mode [ 416.554862][T16954] __nla_validate_parse: 12 callbacks suppressed [ 416.554883][T16954] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3047'. [ 416.637061][T14363] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.659737][T16954] tipc: Enabling of bearer rejected, failed to enable media [ 416.669738][T16964] netlink: 'syz.2.3047': attribute type 21 has an invalid length. [ 416.683648][T16900] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 416.706270][T16957] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.717228][T16900] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 416.733278][T16957] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.762466][T16957] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.810578][T16967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.822793][T16967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.861818][T16967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.878585][T16957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3046'. [ 416.897348][T16967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.914139][T16957] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3046'. [ 416.938526][T16957] netlink: 'syz.4.3046': attribute type 12 has an invalid length. [ 416.958861][T16957] netlink: 'syz.4.3046': attribute type 11 has an invalid length. [ 416.978551][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.990196][T16900] team0: Port device team_slave_0 added [ 417.001203][T16900] team0: Port device team_slave_1 added [ 417.009117][T16956] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.185718][T16980] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3054'. [ 417.199519][T16980] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 417.283847][T16900] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 417.305106][T16900] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.369572][T16900] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 417.398567][T16994] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3059'. [ 417.412361][T16900] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 417.440316][T16900] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.498715][ T52] Bluetooth: hci4: command tx timeout [ 417.513108][T16900] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 417.535693][T17004] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3060'. [ 417.623987][T17007] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3061'. [ 417.727206][T16900] hsr_slave_0: entered promiscuous mode [ 417.750253][T16900] hsr_slave_1: entered promiscuous mode [ 417.796864][T16900] debugfs: 'hsr0' already exists in 'hsr' [ 417.822481][T16900] Cannot create hsr debugfs directory [ 418.106476][T17022] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3065'. [ 418.135609][T17032] netlink: 'syz.2.3067': attribute type 2 has an invalid length. [ 418.155164][T17022] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3065'. [ 418.168548][T17032] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3067'. [ 418.463376][T16900] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.479498][T16900] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 418.591750][T16900] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.607526][T16900] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 418.674855][T17043] netlink: 'syz.2.3070': attribute type 1 has an invalid length. [ 418.728281][T17043] 8021q: adding VLAN 0 to HW filter on device bond7 [ 418.817312][T16900] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 418.837786][T16900] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 418.876131][T17048] netlink: 'syz.1.3071': attribute type 3 has an invalid length. [ 418.954001][T17043] veth11: entered promiscuous mode [ 418.974889][T17043] bond7: (slave veth11): Enslaving as an active interface with a down link [ 419.043980][T17045] veth13: entered promiscuous mode [ 419.055227][T17045] bond7: (slave veth13): Enslaving as an active interface with a down link [ 419.065925][T17047] bond7: entered allmulticast mode [ 419.201209][T16900] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 419.211829][T16900] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 419.280919][T17062] bond2: option min_links: invalid value (18446744073709551614) [ 419.289101][T17062] bond2: option min_links: allowed values 0 - 2147483647 [ 419.302397][T17062] bond2 (unregistering): Released all slaves [ 419.579541][ T52] Bluetooth: hci4: command tx timeout [ 419.691533][T16900] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 419.765518][T16900] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 419.844975][T16900] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 419.893643][T16900] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 419.972175][T17099] tipc: Enabled bearer , priority 0 [ 419.983520][T17099] syzkaller0: entered promiscuous mode [ 419.992383][ T5884] IPVS: starting estimator thread 0... [ 420.017682][T17099] syzkaller0: entered allmulticast mode [ 420.086685][T17099] tipc: Enabling of bearer rejected, already enabled [ 420.100740][T17120] IPVS: using max 23 ests per chain, 55200 per kthread [ 420.144328][T17095] tipc: Resetting bearer [ 420.190354][T17095] tipc: Disabling bearer [ 420.229424][T17127] : renamed from batadv_slave_1 (while UP) [ 420.387372][T16900] 8021q: adding VLAN 0 to HW filter on device bond0 [ 420.440552][T16900] 8021q: adding VLAN 0 to HW filter on device team0 [ 420.476362][T17091] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.483639][T17091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 420.531955][T17091] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.539324][T17091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 420.704164][T17149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 421.091833][T16900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 421.309573][T16900] veth0_vlan: entered promiscuous mode [ 421.352772][T16900] veth1_vlan: entered promiscuous mode [ 421.404414][T16900] veth0_macvtap: entered promiscuous mode [ 421.417242][T16900] veth1_macvtap: entered promiscuous mode [ 421.480422][T16900] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 421.585045][T16900] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 421.630035][T17108] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.668839][ T52] Bluetooth: hci4: command tx timeout [ 421.718491][ T1146] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.760781][T14364] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.789146][T14364] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.922708][T17180] netlink: 'syz.0.3099': attribute type 11 has an invalid length. [ 421.935979][T14364] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.945004][T14364] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.957196][T17180] __nla_validate_parse: 73 callbacks suppressed [ 421.957216][T17180] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.3099'. [ 422.058592][ T6749] net_ratelimit: 4 callbacks suppressed [ 422.058612][ T6749] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.098831][T14363] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 422.106738][T14363] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 422.163793][T17192] netlink: 'syz.2.3106': attribute type 11 has an invalid length. [ 422.181951][T17192] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3106'. [ 422.214910][T17196] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.224691][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.334143][T17200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.343048][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.381217][T17089] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.552490][T17209] netlink: 'syz.4.3110': attribute type 13 has an invalid length. [ 422.723674][T17215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.745876][T17219] sctp: [Deprecated]: syz.0.3113 (pid 17219) Use of struct sctp_assoc_value in delayed_ack socket option. [ 422.745876][T17219] Use struct sctp_sack_info instead [ 422.779681][T17215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.796837][T17215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.816403][T17215] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.258823][ T5149] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 423.276928][ T5149] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 423.286090][ T5149] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 423.298862][ T5149] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 423.308943][ T5149] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 423.379477][T17244] hsr0 speed is unknown, defaulting to 1000 [ 423.558751][T17262] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3123'. [ 423.737914][ T52] Bluetooth: hci4: command tx timeout [ 423.744939][T17266] macsec5: entered promiscuous mode [ 423.752995][T17266] macsec5: entered allmulticast mode [ 423.761441][T17266] bond15: (slave macsec5): Error -34 calling dev_set_mtu [ 423.980639][T17271] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3124'. [ 424.103484][T17244] chnl_net:caif_netlink_parms(): no params data found [ 424.250588][T17285] netlink: 'syz.1.3127': attribute type 10 has an invalid length. [ 424.605660][T17244] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.636171][T17244] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.652023][T17244] bridge_slave_0: entered allmulticast mode [ 424.688060][T17244] bridge_slave_0: entered promiscuous mode [ 424.704712][T17244] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.720067][T17244] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.750691][T17244] bridge_slave_1: entered allmulticast mode [ 424.773446][T17244] bridge_slave_1: entered promiscuous mode [ 424.818876][T17310] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 424.849209][T17314] syzkaller0: entered promiscuous mode [ 424.856073][T17314] syzkaller0: entered allmulticast mode [ 424.931489][T17306] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3131'. [ 425.131683][T17340] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3137'. [ 425.160518][T17244] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 425.184909][T17340] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3137'. [ 425.214483][T17244] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 425.337783][ T52] Bluetooth: hci5: command tx timeout [ 425.399659][T17244] team0: Port device team_slave_0 added [ 425.446632][T17244] team0: Port device team_slave_1 added [ 425.618258][T17244] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 425.639588][T17244] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.682759][T17244] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 425.711158][T17244] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 425.727573][T17244] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.783445][T17244] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 425.837871][T17369] netlink: 'syz.1.3145': attribute type 11 has an invalid length. [ 425.907356][T17369] netlink: 'syz.1.3145': attribute type 11 has an invalid length. [ 425.948042][T17369] netlink: 204 bytes leftover after parsing attributes in process `syz.1.3145'. [ 425.958609][T17244] hsr_slave_0: entered promiscuous mode [ 425.965397][T17244] hsr_slave_1: entered promiscuous mode [ 426.018861][T17244] debugfs: 'hsr0' already exists in 'hsr' [ 426.024654][T17244] Cannot create hsr debugfs directory [ 426.182266][T17382] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3141'. [ 426.248626][T17376] kthread_run failed with err -4 [ 426.364236][T17396] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3141'. [ 427.029716][T17244] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.067937][T17244] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 427.088785][T17244] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 427.193315][T17244] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.208495][T17244] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 427.240846][T17244] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 427.347376][T17244] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.369031][T17244] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 427.384217][T17244] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 427.426506][ T52] Bluetooth: hci5: command tx timeout [ 427.489362][T17244] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.499935][T17443] netlink: 'syz.4.3159': attribute type 2 has an invalid length. [ 427.506010][T17090] net_ratelimit: 10 callbacks suppressed [ 427.506031][T17090] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.510061][T17443] __nla_validate_parse: 3 callbacks suppressed [ 427.510078][T17443] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3159'. [ 427.539165][T17244] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 427.553057][T17244] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 427.611287][T17443] bond16 (unregistering): Released all slaves [ 428.029244][T17244] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 428.065720][T17244] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 428.126614][T17244] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 428.158871][T17244] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 428.176581][T17476] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.424746][T17244] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.455961][T17492] syzkaller0: entered promiscuous mode [ 428.462080][T17492] syzkaller0: entered allmulticast mode [ 428.524561][T17244] 8021q: adding VLAN 0 to HW filter on device team0 [ 428.557183][T17108] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.564700][T17108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.646120][T17108] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.653521][T17108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.701421][T17498] netlink: 'syz.3.3174': attribute type 1 has an invalid length. [ 428.705000][T17500] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3175'. [ 428.721413][T17500] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3175'. [ 428.741205][T17500] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3175'. [ 428.942700][T17509] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3177'. [ 428.957313][T17509] netlink: 'syz.1.3177': attribute type 21 has an invalid length. [ 428.973780][T17509] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3177'. [ 428.983842][T17511] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 429.019813][T17509] netlink: 'syz.1.3177': attribute type 21 has an invalid length. [ 429.029455][T17511] syzkaller0: entered promiscuous mode [ 429.034984][T17511] syzkaller0: entered allmulticast mode [ 429.035615][T17509] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3177'. [ 429.044107][T17091] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.064455][T17091] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.073917][T17511] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 429.095974][T17091] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.114226][T17091] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.144536][T17244] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 429.357055][T17244] veth0_vlan: entered promiscuous mode [ 429.441178][T17244] veth1_vlan: entered promiscuous mode [ 429.475960][T17528] Cannot find add_set index 4 as target [ 429.509911][ T52] Bluetooth: hci5: command tx timeout [ 429.513075][T17244] veth0_macvtap: entered promiscuous mode [ 429.533954][T17529] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3183'. [ 429.555648][T17244] veth1_macvtap: entered promiscuous mode [ 429.606244][T17244] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 429.652475][T17244] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 429.670355][T17089] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.680371][T17089] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.694649][T17089] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.714169][T17089] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.957035][T17089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.983553][T17089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.072707][T17108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.082622][T17108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.156614][T17556] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.3191'. [ 430.190777][T17556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3191'. [ 430.295923][T17561] IPv6: sit1: Disabled Multicast RS [ 430.346133][T17561] sit1: entered allmulticast mode [ 431.133973][T17590] nft_compat: unsupported protocol 0 [ 431.213521][T17595] x_tables: duplicate underflow at hook 3 [ 431.395194][ T5149] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 431.406743][ T5149] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 431.446301][ T5149] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 431.456401][ T5149] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 431.466821][ T5149] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 431.508066][T17601] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 431.525374][T17603] netlink: 'syz.0.3208': attribute type 1 has an invalid length. [ 431.579852][ T52] Bluetooth: hci5: command tx timeout [ 431.622814][T14363] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 431.636222][T14363] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.024688][T14363] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.081083][T14363] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.166760][T17597] hsr0 speed is unknown, defaulting to 1000 [ 432.243161][T14363] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.266032][T14363] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.271253][T17628] netlink: 'syz.0.3214': attribute type 1 has an invalid length. [ 432.445148][T17628] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 432.480838][T14363] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 432.513454][T14363] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.730614][T17640] __nla_validate_parse: 8 callbacks suppressed [ 432.730635][T17640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3217'. [ 432.960359][T17650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3219'. [ 432.970749][T17649] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3219'. [ 433.032035][T14363] batadv2: left allmulticast mode [ 433.037977][T14363] batadv2: left promiscuous mode [ 433.045143][T14363] bridge0: port 2(batadv2) entered disabled state [ 433.072768][T14363] batadv1: left allmulticast mode [ 433.088759][T14363] batadv1: left promiscuous mode [ 433.104209][T14363] bridge0: port 1(batadv1) entered disabled state [ 433.512664][ T52] Bluetooth: hci1: command tx timeout [ 433.798397][T14363] dvmrp6 (unregistering): left allmulticast mode [ 434.293653][T14363] bond0 (unregistering): Released all slaves [ 434.313939][T14363] bond1 (unregistering): Released all slaves [ 434.424558][T14363] bond2 (unregistering): Released all slaves [ 434.440313][T14363] bond3 (unregistering): Released all slaves [ 434.454318][T14363] bond4 (unregistering): Released all slaves [ 434.470540][T14363] bond5 (unregistering): Released all slaves [ 434.603314][T14363] bond6 (unregistering): Released all slaves [ 434.716270][T14363] bond7 (unregistering): Released all slaves [ 434.821871][T14363] bond8 (unregistering): Released all slaves [ 434.835226][T14363] bond9 (unregistering): Released all slaves [ 434.850874][T14363] bond10 (unregistering): Released all slaves [ 434.964388][T14363] bond11 (unregistering): Released all slaves [ 434.979305][T14363] bond12 (unregistering): Released all slaves [ 435.086725][T14363] bond13 (unregistering): Released all slaves [ 435.101983][T14363] bond14 (unregistering): Released all slaves [ 435.117043][T14363] bond15 (unregistering): Released all slaves [ 435.402987][T14363] : left promiscuous mode [ 435.578163][ T52] Bluetooth: hci1: command tx timeout [ 435.624152][T17597] chnl_net:caif_netlink_parms(): no params data found [ 435.670504][T14363] tipc: Disabling bearer [ 435.689726][T14363] tipc: Disabling bearer [ 435.705971][T14363] tipc: Disabling bearer [ 435.727064][T14363] tipc: Left network mode [ 435.933238][T14363] IPVS: stopping master sync thread 13289 ... [ 436.140550][T17722] netlink: 45 bytes leftover after parsing attributes in process `syz.1.3233'. [ 436.242672][T17738] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3235'. [ 436.488270][T17749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 436.509944][T17597] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.521375][T17597] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.540088][T17597] bridge_slave_0: entered allmulticast mode [ 436.555928][T17597] bridge_slave_0: entered promiscuous mode [ 436.671509][T17745] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 436.692148][T17745] gretap1: entered promiscuous mode [ 436.700290][T17745] gretap1: entered allmulticast mode [ 436.727237][T17597] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.756248][T17597] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.788319][T17597] bridge_slave_1: entered allmulticast mode [ 436.814863][T17597] bridge_slave_1: entered promiscuous mode [ 437.094024][T17597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 437.198207][T17597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 437.222297][T17785] netlink: 'syz.0.3247': attribute type 13 has an invalid length. [ 437.231758][T17788] netlink: 'syz.0.3247': attribute type 2 has an invalid length. [ 437.453930][T17597] team0: Port device team_slave_0 added [ 437.494419][T14363] hsr_slave_0: left promiscuous mode [ 437.541834][T14363] hsr_slave_1: left promiscuous mode [ 437.550420][T14363] batman_adv: batadv0: Interface deactivated: macsec2 [ 437.563203][T14363] batman_adv: batadv0: Removing interface: macsec2 [ 437.587323][T14363] batadv_slave_0: left promiscuous mode [ 437.593925][T14363] veth1_macvtap: left promiscuous mode [ 437.601304][T14363] veth1_vlan: left promiscuous mode [ 437.608497][T14363] veth0_vlan: left promiscuous mode [ 437.657683][ T52] Bluetooth: hci1: command tx timeout [ 438.790866][T17597] team0: Port device team_slave_1 added [ 438.821544][ T6746] hsr0 speed is unknown, defaulting to 1000 [ 438.822240][T17811] tipc: Enabling of bearer rejected, failed to enable media [ 438.827897][ T6746] infiniband syz1: ib_query_port failed (-19) [ 438.990997][T17829] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3259'. [ 439.007307][T17829] netlink: 'syz.3.3259': attribute type 29 has an invalid length. [ 439.029324][T17829] netlink: 'syz.3.3259': attribute type 29 has an invalid length. [ 439.041198][T17597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 439.060332][T17597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.123987][T17597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 439.166455][T17597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 439.171183][T17829] netlink: 500 bytes leftover after parsing attributes in process `syz.3.3259'. [ 439.200964][T17597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.229918][T17843] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3261'. [ 439.254219][T17843] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3261'. [ 439.279131][T17597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 439.394850][T17831] tipc: Started in network mode [ 439.400197][T17831] tipc: Node identity 2ed7ffc4c08e, cluster identity 4711 [ 439.409585][T17831] tipc: Enabled bearer , priority 0 [ 439.441182][T17831] syzkaller0: entered promiscuous mode [ 439.448346][T17831] syzkaller0: entered allmulticast mode [ 439.555136][T17597] hsr_slave_0: entered promiscuous mode [ 439.576413][T17597] hsr_slave_1: entered promiscuous mode [ 439.592469][T17597] debugfs: 'hsr0' already exists in 'hsr' [ 439.598881][T17597] Cannot create hsr debugfs directory [ 439.622442][T17844] tipc: Resetting bearer [ 439.643397][T17831] netlink: 'syz.1.3260': attribute type 29 has an invalid length. [ 439.738897][ T52] Bluetooth: hci1: command tx timeout [ 439.752923][T17868] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 439.753719][T17855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 439.806656][T17830] tipc: Resetting bearer [ 439.879252][T17830] tipc: Disabling bearer [ 439.889251][T17874] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3266'. [ 440.119756][T14363] IPVS: stop unused estimator thread 0... [ 440.842457][T17913] tipc: Enabled bearer , priority 0 [ 441.061940][T17913] tipc: Disabling bearer [ 441.156884][T17931] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 441.494047][T17943] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3286'. [ 441.964971][T17597] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 442.097555][T17597] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 442.211316][T17597] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 442.263116][T17597] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 442.421072][T18001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3296'. [ 442.528816][T18006] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3298'. [ 442.734480][T17597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 442.842389][T17597] 8021q: adding VLAN 0 to HW filter on device team0 [ 442.898371][T17091] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.905677][T17091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 442.997830][T14364] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.005620][T14364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 443.101853][T18029] tipc: Enabled bearer , priority 0 [ 443.131191][T18029] syzkaller0: entered promiscuous mode [ 443.155367][T18038] netlink: 27 bytes leftover after parsing attributes in process `syz.0.3306'. [ 443.168442][T18029] syzkaller0: entered allmulticast mode [ 443.206747][T18042] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 443.317748][T18047] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3308'. [ 443.358579][T18050] tipc: Resetting bearer [ 443.400337][T18026] tipc: Resetting bearer [ 443.475340][T18026] tipc: Disabling bearer [ 443.697762][T18064] netlink: 'syz.2.3313': attribute type 29 has an invalid length. [ 443.705942][T18067] netlink: 'syz.2.3313': attribute type 29 has an invalid length. [ 443.822483][T18067] netlink: 'syz.2.3313': attribute type 1 has an invalid length. [ 444.247989][T18098] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 444.255711][T18098] IPv6: NLM_F_CREATE should be set when creating new route [ 444.256838][T17597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.294545][T18102] __nla_validate_parse: 3 callbacks suppressed [ 444.294568][T18102] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3321'. [ 444.324458][T18101] netlink: 'syz.3.3319': attribute type 3 has an invalid length. [ 444.886747][T18128] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3325'. [ 445.105664][T17597] veth0_vlan: entered promiscuous mode [ 445.168637][T18136] vlan2: entered promiscuous mode [ 445.186078][T18136] bridge0: entered promiscuous mode [ 445.204216][T17597] veth1_vlan: entered promiscuous mode [ 445.321467][T17597] veth0_macvtap: entered promiscuous mode [ 445.362304][T17597] veth1_macvtap: entered promiscuous mode [ 445.536915][T17597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 445.594186][T17597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 445.627132][T18150] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 445.681682][T18153] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3331'. [ 445.722449][T14363] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.770067][T14364] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.782294][T18153] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 445.804532][T14364] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 445.894207][T14364] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.305093][T17091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 446.314455][T18186] netlink: 'syz.3.3337': attribute type 3 has an invalid length. [ 446.357879][T17091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 446.536763][T17088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 446.558825][T18199] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3340'. [ 446.573702][T17088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 446.681289][T18202] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3342'. [ 446.869868][T18211] openvswitch: netlink: Actions may not be safe on all matching packets [ 446.964500][T18221] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 447.130761][T18227] ip6gre0: mtu less than device minimum [ 447.140877][T18229] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3349'. [ 447.154972][T18229] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3349'. [ 447.166592][T18229] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3349'. [ 447.191432][T18229] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3349'. [ 447.217338][T18234] IPVS: set_ctl: invalid protocol: 92 100.1.1.1:20000 [ 447.224878][ T5884] IPVS: starting estimator thread 0... [ 447.233794][T18237] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 447.243499][T18238] IPVS: set_ctl: invalid protocol: 92 100.1.1.1:20000 [ 447.330151][T18239] IPVS: using max 24 ests per chain, 57600 per kthread [ 447.668575][T18256] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3357'. [ 447.765985][T18259] tipc: Enabled bearer , priority 0 [ 447.789426][T18259] syzkaller0: entered promiscuous mode [ 447.794961][T18259] syzkaller0: entered allmulticast mode [ 447.924033][T18259] tipc: Resetting bearer [ 447.994512][T18258] tipc: Resetting bearer [ 448.120065][T18258] tipc: Disabling bearer [ 448.481812][ T5149] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 448.492860][ T5149] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 448.508693][ T5149] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 448.523694][ T5149] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 448.533579][ T5149] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 448.816744][T18308] C: renamed from lo (while UP) [ 448.855846][T18308] netlink: 'syz.4.3371': attribute type 39 has an invalid length. [ 449.045855][ T30] audit: type=1107 audit(1762740045.475:7): pid=18324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 449.128748][T18327] syzkaller0: entered promiscuous mode [ 449.134312][T18327] syzkaller0: entered allmulticast mode [ 449.258818][ T31] INFO: task udevd:5839 blocked for more than 143 seconds. [ 449.266189][ T31] Not tainted syzkaller #0 [ 449.276413][T18341] netlink: 'syz.1.3376': attribute type 1 has an invalid length. [ 449.279527][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 449.307549][ T31] task:udevd state:D stack:21864 pid:5839 tgid:5839 ppid:5199 task_flags:0x400140 flags:0x00080003 [ 449.311620][T18340] __nla_validate_parse: 6 callbacks suppressed [ 449.311638][T18340] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3380'. [ 449.321119][ T31] Call Trace: [ 449.338985][ T31] [ 449.342142][ T31] __schedule+0x1798/0x4cc0 [ 449.347216][ T31] ? __pfx___schedule+0x10/0x10 [ 449.353554][ T31] ? schedule+0x91/0x360 [ 449.358264][ T31] schedule+0x165/0x360 [ 449.362472][ T31] io_schedule+0x80/0xd0 [ 449.385175][ T31] folio_wait_bit_common+0x6b0/0xb80 [ 449.395107][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 449.402099][T18347] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3381'. [ 449.412555][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 449.420527][ T31] ? __filemap_get_folio+0x6c0/0xaf0 [ 449.426149][ T31] ? do_read_cache_folio+0x4e9/0x590 [ 449.432593][T18347] xt_TCPMSS: Only works on TCP SYN packets [ 449.432618][ T31] do_read_cache_folio+0x1aa/0x590 [ 449.443893][ T31] ? __pfx_blkdev_read_folio+0x10/0x10 [ 449.449638][ T31] read_part_sector+0xb6/0x2b0 [ 449.454446][ T31] adfspart_check_POWERTEC+0x8c/0xf30 [ 449.460312][ T31] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 449.465930][ T31] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 449.472239][ T31] bdev_disk_changed+0x75f/0x14b0 [ 449.477311][ T31] ? __pfx_bdev_disk_changed+0x10/0x10 [ 449.484514][ T31] ? wait_on_inode+0xc0/0x230 [ 449.489691][ T31] blkdev_get_whole+0x380/0x510 [ 449.494616][ T31] bdev_open+0x31e/0xd30 [ 449.499148][ T31] blkdev_open+0x457/0x600 [ 449.503615][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 449.508991][ T31] do_dentry_open+0x953/0x13f0 [ 449.513823][ T31] vfs_open+0x3b/0x340 [ 449.519284][ T31] ? path_openat+0x2ecd/0x3830 [ 449.524161][ T31] path_openat+0x2ee5/0x3830 [ 449.529872][ T31] ? __pfx_path_openat+0x10/0x10 [ 449.534879][ T31] do_filp_open+0x1fa/0x410 [ 449.539546][ T31] ? __lock_acquire+0xab9/0xd20 [ 449.544431][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 449.550105][ T31] ? _raw_spin_unlock+0x28/0x50 [ 449.554979][ T31] ? alloc_fd+0x64c/0x6c0 [ 449.560267][ T31] do_sys_openat2+0x121/0x1c0 [ 449.565067][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 449.570596][ T31] __x64_sys_openat+0x138/0x170 [ 449.575489][ T31] do_syscall_64+0xfa/0xfa0 [ 449.581554][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.589046][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 449.595246][ T31] ? clear_bhb_loop+0x60/0xb0 [ 449.600149][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.606164][ T31] RIP: 0033:0x7fc3a88a7407 [ 449.611334][ T31] RSP: 002b:00007ffd5626f5f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 449.620052][ T31] RAX: ffffffffffffffda RBX: 00007fc3a9097880 RCX: 00007fc3a88a7407 [ 449.628388][ T31] RDX: 00000000000a0800 RSI: 0000564d7ccc02d0 RDI: ffffffffffffff9c [ 449.636591][ T31] RBP: 0000564d7ccbf910 R08: 0000000000000000 R09: 0000000000000000 [ 449.644938][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 0000564d7ccd4830 [ 449.653437][ T31] R13: 0000564d7cccd190 R14: 0000000000000000 R15: 0000564d7ccd4830 [ 449.662029][ T31] [ 449.665366][ T31] [ 449.665366][ T31] Showing all locks held in the system: [ 449.675926][ T31] 1 lock held by khungtaskd/31: [ 449.681009][ T31] #0: ffffffff8df3d660 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 449.692042][ T31] 2 locks held by getty/5593: [ 449.696765][ T31] #0: ffff88802fe3b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 449.706928][ T31] #1: ffffc900036ce2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 449.717308][ T31] 1 lock held by udevd/5839: [ 449.722180][ T31] #0: ffff888143f73358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 449.731848][ T31] 3 locks held by kworker/u8:23/17088: [ 449.737333][ T31] #0: ffff88801a069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 449.752185][ T31] #1: ffffc900041f7ba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 449.764103][ T31] #2: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 449.773374][ T31] 1 lock held by syz-executor/18293: [ 449.778804][ T31] #0: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 [ 449.788671][ T31] 2 locks held by syz.1.3376/18327: [ 449.795027][ T31] #0: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 449.804576][ T31] #1: ffffffff8df430f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 449.815724][ T31] 1 lock held by syz.1.3376/18336: [ 449.822005][ T31] #0: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 449.831836][ T31] 1 lock held by syz.3.3379/18335: [ 449.837173][ T31] #0: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x37a/0x1df0 [ 449.846705][ T31] 2 locks held by syz.2.3380/18340: [ 449.852893][ T31] #0: ffffffff8f7eb668 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 449.864032][ T31] #1: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 [ 449.873497][ T31] 1 lock held by syz.4.3381/18347: [ 449.879200][ T31] #0: ffffffff8f2cb708 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_delroute+0x107/0x2f0 [ 449.888968][ T31] [ 449.891332][ T31] ============================================= [ 449.891332][ T31] [ 449.910140][ T31] NMI backtrace for cpu 1 [ 449.910168][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 449.910190][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 449.910202][ T31] Call Trace: [ 449.910210][ T31] [ 449.910219][ T31] dump_stack_lvl+0x189/0x250 [ 449.910256][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 449.910282][ T31] ? __pfx__printk+0x10/0x10 [ 449.910318][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 449.910344][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 449.910370][ T31] ? __pfx__printk+0x10/0x10 [ 449.910395][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 449.910429][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 449.910453][ T31] watchdog+0xf60/0xfa0 [ 449.910481][ T31] ? watchdog+0x1e2/0xfa0 [ 449.910508][ T31] kthread+0x711/0x8a0 [ 449.910536][ T31] ? __pfx_watchdog+0x10/0x10 [ 449.910555][ T31] ? __pfx_kthread+0x10/0x10 [ 449.910581][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 449.910607][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 449.910631][ T31] ? __pfx_kthread+0x10/0x10 [ 449.910657][ T31] ret_from_fork+0x4bc/0x870 [ 449.910681][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 449.910710][ T31] ? __switch_to_asm+0x39/0x70 [ 449.910726][ T31] ? __switch_to_asm+0x33/0x70 [ 449.910740][ T31] ? __pfx_kthread+0x10/0x10 [ 449.910765][ T31] ret_from_fork_asm+0x1a/0x30 [ 449.910799][ T31] [ 449.910807][ T31] Sending NMI from CPU 1 to CPUs 0: [ 450.061647][ C0] NMI backtrace for cpu 0 [ 450.061665][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 450.061681][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 450.061691][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 450.061716][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 d1 21 00 f3 0f 1e fa fb f4 c8 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 450.061730][ C0] RSP: 0018:ffffffff8dc07d80 EFLAGS: 000002c6 [ 450.061745][ C0] RAX: b88d3cf87374e100 RBX: ffffffff81967bf7 RCX: b88d3cf87374e100 [ 450.061756][ C0] RDX: 0000000000000001 RSI: ffffffff8d70dbaf RDI: ffffffff8bbf0760 [ 450.061767][ C0] RBP: ffffffff8dc07ea8 R08: ffff8880b8832fdb R09: 1ffff110171065fb [ 450.061778][ C0] R10: dffffc0000000000 R11: ffffed10171065fc R12: ffffffff8f7ce270 [ 450.061789][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1b92a40 [ 450.061799][ C0] FS: 0000000000000000(0000) GS:ffff88812613b000(0000) knlGS:0000000000000000 [ 450.061812][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 450.061822][ C0] CR2: 00007f717d9b4198 CR3: 000000007fbbc000 CR4: 00000000003526f0 [ 450.061839][ C0] Call Trace: [ 450.061845][ C0] [ 450.061851][ C0] default_idle+0x13/0x20 [ 450.061865][ C0] default_idle_call+0x73/0xb0 [ 450.061881][ C0] do_idle+0x1e7/0x510 [ 450.061900][ C0] ? __pfx_do_idle+0x10/0x10 [ 450.061924][ C0] cpu_startup_entry+0x44/0x60 [ 450.061939][ C0] rest_init+0x2de/0x300 [ 450.061955][ C0] start_kernel+0x3ae/0x410 [ 450.061973][ C0] x86_64_start_reservations+0x24/0x30 [ 450.061992][ C0] x86_64_start_kernel+0x143/0x1c0 [ 450.062011][ C0] common_startup_64+0x13e/0x147 [ 450.062038][ C0] [ 450.252329][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.264281][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.272983][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.282902][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.291394][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.300090][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.310618][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.318853][T18347] netlink: 'syz.4.3381': attribute type 3 has an invalid length. [ 450.371661][T18293] chnl_net:caif_netlink_parms(): no params data found [ 450.466495][T18293] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.476482][T18293] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.484207][T18293] bridge_slave_0: entered allmulticast mode [ 450.491744][T18293] bridge_slave_0: entered promiscuous mode [ 450.501002][T18293] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.510227][T18293] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.518731][T18293] bridge_slave_1: entered allmulticast mode [ 450.526105][T18293] bridge_slave_1: entered promiscuous mode [ 450.562106][T18293] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 450.577837][T18293] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 450.615849][T18293] team0: Port device team_slave_0 added [ 450.617932][ T52] Bluetooth: hci0: command tx timeout [ 450.626808][T18293] team0: Port device team_slave_1 added [ 450.658777][T18293] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 450.665767][T18293] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 450.692769][T18293] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 450.706613][T18293] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 450.714439][T18293] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 450.741483][T18293] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 450.789031][T18293] hsr_slave_0: entered promiscuous mode [ 450.795606][T18293] hsr_slave_1: entered promiscuous mode [ 450.803680][T18293] debugfs: 'hsr0' already exists in 'hsr' [ 450.810348][T18293] Cannot create hsr debugfs directory [ 451.221569][T18293] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 451.233610][T18293] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 451.243915][T18293] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 451.254138][T18293] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 451.343820][T18293] 8021q: adding VLAN 0 to HW filter on device bond0 [ 451.366941][T18293] 8021q: adding VLAN 0 to HW filter on device team0 [ 451.380411][T17088] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.387709][T17088] bridge0: port 1(bridge_slave_0) entered forwarding state [ 451.404721][T17108] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.411923][T17108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 451.607125][T18293] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.659743][T18293] veth0_vlan: entered promiscuous mode [ 451.672787][T18293] veth1_vlan: entered promiscuous mode [ 451.705905][T18293] veth0_macvtap: entered promiscuous mode [ 451.715291][T18293] veth1_macvtap: entered promiscuous mode [ 451.740953][T18293] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 451.757406][T18293] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 451.773384][T14364] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.783037][T14364] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.794436][T14364] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.804495][T14364] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.893569][T17108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.908317][T17108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.938728][T17108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.948374][T17108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.698062][ T52] Bluetooth: hci0: command tx timeout [ 454.778507][ T52] Bluetooth: hci0: command tx timeout [ 456.858323][ T52] Bluetooth: hci0: command tx timeout