last executing test programs: 2.368938092s ago: executing program 1 (id=3883): r0 = socket$inet(0x2, 0x80001, 0x84) listen(r0, 0x2f) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e21, 0x5, @loopback, 0x4}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="b4050000000000006110a40000eaffff62010d00000000009500090000000000507147dd4506aaf2085f3568ee7725d12c9f122896638327c1d573b6660f3a7d6ffd4f1702fc2fb1f193e6a0848410b7"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xb7, &(0x7f000000cf3d)=""/183, 0x0, 0x2, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x94) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) sendmsg$tipc(r3, &(0x7f00000000c0)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x3}, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x20000080) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) r4 = accept4(r1, 0x0, 0x0, 0x0) connect$l2tp6(r4, 0x0, 0x0) r5 = socket$caif_stream(0x25, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000003080101000000000000000000000000050003000600000006000240000000002400048008000440000000000800054000000000040007"], 0x48}}, 0x0) setsockopt$sock_int(r5, 0x1, 0xc, &(0x7f0000000300)=0x3ff, 0x4) connect$caif(r5, &(0x7f0000000100)=@rfm={0x25, 0x0, "d034e68fae880aca9de7751355b0eb74"}, 0x18) r7 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r7, 0x111, 0x4, 0x1, 0x4) listen(r0, 0x4) listen(r0, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x8000, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7, 0x0, 0x0, @multicast2, @private}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f3, &(0x7f0000001a80)={'syztnl0\x00', &(0x7f0000000140)={'gre0\x00', r9, 0x20, 0x20, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x27, 0x0, 0x0, 0x0, 0x0, @empty, @empty}}}}) listen(r7, 0xaea) 1.668404548s ago: executing program 1 (id=3891): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0xd07, 0xc041}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x20}}, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001e000504000000000000000004"], 0x114}], 0x1}, 0x10) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000580)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @private1, 0x7fff}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)="17", 0x1}], 0x1}}], 0x2, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, 0x0, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000000)={0x41424344, 0x41424344}, 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f00000000c0)={0x41424344, 0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x1eb, &(0x7f0000000640)={@local, @multicast, @val={@val={0x88a8, 0x2, 0x1, 0x2}, {0x8100, 0x6}}, {@ipv6={0x86dd, @tcp={0x2, 0x6, "01b400", 0x1ad, 0x6, 0x0, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@fragment={0x3c, 0x0, 0x9, 0x0, 0x0, 0x4, 0x66}, @hopopts={0x1, 0x0, '\x00', [@pad1]}, @fragment={0x1d, 0x0, 0x1, 0x0, 0x0, 0x1b, 0x64}, @fragment={0x32, 0x0, 0x8, 0x0, 0x0, 0x9, 0x64}, @dstopts={0x62, 0x4, '\x00', [@jumbo={0xc2, 0x4, 0x3}, @jumbo={0xc2, 0x4, 0x6}, @hao={0xc9, 0x10, @empty}, @pad1]}, @hopopts={0x3a, 0x8, '\x00', [@jumbo, @ra={0x5, 0x2, 0x4}, @calipso={0x7, 0x28, {0x0, 0x8, 0x9, 0x3, [0x6, 0x3, 0x9, 0x1]}}, @hao={0xc9, 0x10, @mcast1}]}, @srh={0x62, 0xe, 0x4, 0x7, 0x4, 0x30, 0x80, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1, @mcast1, @private1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @mcast2, @private1]}], {{0x4e21, 0x4e21, r2, r3, 0x0, 0x0, 0xe, 0x4, 0x6, 0x0, 0x9, {[@sack={0x5, 0x2}, @exp_smc={0xfe, 0x6}, @window={0x3, 0x3, 0x8}, @mptcp=@add_addr={0x1e, 0xf, 0x0, 0xf, 0xb, @remote, 0x2, "1980b151b1"}, @mss={0x2, 0x4, 0x7a92}, @window={0x3, 0x3, 0x9}, @nop]}}, {"2741c9f621dd8384fad1ea1b713eb1bf6d5e63a69144040b13691f1c13ec6d620deea3c35fd8e098ee5075adc5b57b85dd1a96c41e1806c69af48f2e201278e544b211972d3e274430010772189188bf79f4286149"}}}}}}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a03030000000000000000020000000c00024000000000000000020900010073797a30"], 0x54}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003940)=[{{&(0x7f0000000040)={0x2, 0x0, @local}, 0x10, 0x0}}], 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x14, &(0x7f0000000040), 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {}, {0xfff1, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0xd07, 0xc041}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x20}}, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001e000504000000000000000004"], 0x114}], 0x1}, 0x10) (async) socket$inet6_sctp(0xa, 0x801, 0x84) (async) sendmmsg$inet6(r1, &(0x7f0000000580)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000340)="f2", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e24, 0xff, @private1, 0x7fff}, 0x1c, &(0x7f0000000400)=[{&(0x7f00000001c0)="17", 0x1}], 0x1}}], 0x2, 0x0) (async) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, 0x0, 0x0) (async) syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) (async) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) (async) syz_emit_ethernet(0x1eb, &(0x7f0000000640)={@local, @multicast, @val={@val={0x88a8, 0x2, 0x1, 0x2}, {0x8100, 0x6}}, {@ipv6={0x86dd, @tcp={0x2, 0x6, "01b400", 0x1ad, 0x6, 0x0, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[@fragment={0x3c, 0x0, 0x9, 0x0, 0x0, 0x4, 0x66}, @hopopts={0x1, 0x0, '\x00', [@pad1]}, @fragment={0x1d, 0x0, 0x1, 0x0, 0x0, 0x1b, 0x64}, @fragment={0x32, 0x0, 0x8, 0x0, 0x0, 0x9, 0x64}, @dstopts={0x62, 0x4, '\x00', [@jumbo={0xc2, 0x4, 0x3}, @jumbo={0xc2, 0x4, 0x6}, @hao={0xc9, 0x10, @empty}, @pad1]}, @hopopts={0x3a, 0x8, '\x00', [@jumbo, @ra={0x5, 0x2, 0x4}, @calipso={0x7, 0x28, {0x0, 0x8, 0x9, 0x3, [0x6, 0x3, 0x9, 0x1]}}, @hao={0xc9, 0x10, @mcast1}]}, @srh={0x62, 0xe, 0x4, 0x7, 0x4, 0x30, 0x80, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1, @mcast1, @private1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @mcast2, @private1]}], {{0x4e21, 0x4e21, r2, r3, 0x0, 0x0, 0xe, 0x4, 0x6, 0x0, 0x9, {[@sack={0x5, 0x2}, @exp_smc={0xfe, 0x6}, @window={0x3, 0x3, 0x8}, @mptcp=@add_addr={0x1e, 0xf, 0x0, 0xf, 0xb, @remote, 0x2, "1980b151b1"}, @mss={0x2, 0x4, 0x7a92}, @window={0x3, 0x3, 0x9}, @nop]}}, {"2741c9f621dd8384fad1ea1b713eb1bf6d5e63a69144040b13691f1c13ec6d620deea3c35fd8e098ee5075adc5b57b85dd1a96c41e1806c69af48f2e201278e544b211972d3e274430010772189188bf79f4286149"}}}}}}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a03030000000000000000020000000c00024000000000000000020900010073797a30"], 0x54}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003940)=[{{&(0x7f0000000040)={0x2, 0x0, @local}, 0x10, 0x0}}], 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$sock_int(r6, 0x1, 0x14, &(0x7f0000000040), 0x50) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {}, {0xfff1, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) (async) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) (async) 1.611485472s ago: executing program 2 (id=3892): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000140000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff080001400000000208000140000000013400018008000140764f15e208000140000000000800014000000007ebfd014000000000080001400000000908000140000000001c000180080001400000002808000140000000cb0800014000000008"], 0x140}}, 0x0) (async) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) close(r1) (async) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) listen(r2, 0x0) (async) listen(r2, 0x7f3d) (async) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=ANY=[@ANYBLOB="48000000100003052abd70000400000000000000", @ANYRES32=0x0, @ANYBLOB="18800300a0010200140012800b0001006d619fb0637365630000040002800800", @ANYRES32=r4, @ANYBLOB="0a000200aaaaaaaaaabb0000"], 0x48}}, 0x800) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="2400000007063c84df321df47f06336b0101000000000000000001000003080086400000"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4000840) r8 = socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0xa00, 0x0, 0x0, {0x3, 0x0, 0x7}}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, @NFT_OBJECT_SECMARK=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}}, 0x8050) (async) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f5f626174616476001400350001657468315f6d6163767461700000001400350067726530000000000000000000000000140035006261746164765f736c6176655f31000008000f"], 0xe8}}, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) shutdown(r8, 0x0) 1.609377976s ago: executing program 3 (id=3893): bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0xa0, 0x7b, 0xa, 0xff00}, [@call={0x1d, 0xa}, @exit, @map_fd={0x18, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x10, 0x0, 0x0, 0x25000000}, @generic]}, &(0x7f0000000140)='GPL\x00', 0xa, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x47, 0x10, 0x0, 0x1e}, 0x2d) r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000740)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000780)={0x20, r0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x20}, 0x1, 0x0, 0x0, 0x8045}, 0x20040010) syz_emit_ethernet(0x66, &(0x7f0000000180)=ANY=[@ANYBLOB="69e1629b6174391e7dd7a2d786dd60b6000000302c03cb697a653e336f000000500000000000ff02000000000000000000000000000102000003"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="e706f2ffff1f391e7dd7a2d786dd609907a600302c03cb697a653e336f000000500000000000ff020000000000000000000000000001020090"], 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000000)=0x1, 0x4) 1.300216897s ago: executing program 2 (id=3896): r0 = socket$kcm(0x11, 0x3, 0x0) unshare(0x6020400) r1 = socket$vsock_stream(0x28, 0x1, 0x0) shutdown(r1, 0x300) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0xdd86, 0x2c}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000080)='b', 0x28}], 0x1}, 0x0) 1.234055614s ago: executing program 0 (id=3897): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, '\x00', 0x28}, 0x400}, 0x1c) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000140)={0x54, r0, 0x1, 0x0, 0x3, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'tunl0\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d45db24352fd6875313d9a7de85759f58b6d3335d4ff7169"}]]}, 0x54}}, 0x0) 1.183195767s ago: executing program 3 (id=3898): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x339) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) r2 = socket(0x1e, 0x1, 0x0) setsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x8a, &(0x7f0000000040)=0x7e, 0x4) close(r0) 1.123431427s ago: executing program 0 (id=3899): r0 = socket(0x10, 0x3, 0x0) (async) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) recvfrom$inet(r0, &(0x7f0000000080)=""/43, 0x2b, 0x40000040, &(0x7f0000000280)={0x2, 0x4e22, @multicast1}, 0x10) (async) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'ip6gre0\x00', @ifru_data=&(0x7f0000000500)="1a4cf331728a2ab98f4b19a5a033e412b2a11fbbb6a3a9c9e6bea5f37dbca046"}) (async) ioctl$sock_netdev_private(r1, 0x89f1, &(0x7f0000000000)) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@ipv6_getaddrlabel={0x1c, 0x1e, 0x492dfc465ae32a8d, 0x0, 0x0, {0xa, 0x0, 0x38}}, 0x1c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180500000000000000000000000000008510000006000000180000000000000000000000000000006600000000000000181e950000000000000034000100000000009500000000000000000000000000d38cdd970000000079e303576f46aa1c28862e44f6fec14ab3564f9946fe83ac1ce19c87194a96ae972a3231d42e08713eb1dd6b07377d4dee2e0651540039fd0d12107d61c0dce50cee2a023bc5aeecf8ff9287"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x90) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, 0x0, 0x0) (async) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050029bd7000fbdbdf252e00000008000300", @ANYRES32=r4, @ANYBLOB="0a003400020202020202000005001801330000000800350000000200"], 0x38}}, 0x0) (async) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x7d4165c9) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000140)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x91, @remote, 0x1}}, 0x0, 0x0, 0x32, 0x0, "0c9e089c1b4a04000bde79f04103c458187eb46c2d996aff287154e786455261c425a7519cc275d04e6205abd307a0c4fa3838bf399ad5bd35f21907c7988d1300"}, 0xd8) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r9, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x0, @private1={0xfc, 0x1, '\x00', 0xfe}, 0x2}}, 0x0, 0x0, 0x4, 0x0, "a1c1dd75a6843e10951cd4b347113e55eb499519becf7542c90bc21470e441225642855b5f2faed4a18d67efd5f2fdf98328de94410300"}, 0xd8) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r10) socket$inet6_mptcp(0xa, 0x1, 0x106) 1.073972883s ago: executing program 1 (id=3900): socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x4000}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x14, 0x0, &(0x7f0000000380)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, 0x0, 0x0) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, &(0x7f000000a940)={0x23, 0x9, 0xfd, 0x82}, 0x10) (async) connect$phonet_pipe(r4, &(0x7f000000a940)={0x23, 0x9, 0xfd, 0x82}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r5, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'veth0_macvtap\x00', 0x0}) sendmmsg$inet(r5, &(0x7f0000002240)=[{{&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @local, @loopback}}}], 0x20}}], 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x12, &(0x7f0000000180)=0x800001, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r9, @ANYBLOB="00001700000000001c003780"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r11, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000e40)={0x1c, r12, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008894}, 0x44010) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f00000000c0)={'wpan4\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f00000000c0)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000100)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000440)={0x70, r12, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xfffe}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0x555d}]}, 0x70}, 0x1, 0x0, 0x0, 0x10040}, 0x40881) (async) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r13, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000440)={0x70, r12, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xffff}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xfffe}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0x555d}]}, 0x70}, 0x1, 0x0, 0x0, 0x10040}, 0x40881) bind$inet6(r2, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) listen(r7, 0xd391) (async) listen(r7, 0xd391) syz_emit_ethernet(0x4a, &(0x7f00000002c0)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x7e, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x5, 0xc2}}}}}}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYRESHEX], 0x20}}, 0x0) 1.073631266s ago: executing program 2 (id=3901): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d40)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c783, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x34004, 0x0, 0xffffffff, 0x0, 0x1}}]}}]}, 0x14c}}, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x2d, 'cpu'}]}, 0x5) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2, 0x31}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18020000f9ffffff0000000000000000850000004100000095000000000000003d789ade838a5adf0c21f97a9d6f55528c474cb385573d9fd2aff88c497a5d0ab93dbb1df77098cacd277206f0902cf2c1d66e1ef4fe6deeaf8739f048bff4c9d61b5c334ef7384130fd875789e46307b8f29c46149360bea59a42011aabc5001093a06d23b6cf4f033c6000c3ab63ee036fe7023574b86c8964c32f955d410083f7567735a2ca0100000000000000c644e801f17579bac767236f2b3addb04f55cee250cb376879ae14b9e1ab98703bc7db41925c55b0a4141ae3c08d264831d0f6365469c35621850000f6ff0000000000000000000000000000000000317dc59df6de3bfd0d7f785ff1e9606c84574e4b80937ae83516d820278c4c3fda817aeb17be0cca599b7c4bf6350dcb747508404034d9478ff88e1cbfe43f46a1a5d9239e393f2bb309160118a787cb0c64b606ffe744f79c1bba0ca081302b0f04e377f1b6a3646cbe934ef6ad95d4f160a9dcc9550f9777ca5d2daa2b239547f27a221d2eefb2c40ffe95c97ce091b7c2a8c0471b9124af726edb5a3b9aba486b93cb5ea7fff68f53401f8e826d5afbb98ed8b015dc328a507d15260a18a79110e68f1d43dad73121b60ec43e98e3f522b61a4f8fc0ba0257e8fd5ac428b986c49c76395b5a51c2c75d8c1453771915705bd0925cf573b0a9c01d8e552fe288d3c0433cbe801747f335448deb0e7164f6df7d3554bc66ff51352f912d76519aa6290fe7e72402000000e85552c5c049dde27c5294dc77c8a4490492a6deb8108c14ac9a261e2d990f65ea36f217783759c06e37c3a2f3b0b3c3893700152cdca1a4a045b3645b827c989b6a42f3a19d7df9b6c176a209afe66b38ab5a44bffc22ff89f0f03345e2f83f38b01df7ad086b462aad68f9fdf167f53fac61f511bf206de4eaf6d3eabde1bbe1077c3df5ff031bb8e9fc7f562c68e71db1dc7e61eb73a7b068ed9782ab069743d99dfe6209bd936d3e706df924e7043c5a66b730b6c64b6df44ad36788bd93ac57fd67baf927ec64f9ba759e7d4ed9bcf1a33ca39864d3bde66ad03a491ddfd17a3189ad7340ef90306e8dca300131219a55bbbd21289cf14fe40ef8fad89488df3503a766a8edf43bf816f4a5f0d8b1a0c183575a1589994054af2338e49a18186b94de6151107353eccd2817a075f9c4da88c31af5af5c981c6d72edb4df8b352a7d339e903a81b3c4eb51d8a286d0505cf8ee7c0daba3c2beb61865ee571a16cfb00e99088c8236964c798972daa234a0f055e33ea334d85a01d6f53da316813ea458430671b5eb59007a3e0a359aeb67a512576c942d187e5e9a905b18a303303e05266ecd0ab77f0ef4ae42d4c8d21c65fcedc6876ff461de2e2fa8c262b489edf06065535cb58820cfc9d3c1a93976d085a70000"], &(0x7f0000000240)='syzkaller\x00', 0x4, 0xff0, &(0x7f000062b000)=""/4080, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x3d) r7 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r7, 0x84, 0xc, &(0x7f0000000380), &(0x7f00000003c0)=0x4) r8 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$IP_VS_SO_GET_DAEMON(r8, 0x0, 0x487, &(0x7f0000000800), &(0x7f0000000840)=0x30) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0xa0001f98, 0x15, 0x0, &(0x7f0000000280)="4c1b84bdac37f4451b20a3066494677ee389d422a1", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r4}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x16, &(0x7f00000006c0)=ANY=[@ANYBLOB="18570000030000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000000b990001fcffffff5da0a4fffcffffff181200002f1f6f2d98ecea810c3b2855", @ANYRES64=r5, @ANYBLOB="0000000000000000b7030000f3ff0000850000000c000000b700000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x1, 0x2a, 0x0, 0x0, 0x58, '\x00', r2, 0xf, r9}, 0x94) 1.072199705s ago: executing program 4 (id=3902): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000580)=0x1, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0x7fb, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req={0x9, 0x5, 0xfffffff9, 0x2}, 0x10) socket$kcm(0x2, 0xa, 0x2) sendmsg$can_raw(r1, &(0x7f0000000240)={&(0x7f0000000540)={0x1d, r2}, 0x10, &(0x7f0000000480)={&(0x7f0000000140)=@can={{0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, "000000000000001e"}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040) r4 = socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x80002, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000001280), 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40004) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES16=r8, @ANYRESOCT=r7, @ANYRES16=r5, @ANYRESHEX=r4, @ANYRES64=0x0], 0x3c}}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000000640)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x2001, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r12 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000005700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r10, &(0x7f00000059c0)={0x0, 0x0, &(0x7f0000005980)={&(0x7f0000000840)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="050129bd7000fddbdf2511000000ff010300d059e2ae05f8dcee83308a634c7947e82a850f55d8f92270cb380c2397d66d2d6ed34bdf85c3b826517410077efe15d347bac05889b944c9a01256ae7e7acc2a07f0a7108ec06dbd4b787b8856a4580e28f1b9d5e96714d3b8c19e797df8e21ff98f3d54772be4627f6e86a817e678295556c80503bd7c15d68cdd41aa17e090a44da68372b01cd045c1a538a8ca4c0c19666a9cabcbeaff803b9e2e189da951f2967662920efc5e0bea28ae7424c49b25f874270c5bf61efe9ccfe896b2177d9527d86c4d54a515f7fa2d144d417858cdb86e3b546037104e384bc745237e3e86dc04ce1a800831cd66f97ad1207e3ae3e03b9da9f1293d0dfda406637cc9c16a6a26cd6bfd39f0bf1d12aebef0cd4d2873eec2ac5abf9e079f6dabea8760a2c0094f0951ff93eac26db13a64ae77c81f6535ee9626df504c3f5bb453329ee8fae0dba1f003f850e1c546237dbfcaba9a562ae8da18c21fedc3006702f50ac12a6901a278d300ed6e9aa7e7b791cc232a8a88085ffea057c55b28dbf1373ec05107b1ea6c94f0da39", @ANYRES32=r13, @ANYBLOB="0c00990000000000330000000a0006000802110000000000"], 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20008804) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="24000000100003042dbd700000000000000074005714848be3bf8c0a7f11502929985128be373878cd38feffc5790c5986fa3116e76b666791ef1023070a4522e0c558b81f873321f5972570c5173d55e4aa622793e4043c25e097470f3c4d", @ANYRESOCT=r4, @ANYRES32=r1, @ANYRESHEX=r9], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x14) 916.155573ms ago: executing program 2 (id=3903): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) accept$nfc_llcp(r1, &(0x7f0000000080), &(0x7f0000000140)=0x60) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'pimreg0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfa, {0x0, 0x0, 0x0, r2, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "c92ad6ab8055fe39a5a9615d5ba410de"}, @TCA_FLOWER_KEY_CT_LABELS_MASK={0x14, 0x62, "988f88d52ae2aa1e44f0e5686a8da5d9"}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) 843.830408ms ago: executing program 0 (id=3904): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_INITSTATE(r0, 0x113, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x24, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL={0x8, 0x17, 0x2}, @ETHTOOL_A_COALESCE_TX_MAX_FRAMES_LOW={0x8, 0x11, 0x97d8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000091}, 0x8000) r5 = socket$can_j1939(0x1d, 0x2, 0x7) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x1}, 0x20) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x0, 0x37, 0x0, 0x1}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r7, 0x2, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r8, 0x0, '\x00', 0x0, r6, 0x0, 0x1}, 0x48) setsockopt$SO_J1939_SEND_PRIO(r5, 0x6b, 0x20, 0x0, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYRES64=0x0, @ANYRESHEX=r2, @ANYRESHEX=r1], 0x48}, 0x1, 0x0, 0x0, 0x4004080}, 0x24004814) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@delchain={0x3c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0xffe0, 0x8}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) 762.183058ms ago: executing program 4 (id=3905): r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f00000000c0)) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0102000000000000000001"], 0xfc}}, 0x40040) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r1) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) (async) ioctl$SIOCSIFHWADDR(r1, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00'}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000140)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000030000000700000008000300", @ANYRES32=r4, @ANYBLOB="08000500010000001400040074"], 0x54}}, 0x0) 761.726415ms ago: executing program 1 (id=3906): r0 = socket(0x10, 0x3, 0x2) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) (async) connect$netlink(r0, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) (async) write(r0, &(0x7f0000000000)='\"', 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x14, r2, 0x1, 0x0, 0x25dfdbfd, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x880) 751.099492ms ago: executing program 3 (id=3907): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x72f6c3b797f71946, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40024}, 0x20000000) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x400c084) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x5c, r1, 0x200, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="5c304ee0d108"}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8041}, 0x4000090) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xcc, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x6, 0x42}}}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "101bc33260dc2440a7f95c4397c09ee5dce69d7afe4a6c4b"}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "e3f76c47b13ce96415829f8615a1ef2938b9b291c13b6f64"}], @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0xcc}, 0x1, 0x0, 0x0, 0x60004881}, 0x20040000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000600)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4f8637b311fce689}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x2c, r1, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x4004000) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000700)={r0, 0x80, 0x2, 0x7}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000780)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r5, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x3c, r1, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x200460d1}, 0x8000) sendmsg$NL80211_CMD_DEL_TX_TS(r5, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x60}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x5c, r2, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x57}}}}, [@NL80211_ATTR_TSID={0x5, 0xd2, 0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x5}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4800) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x64, r2, 0x400, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_TX_RATES={0x50, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xfa, 0xc, 0x7fff, 0xfff9, 0x4, 0x3000, 0x0, 0x4]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x19, 0xd1, 0x7, 0x5, 0x3, 0x3ba2, 0x7f, 0xb]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xa, 0x1, [0x1, 0x36, 0x1b, 0x18, 0xb, 0x1b]}, @NL80211_TXRATE_HE_LTF={0x5}]}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x640b15e696f8e27b) ioctl$PPPIOCGNPMODE(r5, 0xc008744c, &(0x7f0000000b00)={0x8021, 0x2}) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000b80), r0) sendmsg$MPTCP_PM_CMD_REMOVE(r0, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x3c, r7, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x81}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f0000000c80)={0x3ff, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x8, "1978fee91e68f2"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r5, 0xc0709411, &(0x7f0000001c80)={{r8, 0x80, 0x7ff, 0x6, 0x2, 0x5, 0x0, 0x3ff, 0x7, 0x9, 0xa, 0x40, 0xffff, 0x9, 0x3}, 0x18, [0x0, 0x0, 0x0]}) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(r5, 0xf505, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) recvmmsg(r10, &(0x7f0000005b40)=[{{0x0, 0x0, &(0x7f0000003040)=[{&(0x7f0000001d40)=""/7, 0x7}, {&(0x7f0000001d80)=""/63, 0x3f}, {&(0x7f0000001dc0)=""/92, 0x5c}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/230, 0xe6}, {&(0x7f0000002f40)=""/63, 0x3f}, {&(0x7f0000002f80)}, {&(0x7f0000002fc0)=""/72, 0x48}], 0x8, &(0x7f00000030c0)=""/115, 0x73}, 0x8d5b}, {{&(0x7f0000003140)=@l2tp6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000003200)=[{&(0x7f00000031c0)=""/47, 0x2f}], 0x1, &(0x7f0000003240)=""/74, 0x4a}, 0x5}, {{&(0x7f00000032c0)=@ax25={{0x3, @bcast}, [@rose, @bcast, @default, @remote, @default, @null, @null, @null]}, 0x80, &(0x7f0000003580)=[{&(0x7f0000003340)=""/149, 0x95}, {&(0x7f0000003400)=""/86, 0x56}, {&(0x7f0000003480)=""/181, 0xb5}, {&(0x7f0000003540)=""/5, 0x5}], 0x4, &(0x7f00000035c0)=""/60, 0x3c}, 0x4}, {{&(0x7f0000003600)=@l2tp6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f00000049c0)=[{&(0x7f0000003680)=""/207, 0xcf}, {&(0x7f0000003780)=""/4096, 0x1000}, {&(0x7f0000004780)=""/197, 0xc5}, {&(0x7f0000004880)=""/53, 0x35}, {&(0x7f00000048c0)=""/234, 0xea}], 0x5, &(0x7f0000004a40)=""/143, 0x8f}, 0x8}, {{&(0x7f0000004b00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000005000)=[{&(0x7f0000004b80)=""/137, 0x89}, {&(0x7f0000004c40)=""/173, 0xad}, {&(0x7f0000004d00)=""/53, 0x35}, {&(0x7f0000004d40)=""/138, 0x8a}, {&(0x7f0000004e00)=""/196, 0xc4}, {&(0x7f0000004f00)=""/211, 0xd3}], 0x6}, 0x40}, {{&(0x7f0000005080)=@tipc, 0x80, &(0x7f0000005580)=[{&(0x7f0000005100)=""/116, 0x74}, {&(0x7f0000005180)=""/49, 0x31}, {&(0x7f00000051c0)=""/96, 0x60}, {&(0x7f0000005240)=""/98, 0x62}, {&(0x7f00000052c0)=""/118, 0x76}, {&(0x7f0000005340)=""/45, 0x2d}, {&(0x7f0000005380)=""/129, 0x81}, {&(0x7f0000005440)=""/246, 0xf6}, {&(0x7f0000005540)=""/33, 0x21}], 0x9, &(0x7f0000005640)=""/120, 0x78}, 0x8000}, {{0x0, 0x0, &(0x7f0000005700)=[{&(0x7f00000056c0)=""/46, 0x2e}], 0x1, &(0x7f0000005740)=""/53, 0x35}, 0x4}, {{&(0x7f0000005780)=@l2, 0x80, &(0x7f0000005a00)=[{&(0x7f0000005800)=""/172, 0xac}, {&(0x7f00000058c0)=""/123, 0x7b}, {&(0x7f0000005940)=""/5, 0x5}, {&(0x7f0000005980)=""/90, 0x5a}], 0x4, &(0x7f0000005a40)=""/231, 0xe7}, 0x1}], 0x8, 0x10040, &(0x7f0000005d40)) socketpair(0x1f, 0x4, 0x3877be7d, &(0x7f0000005d80)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000005e00), r9) sendmsg$ETHTOOL_MSG_DEBUG_GET(r11, &(0x7f0000005f00)={&(0x7f0000005dc0), 0xc, &(0x7f0000005ec0)={&(0x7f0000005e40)={0x60, r12, 0x4, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x28008000}, 0x8000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000005f40)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000005f80)={@dev={0xfe, 0x80, '\x00', 0x16}, @ipv4={'\x00', '\xff\xff', @empty}, @mcast1, 0x7, 0x9, 0x1, 0x500, 0x573, 0x1000008, r13}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000006380)={&(0x7f0000006000)={0x10, 0x0, 0x0, 0x10003900}, 0xc, &(0x7f0000006340)={&(0x7f00000062c0)={0x64, 0x0, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x32}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0xff}]}, 0x64}, 0x1, 0x0, 0x0, 0x850}, 0x20040050) 630.708111ms ago: executing program 1 (id=3908): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=@base={0x2, 0x4, 0x4, 0xbf22, 0x480}, 0x48) mmap(&(0x7f0000fa3000/0x4000)=nil, 0x4000, 0x4, 0x82011, r0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x9, r3}) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000140)={0x0, {0x2, 0x4e21, @rand_addr=0x64010102}, {0x2, 0x4e20, @multicast1}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x151, 0x0, 0x0, 0x0, 0x81, &(0x7f0000000080)='batadv0\x00', 0x3ff, 0x9, 0x3}) r4 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x80ad}, 0x1c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@deltclass={0xc70, 0x29, 0x8, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xffe6, 0xffff}, {0x2, 0xe}, {0x4, 0xe}}, [@tclass_kind_options=@c_htb={{0x8}, {0xc44, 0x2, [@TCA_HTB_CTAB={0x404, 0x3, [0x6d0, 0x81, 0xd, 0x4, 0x3, 0x4f83, 0xa, 0x80000000, 0x8, 0x56e, 0x9, 0x5, 0xaa, 0x1, 0x4, 0x5, 0x2, 0x7, 0x3, 0xca, 0x9, 0x53, 0x7fffffff, 0x1, 0x9, 0xe0c, 0x23d, 0x1, 0x1, 0x3, 0x0, 0x73, 0x8, 0x80000000, 0x7, 0x6, 0x9, 0x567, 0x4, 0x6, 0x4, 0x7, 0xff, 0x7, 0x80000001, 0x8, 0x7ff, 0x8, 0x40, 0x1, 0xff, 0x4, 0x166, 0x87b7, 0x3, 0x31bdf83f, 0x9, 0x8, 0x7fff, 0x3, 0x5, 0x0, 0xf, 0x8, 0x7, 0x7, 0x6, 0x7, 0x0, 0x6, 0x4, 0xbe9f, 0x3, 0x1, 0x7552, 0xc2, 0x0, 0x7, 0x0, 0xa931, 0x3, 0x1, 0x3, 0x0, 0x40, 0x9, 0x0, 0x9, 0x4, 0x5, 0xffffffb8, 0x7, 0x1ff, 0x4, 0x7ff, 0xb60b, 0x0, 0x2, 0x0, 0x8, 0xc, 0x4, 0x3, 0x339d, 0x7, 0x4, 0x8001, 0x7, 0x7, 0x101, 0x400, 0x3, 0xcd, 0x7, 0x9, 0xa8, 0x7fffffff, 0x7f, 0x1, 0x6, 0x0, 0x2, 0x2, 0x7, 0x2, 0x0, 0x3, 0x0, 0x2, 0x1, 0xde3, 0x5, 0x9, 0xffffffff, 0xb3b, 0x0, 0x1b36, 0x0, 0xffffffff, 0x7fff, 0x4, 0xccb, 0x267f55f, 0x1, 0x8, 0x2, 0x80000001, 0x3, 0x1000, 0x3, 0x8, 0x6, 0x8, 0x9, 0x7, 0x400, 0x7, 0x2, 0x101, 0x5, 0xfff, 0x9, 0x9, 0x800, 0x9, 0x4, 0xfffffff9, 0x1, 0x7, 0x2, 0xfffffffb, 0x1, 0x4, 0xc, 0xfffffff7, 0x7, 0x0, 0x9, 0x6, 0x3, 0x2, 0x3, 0x400, 0x1000, 0xdf41, 0x1, 0xffffffff, 0xd1c, 0x5, 0x6a, 0x9, 0x4a, 0x4, 0x101, 0x5, 0x3, 0x7ff, 0x4, 0x1, 0x6563, 0x8, 0x968, 0x0, 0x36e4379, 0x9, 0xe4, 0x1, 0x3, 0xa18d, 0x1, 0x0, 0x9, 0x80000001, 0x80000000, 0x4, 0x4, 0x26, 0x7, 0x20, 0x1, 0x40, 0x3, 0x9ca, 0x4fa, 0x9, 0x9, 0x7, 0x80, 0x5, 0x7fffffff, 0x3, 0xc9e, 0x6, 0x100, 0x7fffffff, 0x896, 0x9, 0x7, 0x3, 0x8, 0x1ce3, 0xbd1, 0x4, 0x8, 0x9, 0x8, 0x40c, 0x1, 0x1, 0x9, 0xffffffff, 0xb8, 0x7b5, 0x8, 0x7]}, @TCA_HTB_OFFLOAD={0x4}, @TCA_HTB_CTAB={0x404, 0x3, [0x7, 0xfffffeff, 0xb, 0x7, 0x2271, 0xd, 0x6, 0x9, 0xb, 0x2a17, 0x1, 0x5, 0x2, 0xfffffffb, 0x7f, 0x7fff, 0xc, 0x5, 0x0, 0x200, 0xffffffff, 0x8820, 0x10e, 0x9655, 0xfb, 0x8, 0x8, 0x3, 0x5, 0x2, 0x3, 0x100, 0x8, 0x1c6063fd, 0x5, 0x6, 0xfffffffe, 0x8a93, 0xfffff18a, 0x3a5, 0x4, 0x0, 0x8be, 0x3, 0x0, 0x7, 0x4, 0x6, 0x328d82a6, 0x1ff, 0x1, 0x4, 0xd, 0x8, 0x2, 0x0, 0xa5, 0x0, 0x30000000, 0xfff, 0x1, 0x5196, 0x100, 0x1, 0x2, 0x2, 0x2, 0x7, 0x4, 0x7, 0xb0, 0x5, 0xf, 0xfffffffd, 0x6, 0x6, 0x1, 0x6, 0x9, 0x6, 0xfffffffc, 0x5830, 0x3, 0xb0, 0x1, 0x8, 0x4, 0xffffffff, 0x931e, 0x2e, 0x1000, 0x7, 0x5, 0x78, 0x5, 0x80000000, 0x0, 0x10000, 0x0, 0x7ff, 0x10, 0x81, 0x3, 0xfffffe00, 0x80, 0x9, 0x0, 0x1c4c, 0x1adcdb7b, 0x4, 0x4, 0x80, 0x7f, 0x7fff, 0xfffffffa, 0x6, 0x3, 0x2, 0xffffff80, 0xa, 0x0, 0x2, 0x9, 0x4, 0x101, 0x592, 0x1, 0x10, 0xe2, 0x81, 0x40000, 0x7ff, 0x8001, 0x7fffffff, 0x0, 0x2, 0x7, 0x14, 0x1, 0x8000, 0x10, 0x6, 0x2, 0x6, 0x2, 0x8, 0x7, 0x3, 0xffff, 0x1, 0x6, 0x40, 0x101, 0x7, 0xe, 0xee4e, 0x4, 0x84, 0x1, 0x9, 0xfffffc00, 0x6, 0x4, 0xfffff26c, 0x1, 0x0, 0x80, 0x8, 0xdf, 0x8, 0x6, 0x3119, 0xc, 0xbd7, 0x2, 0x3, 0x7, 0x7, 0x7, 0xdd6, 0x1ff, 0x8, 0x100, 0x1, 0x8, 0xc, 0xfffffffa, 0x8000, 0xac, 0x6, 0x6, 0x7fff, 0xfffffffc, 0x2, 0x5, 0xff, 0x8, 0x9, 0x3, 0x2, 0x5, 0x4, 0x6, 0x3bb, 0xffffffff, 0x7, 0x1, 0x1b1a, 0x1, 0xccf, 0x5, 0x7, 0x8000, 0x0, 0x6, 0x5, 0x3, 0xffffffff, 0xfe84, 0xf5c, 0x40, 0x7, 0x5, 0x6, 0x8, 0x17, 0x4, 0x4, 0x27e, 0x5, 0xd, 0x8, 0x4, 0x6, 0x3, 0x3ff, 0x0, 0x200800, 0xffff, 0x4, 0x10001, 0x5, 0x3, 0x1aa, 0x8, 0x9341, 0x8, 0x200, 0x1, 0x100, 0x8000, 0x6, 0x2, 0x6, 0xfffffff9, 0x30e1]}, @TCA_HTB_RTAB={0x404, 0x4, [0xd95, 0x2, 0x3, 0x2d, 0x6, 0xf, 0x1, 0x1, 0x800, 0x18, 0xfffff801, 0x229, 0x8, 0xd, 0x7, 0x8, 0x146be78f, 0x3, 0x7, 0x5, 0xb03f, 0x1, 0x3ff, 0xddb6, 0x1, 0x800, 0x0, 0x7fff, 0x101, 0x8, 0x10000, 0x7, 0x8, 0x9, 0xc000000, 0xfff, 0x2, 0x4, 0x7ff, 0x6, 0xd, 0x0, 0x0, 0x6, 0x8, 0x9, 0x20, 0x8, 0xfff, 0x4, 0xcc, 0x6, 0xe, 0x0, 0xba, 0xe305, 0x7f, 0x80, 0x1, 0x5, 0xaa5, 0x7ff, 0x3, 0x9, 0x4, 0x0, 0x200, 0xa0e, 0x3, 0x3, 0x400, 0xf8, 0x7f, 0x9, 0x3, 0x19ae, 0x1, 0x1, 0x800, 0x4, 0x10000, 0x1, 0x2, 0x7, 0x101, 0x10, 0x71, 0x7, 0xffffffed, 0x2, 0xfff, 0x2b4, 0x401, 0x0, 0x1000, 0x7, 0xfffffffb, 0x101, 0x422c28d7, 0x7b87, 0x0, 0x7fffffff, 0xb0, 0x200, 0x7, 0x80, 0xffffffff, 0x6, 0x7, 0x4, 0x1, 0x3800000, 0x9, 0x3, 0x81, 0x4, 0x8000, 0x7fff, 0x8, 0x4e85c83d, 0x4, 0xfffffffe, 0xffffff58, 0x5, 0x80000000, 0x6, 0xab, 0x800, 0xd1ce, 0x6b9d, 0x8, 0x3, 0x0, 0x400, 0xfffffffe, 0x7, 0x3, 0x9, 0xffffff80, 0x80000001, 0x7fffffff, 0x1, 0x8, 0x5, 0x40, 0x40, 0x41a, 0x1e, 0xffffffc0, 0x10000, 0x6, 0x7, 0x7f, 0x200, 0x2, 0xbe, 0x0, 0xc1, 0x5bc5, 0x5, 0x4, 0x5, 0x5, 0x9, 0x4, 0x4d292e55, 0x81, 0x2, 0x0, 0x41a, 0xffffffff, 0x5, 0x6, 0xfffffe55, 0x0, 0x0, 0x9, 0x4, 0x7, 0x910, 0xffff, 0x7, 0x64cc9857, 0x3, 0x0, 0x9, 0xff, 0xb, 0x768, 0x6, 0x0, 0x7, 0x2, 0x9, 0x7fffffff, 0x1ff, 0x5, 0x6, 0x1, 0x2b, 0x1, 0x2, 0xe, 0x5, 0x6, 0x0, 0x10001, 0x2, 0x6, 0x3, 0x6, 0x4, 0x0, 0x3, 0x8, 0x1, 0x8, 0xa0000, 0x3, 0x0, 0x7, 0xe, 0x5, 0xfffffffe, 0x7ff, 0xe, 0x1, 0x1, 0x3ff, 0xe4, 0x6b68, 0x7f, 0x7, 0x9, 0x4, 0x5c6, 0x0, 0x8, 0x8, 0xffffffad, 0xfc3, 0x8, 0x5, 0x5, 0x21b8, 0x3, 0xe04, 0x9, 0x3, 0x9, 0x24e, 0x0, 0x10, 0x9, 0x8, 0x8]}, @TCA_HTB_PARMS={0x30, 0x1, {{0x4, 0x3, 0x1097, 0xffff, 0x3, 0xb4b}, {0x7, 0x5d8eeeb8a09d3131, 0xa, 0x0, 0x2, 0x60}, 0x5d8ac3e9, 0xfffffffc, 0x10001, 0xfff, 0x7}}]}}]}, 0xc70}}, 0x0) 546.129177ms ago: executing program 4 (id=3909): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}, 0x1, 0x0, 0x0, 0x44094}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04", 0x13}], 0x1}, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000002700)=""/4089, &(0x7f0000001000)=0xff9) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}]}, 0x24}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380), 0x4) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000000080)={r8, @in6={{0xa, 0x4e23, 0x4004, @empty, 0xc}}, 0x9, 0xb73}, 0x90) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x3, [@ptr={0xc}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xc, 0x2}]}]}, {0x0, [0x0]}}, &(0x7f0000000080)=""/18, 0x3b, 0x12}, 0x28) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=ANY=[@ANYRESDEC=r9], &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, r9, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x20000}, 0x10}, 0x94) 545.728685ms ago: executing program 0 (id=3910): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x10000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x8, 0x0, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x6c}, 0x0, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) socket$netlink(0x10, 0x3, 0x15) (async) r1 = socket$netlink(0x10, 0x3, 0x15) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000000)="390000001300034700bb5be1c3e4feff06000000e6b04634997ecaf2c37f678701000000450000002500000019000400040003000000000000000006040000000000f93132", 0x45}], 0x1) 534.538027ms ago: executing program 3 (id=3911): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a090400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000031080003400000000114000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x4}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000000)="e26d0ec68ce2"}, 0x20) 418.659851ms ago: executing program 4 (id=3912): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b70500000000000c7910a800000000007d0a0000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x10}, 0x10}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0x17, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x38000}, {}, {}, [@jmp={0x5, 0x0, 0x2, 0xa, 0x1, 0x30, 0xffffffffffffffff}, @btf_id={0x18, 0x9, 0x3, 0x0, 0x3}, @alu={0x7, 0x0, 0x9, 0x7, 0x2, 0x4, 0xfffffffffffffffc}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffff9}, @jmp={0x5, 0x0, 0x0, 0x6, 0xb, 0xc, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x0, 0x8, 0x1, 0xffffffffffffffff, 0x1}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x2e20, 0x84, &(0x7f00000003c0)=""/132, 0x40f00, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000200)={0x0, 0x9, 0x1000, 0x3ff}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[0x1], 0x0, 0x10, 0x1}, 0x94) getpeername$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f00000001c0), r2) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000fc0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fddbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="3c000280380001"], 0x58}, 0x1, 0x0, 0x0, 0x20040881}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000600)={r0, r1, 0x25, 0x5, @void}, 0x10) 354.052286ms ago: executing program 2 (id=3913): r0 = socket$inet(0x2, 0x3, 0x8d) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000001c0)="01", 0x1) setsockopt$inet_opts(r1, 0x0, 0xc, &(0x7f0000000000)="c1", 0x1) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000680)=""/17, &(0x7f00000000c0)=0x11) setsockopt$inet_msfilter(r0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x7c, r2}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="500000001800010000000000000000000ae0"], 0x50}}, 0x0) socket(0xa, 0x1, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_pwait(r6, &(0x7f0000000180)=[{}], 0x1, 0xdeb, 0x0, 0x0) bind$alg(r5, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20000010) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r10, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL={0x5, 0x3, 0x4}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}]}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) getsockopt$sock_buf(r7, 0x1, 0x1f, 0x0, &(0x7f0000001040)=0xa00) r11 = accept4(r5, 0x0, 0x0, 0x0) r12 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r12, 0x6, 0x6, &(0x7f0000000080)=0x80000001, 0x4) recvmmsg$unix(r11, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=""/67, 0x43}], 0x1}}], 0x1, 0x40012040, 0x0) 353.672684ms ago: executing program 0 (id=3914): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000fc0), r0) sendmsg$NFC_CMD_SE_IO(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="40ccadb9", @ANYRESHEX=r2, @ANYRESHEX=r2, @ANYRESOCT], 0x28}, 0x1, 0x0, 0x0, 0x14044045}, 0x2400cc84) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448ca, &(0x7f0000000840)) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r3) (async) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r6, 0x89e1, &(0x7f0000005140)={r5}) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x1}, [@IPSET_ATTR_REVISION={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40414) 353.402102ms ago: executing program 1 (id=3915): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x43, &(0x7f00000002c0)={&(0x7f0000000640)=@newtaction={0xd8, 0x30, 0xffff, 0x0, 0x0, {}, [{0xc4}]}, 0xd8}}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 304.062187ms ago: executing program 3 (id=3916): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x0, 0x0, 0x0, 0x4}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0xb17, 0xc574450d1af2b53c}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0xe0b1}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20044010}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r6, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x8840) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000000)={0x80, 0xbff, 0x9, 0xb}, 0x10) 205.725881ms ago: executing program 4 (id=3917): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e1d, 0x1, @mcast1, 0x7}, 0x1c) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000080)=0x28, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x400ad80, &(0x7f00000000c0)={0xa, 0x4e23, 0x5b3, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x8}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="b3ab706204ee39c9dae21a1718ee351ebc92d2f0d482a863ae5c0b4d768ffe745af2c53a083d9b761b", 0x29}], 0x1}}], 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61158800000000006113500000000000bfa000000000000007000000ee0016055e0301000000000064050000070000006916300000000000bf07000000000000260507000fff0720670600001f000000470600000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 74.093361ms ago: executing program 0 (id=3918): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x0, 0x4000041}, 0x44000) (async) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000021002101000000000000dc000a000000000000000000000008001a"], 0x24}}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x0, 0x0, 0x4c21, 0x2, 0x0, 0x0, 0x0, 0x5c, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, {0x0, 0x0, 0x0, 0xa, 0x0, 0x80000, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {}, 0x70bd28, 0x3500, 0xa, 0x4, 0x0, 0x22}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x40, "217d66d38547aa140db8a200000000c538c7cb7a"}}, @offload={0xc}]}, 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x8c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x60, 0x3, 0x0, 0x1, [{0x5c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x50, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}, {0x2c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x110}}, 0x0) 72.947519ms ago: executing program 2 (id=3919): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3802000005060300ff3bb7000000000033dea09c80f7e405720000000a000004000b00030073797a30000000000900030073797a3000"/68], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aa4000000060a0b0400000000000000000200000078000480740001800a0001006d617463680000006400028008000240000000000c00010072617465657374004c0003007e6b92c43235dc7e977221f83c3f179e65b2ff0a2c370242c067b787cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470582e870900010073797a30000000000900020073797a32"], 0xcc}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_batadv\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc}]}}}]}, 0x40}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5, 0xf, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x44}}, 0x0) 49.235544ms ago: executing program 3 (id=3920): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, 0x0, 0x0}, 0x94) socket(0x11, 0x3, 0x1) (async) r0 = socket(0x11, 0x3, 0x1) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001d80)={@ifindex, 0xffffffffffffffff, 0x36, 0x100c}, 0x20) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f00000003c0)={'wlan1\x00', {0x2, 0x0, @empty=0xcf05fdfd}}) (async) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f00000003c0)={'wlan1\x00', {0x2, 0x0, @empty=0xcf05fdfd}}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000040)=0x20, 0x4) r2 = socket$netlink(0x10, 0x3, 0x400000000000004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002"], 0x7c}}, 0x0) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00', 0x8}}}, 0x108) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="620ac4ff000000007110bd000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x90) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff01000000000000000000000000000100"/71], 0x190) (async) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff01000000000000000000000000000100"/71], 0x190) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r5, 0x0, 0x96, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) writev(r2, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) (async) writev(r2, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r6, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) 0s ago: executing program 4 (id=3921): pipe(&(0x7f0000000180)={0xffffffffffffffff}) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f00000003c0)=0x2, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e000000ff0700000400000008000000812a0000", @ANYRES32=0x1, @ANYBLOB="0200000000000000000000200000000000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="020000000400"/28], 0x50) connect$rose(0xffffffffffffffff, 0x0, 0x0) setsockopt$WPAN_WANTLQI(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x80000) sendmsg$NL80211_CMD_DEL_PMKSA(r3, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x4004040}, 0x4000005) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r5, 0x10c, 0x1, &(0x7f0000000080), 0x4) r6 = socket$kcm(0x2, 0xa, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000700)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000380)={'syzkaller1\x00', @multicast}) write$tun(r4, &(0x7f0000002d80)=ANY=[], 0x150b) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000080)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3, 0xfff1, 0x7, 0x80, 0x9, "d4c5e9e73b45e8224efa8f2af48689a777bb28252c6f300ae9693dba02351bb8a82bb9f52895f7d98cb95fcfa47d726f254e022b703f61ec0d1046ae944952240501dd79d98e59f8c13d11640c08cc9b3111f94a7fc89ffbd9071c67f91e97b72f1e5349b539a9550a93517e7f182415e495d1b949756e54002ab3f36db85cec"}) kernel console output (not intermixed with test programs): llmulticast mode [ 419.372728][T15425] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2531'. [ 420.503451][T15455] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 420.659047][T15462] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2540'. [ 420.739170][T15462] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2540'. [ 421.004816][T15469] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2542'. [ 421.847377][T15491] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.2549'. [ 422.041165][T15501] netlink: 'syz.1.2552': attribute type 1 has an invalid length. [ 422.143817][T15501] netlink: 'syz.1.2552': attribute type 1 has an invalid length. [ 422.300212][T15512] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2553'. [ 422.615499][T15520] netlink: 'syz.0.2557': attribute type 33 has an invalid length. [ 422.742573][ T5529] v: left promiscuous mode [ 422.828346][T15511] xt_policy: too many policy elements [ 423.299013][T15534] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2560'. [ 423.411158][T14576] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.436825][T10269] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.454121][T14576] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.571966][T10269] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.806843][T15537] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2561'. [ 423.914672][T15537] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 423.922333][T15537] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 424.043991][T15546] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2564'. [ 424.209640][T15552] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2565'. [ 424.224305][T10269] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.052465][T15558] syzkaller0: entered promiscuous mode [ 425.084180][T15558] syzkaller0: entered allmulticast mode [ 425.488476][T15577] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2570'. [ 425.589680][T15579] netlink: 'syz.2.2571': attribute type 1 has an invalid length. [ 426.025748][T15592] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2573'. [ 426.241281][T15594] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2574'. [ 427.907858][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 430.922918][T15579] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 431.028376][T15588] veth0_to_bond: left allmulticast mode [ 431.610079][T15603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2575'. [ 431.669626][T15611] syz.3.2577: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 431.774450][T15611] CPU: 1 UID: 0 PID: 15611 Comm: syz.3.2577 Not tainted syzkaller #0 PREEMPT(full) [ 431.774484][T15611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 431.774503][T15611] Call Trace: [ 431.774513][T15611] [ 431.774524][T15611] dump_stack_lvl+0x189/0x250 [ 431.774562][T15611] ? __pfx_dump_stack_lvl+0x10/0x10 [ 431.774592][T15611] ? __pfx__printk+0x10/0x10 [ 431.774626][T15611] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 431.774654][T15611] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 431.774684][T15611] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 431.774715][T15611] warn_alloc+0x214/0x310 [ 431.774753][T15611] ? stack_depot_save_flags+0x40/0x860 [ 431.774792][T15611] ? __pfx_warn_alloc+0x10/0x10 [ 431.774831][T15611] ? kasan_save_track+0x4f/0x80 [ 431.774862][T15611] ? xskq_create+0x56/0x170 [ 431.774880][T15611] ? xsk_init_queue+0xb0/0x110 [ 431.774913][T15611] ? xsk_setsockopt+0x4dc/0x8d0 [ 431.774970][T15611] ? do_sock_setsockopt+0x179/0x1b0 [ 431.774997][T15611] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 431.775023][T15611] ? do_syscall_64+0xfa/0x3b0 [ 431.775045][T15611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.775077][T15611] __vmalloc_node_range_noprof+0x125/0x12f0 [ 431.775146][T15611] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 431.775187][T15611] ? __kasan_kmalloc+0x93/0xb0 [ 431.775223][T15611] vmalloc_user_noprof+0xad/0xf0 [ 431.775264][T15611] ? xskq_create+0xbf/0x170 [ 431.775288][T15611] xskq_create+0xbf/0x170 [ 431.775314][T15611] xsk_init_queue+0xb0/0x110 [ 431.775353][T15611] xsk_setsockopt+0x4dc/0x8d0 [ 431.775390][T15611] ? __pfx_xsk_setsockopt+0x10/0x10 [ 431.775432][T15611] ? __pfx_aa_sk_perm+0x10/0x10 [ 431.775477][T15611] ? aa_sock_opt_perm+0xff/0x1b0 [ 431.775504][T15611] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 431.775527][T15611] ? __pfx_xsk_setsockopt+0x10/0x10 [ 431.775563][T15611] do_sock_setsockopt+0x179/0x1b0 [ 431.775596][T15611] __x64_sys_setsockopt+0x13f/0x1b0 [ 431.775631][T15611] do_syscall_64+0xfa/0x3b0 [ 431.775654][T15611] ? lockdep_hardirqs_on+0x9c/0x150 [ 431.775677][T15611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.775700][T15611] ? clear_bhb_loop+0x60/0xb0 [ 431.775727][T15611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.775757][T15611] RIP: 0033:0x7fc725d8eba9 [ 431.775778][T15611] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 431.775798][T15611] RSP: 002b:00007fc726bc3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 431.775823][T15611] RAX: ffffffffffffffda RBX: 00007fc725fd5fa0 RCX: 00007fc725d8eba9 [ 431.775840][T15611] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 431.775854][T15611] RBP: 00007fc725e11e19 R08: 0000000000000004 R09: 0000000000000000 [ 431.775868][T15611] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 431.775881][T15611] R13: 00007fc725fd6038 R14: 00007fc725fd5fa0 R15: 00007ffc57aaa368 [ 431.775917][T15611] [ 431.775930][T15611] Mem-Info: [ 432.046319][T15630] netlink: 'syz.0.2583': attribute type 3 has an invalid length. [ 432.101057][T15611] active_anon:7195 inactive_anon:0 isolated_anon:0 [ 432.101057][T15611] active_file:3228 inactive_file:39985 isolated_file:0 [ 432.101057][T15611] unevictable:768 dirty:49 writeback:0 [ 432.101057][T15611] slab_reclaimable:11167 slab_unreclaimable:109344 [ 432.101057][T15611] mapped:31190 shmem:1369 pagetables:1333 [ 432.101057][T15611] sec_pagetables:0 bounce:0 [ 432.101057][T15611] kernel_misc_reclaimable:0 [ 432.101057][T15611] free:1314176 free_pcp:11063 free_cma:0 [ 432.234029][T15611] Node 0 active_anon:29180kB inactive_anon:0kB active_file:12912kB inactive_file:159740kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:126060kB dirty:196kB writeback:0kB shmem:3940kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15228kB pagetables:5076kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 432.280679][T15630] netlink: 'syz.0.2583': attribute type 3 has an invalid length. [ 432.366686][T15611] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 432.456979][T15611] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 432.545780][ T55] block nbd3: Possible stuck request ffff888024ffe000: control (read@0,1024B). Runtime 120 seconds [ 432.561079][ T55] block nbd3: Possible stuck request ffff888024ffe1c0: control (read@1024,1024B). Runtime 120 seconds [ 432.563234][T15611] lowmem_reserve[]: [ 432.573841][ T55] block nbd3: Possible stuck request ffff888024ffe380: control (read@2048,1024B). Runtime 120 seconds [ 432.590614][ T55] block nbd3: Possible stuck request ffff888024ffe540: control (read@3072,1024B). Runtime 120 seconds [ 432.615285][T15611] 0 2497 2499 2499 2499 [ 432.622128][T15611] Node 0 DMA32 free:1355192kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29136kB inactive_anon:0kB active_file:12912kB inactive_file:158172kB unevictable:1536kB writepending:196kB present:3129332kB managed:2557416kB mlocked:0kB bounce:0kB free_pcp:27372kB local_pcp:20124kB free_cma:0kB [ 432.658557][T15611] lowmem_reserve[]: 0 0 1 1 1 [ 432.664286][T15611] Node 0 Normal free:24kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1568kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 432.694823][T15611] lowmem_reserve[]: 0 0 0 0 0 [ 432.700085][T15611] Node 1 Normal free:3886132kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16832kB local_pcp:11264kB free_cma:0kB [ 432.733724][T15611] lowmem_reserve[]: 0 0 0 0 0 [ 432.742776][T15611] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 432.768124][T15611] Node 0 DMA32: 576*4kB (UME) 1035*8kB (UME) 472*16kB (UM) 880*32kB (UME) 607*64kB (UME) 237*128kB (UME) 55*256kB (UME) 92*512kB (UM) 45*1024kB (UM) 29*2048kB (UME) 262*4096kB (UM) = 1355288kB [ 432.816499][T15611] Node 0 Normal: 0*4kB 1*8kB (M) 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 432.831571][T15611] Node 1 Normal: 175*4kB (UE) 49*8kB (UME) 39*16kB (UME) 78*32kB (UME) 21*64kB (UME) 5*128kB (UME) 4*256kB (UM) 2*512kB (M) 3*1024kB (UME) 2*2048kB (UE) 945*4096kB (M) = 3886132kB [ 432.857490][T15611] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 432.870756][T15611] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 432.888895][T15611] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 432.899428][T15611] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 432.909900][T15611] 44583 total pagecache pages [ 432.915073][T15611] 5 pages in swap cache [ 432.919433][T15611] Free swap = 124976kB [ 432.924485][T15611] Total swap = 124996kB [ 432.928826][T15611] 2097051 pages RAM [ 432.932815][T15611] 0 pages HighMem/MovableOnly [ 432.938545][T15611] 425671 pages reserved [ 432.943510][T15611] 0 pages cma reserved [ 433.165038][T15674] tipc: Enabled bearer , priority 10 [ 433.256171][T15680] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 433.362843][T15685] netlink: 'syz.4.2594': attribute type 10 has an invalid length. [ 433.382001][T15687] netlink: 'syz.2.2595': attribute type 1 has an invalid length. [ 433.542254][T15687] 8021q: adding VLAN 0 to HW filter on device bond10 [ 433.578605][T15685] bridge0: entered allmulticast mode [ 433.589508][T15685] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 433.590166][T15701] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2598'. [ 433.677262][T15692] veth9: entered promiscuous mode [ 433.898744][T15715] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 434.283897][ T5948] tipc: Node number set to 1317086686 [ 434.344819][T15734] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 434.395917][T15734] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 435.479971][T15771] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2619'. [ 435.517443][T15771] netlink: 'syz.4.2619': attribute type 2 has an invalid length. [ 435.547872][T15771] netlink: 'syz.4.2619': attribute type 2 has an invalid length. [ 435.601108][T15780] netlink: 'syz.3.2621': attribute type 21 has an invalid length. [ 435.612425][T15771] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2619'. [ 435.633635][T15774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2620'. [ 435.646965][T15780] IPv6: NLM_F_CREATE should be specified when creating new route [ 435.916150][T15787] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 436.348965][T15824] netlink: 'syz.3.2633': attribute type 1 has an invalid length. [ 436.393907][T15821] netlink: 'syz.3.2633': attribute type 1 has an invalid length. [ 436.425381][T15821] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2633'. [ 436.437238][T15822] ip6gre2: entered allmulticast mode [ 436.445056][T15824] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2633'. [ 436.714447][T15841] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2639'. [ 436.871936][T15847] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2641'. [ 437.023615][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.375350][T15870] tipc: Enabled bearer , priority 0 [ 437.383512][T15861] syzkaller1: entered promiscuous mode [ 437.399329][T15861] syzkaller1: entered allmulticast mode [ 437.417561][T15869] tipc: Enabling of bearer rejected, already enabled [ 437.428102][T15870] syzkaller0: entered promiscuous mode [ 437.436148][T15880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2651'. [ 437.449129][T15870] syzkaller0: entered allmulticast mode [ 437.460890][T15878] tunl0: entered allmulticast mode [ 437.542189][T15869] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 437.606646][T15870] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 437.630884][T15869] tipc: Resetting bearer [ 437.670917][T15868] tipc: Resetting bearer [ 437.708053][T15890] FAULT_INJECTION: forcing a failure. [ 437.708053][T15890] name failslab, interval 1, probability 0, space 0, times 1 [ 437.744834][T15868] tipc: Disabling bearer [ 437.764188][T15890] CPU: 0 UID: 0 PID: 15890 Comm: syz.2.2654 Not tainted syzkaller #0 PREEMPT(full) [ 437.764219][T15890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 437.764233][T15890] Call Trace: [ 437.764241][T15890] [ 437.764251][T15890] dump_stack_lvl+0x189/0x250 [ 437.764283][T15890] ? __pfx____ratelimit+0x10/0x10 [ 437.764307][T15890] ? __pfx_dump_stack_lvl+0x10/0x10 [ 437.764333][T15890] ? __pfx__printk+0x10/0x10 [ 437.764372][T15890] ? __pfx___might_resched+0x10/0x10 [ 437.764399][T15890] should_fail_ex+0x414/0x560 [ 437.764439][T15890] should_failslab+0xa8/0x100 [ 437.764484][T15890] __kmalloc_noprof+0xcb/0x4f0 [ 437.764512][T15890] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 437.764545][T15890] ? rfkill_alloc+0xad/0x2f0 [ 437.764572][T15890] rfkill_alloc+0xad/0x2f0 [ 437.764601][T15890] wiphy_new_nm+0x11a3/0x19e0 [ 437.764627][T15890] ? __pfx_ieee80211_emulate_remove_chanctx+0x10/0x10 [ 437.764656][T15890] ieee80211_alloc_hw_nm+0x3f3/0x1f20 [ 437.764687][T15890] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 437.764725][T15890] mac80211_hwsim_new_radio+0x1ee/0x5340 [ 437.764767][T15890] ? __pfx_stack_trace_save+0x10/0x10 [ 437.764797][T15890] ? stack_depot_save_flags+0x40/0x860 [ 437.764830][T15890] ? netlink_deliver_tap+0x19c/0x1b0 [ 437.764852][T15890] ? netlink_unicast+0x791/0x9e0 [ 437.764886][T15890] ? netlink_sendmsg+0x805/0xb30 [ 437.764907][T15890] ? __sock_sendmsg+0x21c/0x270 [ 437.764953][T15890] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 437.764984][T15890] ? __nla_validate_parse+0x2400/0x2d40 [ 437.765005][T15890] ? __sock_sendmsg+0x21c/0x270 [ 437.765035][T15890] ? ____sys_sendmsg+0x505/0x830 [ 437.765059][T15890] ? ___sys_sendmsg+0x21f/0x2a0 [ 437.765083][T15890] ? __x64_sys_sendmsg+0x19b/0x260 [ 437.765123][T15890] hwsim_new_radio_nl+0xea4/0x1b10 [ 437.765160][T15890] ? __pfx___nla_validate_parse+0x10/0x10 [ 437.765201][T15890] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 437.765249][T15890] ? __nla_parse+0x40/0x60 [ 437.765277][T15890] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 437.765318][T15890] genl_family_rcv_msg_doit+0x212/0x300 [ 437.765358][T15890] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 437.765405][T15890] ? bpf_lsm_capable+0x9/0x20 [ 437.765434][T15890] ? security_capable+0x7e/0x2e0 [ 437.765483][T15890] genl_rcv_msg+0x60e/0x790 [ 437.765521][T15890] ? __pfx_genl_rcv_msg+0x10/0x10 [ 437.765550][T15890] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 437.765584][T15890] ? __asan_memcpy+0x40/0x70 [ 437.765608][T15890] ? __pfx_ref_tracker_free+0x10/0x10 [ 437.765639][T15890] netlink_rcv_skb+0x208/0x470 [ 437.765659][T15890] ? __lock_acquire+0xab9/0xd20 [ 437.765692][T15890] ? __pfx_genl_rcv_msg+0x10/0x10 [ 437.765724][T15890] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 437.765766][T15890] ? down_read+0x1ad/0x2e0 [ 437.765795][T15890] genl_rcv+0x28/0x40 [ 437.765821][T15890] netlink_unicast+0x82f/0x9e0 [ 437.765863][T15890] ? __pfx_netlink_unicast+0x10/0x10 [ 437.765899][T15890] ? netlink_sendmsg+0x642/0xb30 [ 437.765919][T15890] ? skb_put+0x11b/0x210 [ 437.765949][T15890] netlink_sendmsg+0x805/0xb30 [ 437.765985][T15890] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.766013][T15890] ? aa_sock_msg_perm+0xf1/0x1d0 [ 437.766038][T15890] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 437.766062][T15890] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.766087][T15890] __sock_sendmsg+0x21c/0x270 [ 437.766125][T15890] ____sys_sendmsg+0x505/0x830 [ 437.766160][T15890] ? __pfx_____sys_sendmsg+0x10/0x10 [ 437.766200][T15890] ? import_iovec+0x74/0xa0 [ 437.766234][T15890] ___sys_sendmsg+0x21f/0x2a0 [ 437.766265][T15890] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.766339][T15890] ? __fget_files+0x2a/0x420 [ 437.766358][T15890] ? __fget_files+0x3a0/0x420 [ 437.766391][T15890] __x64_sys_sendmsg+0x19b/0x260 [ 437.766423][T15890] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 437.766474][T15890] ? __pfx_ksys_write+0x10/0x10 [ 437.766501][T15890] ? rcu_is_watching+0x15/0xb0 [ 437.766530][T15890] ? do_syscall_64+0xbe/0x3b0 [ 437.766559][T15890] do_syscall_64+0xfa/0x3b0 [ 437.766582][T15890] ? lockdep_hardirqs_on+0x9c/0x150 [ 437.766604][T15890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.766626][T15890] ? clear_bhb_loop+0x60/0xb0 [ 437.766654][T15890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.766675][T15890] RIP: 0033:0x7ff1ef98eba9 [ 437.766693][T15890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 437.766713][T15890] RSP: 002b:00007ff1f0845038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.766737][T15890] RAX: ffffffffffffffda RBX: 00007ff1efbd5fa0 RCX: 00007ff1ef98eba9 [ 437.766754][T15890] RDX: 0000000020000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 437.766769][T15890] RBP: 00007ff1f0845090 R08: 0000000000000000 R09: 0000000000000000 [ 437.766782][T15890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.766795][T15890] R13: 00007ff1efbd6038 R14: 00007ff1efbd5fa0 R15: 00007fff1c4ed678 [ 437.766832][T15890] [ 438.266448][T15894] netlink: 'syz.1.2656': attribute type 1 has an invalid length. [ 438.274456][T15894] netlink: 220 bytes leftover after parsing attributes in process `syz.1.2656'. [ 438.832671][T15924] netlink: 'syz.2.2665': attribute type 1 has an invalid length. [ 438.836373][T15922] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2664'. [ 438.921911][T15924] 8021q: adding VLAN 0 to HW filter on device bond11 [ 439.028538][T15928] bond11: (slave geneve2): making interface the new active one [ 439.077905][T15928] bond11: (slave geneve2): Enslaving as an active interface with an up link [ 439.198016][T15938] bond0: (slave bridge0): Releasing backup interface [ 439.241057][T15940] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2666'. [ 439.265083][T15938] bridge0: left allmulticast mode [ 439.391812][T15938] bond2: (slave geneve3): Releasing active interface [ 439.440156][T15938] bond5: left promiscuous mode [ 439.487100][T15938] bridge0: port 1(bond5) entered disabled state [ 439.586014][T15938] bond6: (slave veth5): Releasing backup interface [ 439.642138][T14579] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 439.658026][ T5983] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 439.680333][T14579] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 439.742910][T14579] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 439.794163][T15953] lo speed is unknown, defaulting to 1000 [ 439.818175][T14579] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 439.944648][ T5978] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 440.071672][T15970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2672'. [ 440.712760][T16004] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 440.720500][T16004] IPv6: NLM_F_CREATE should be set when creating new route [ 440.768750][T16004] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2683'. [ 440.790260][T16004] 0ªî{X¹¦: entered promiscuous mode [ 440.809615][T16004] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2683'. [ 440.840397][T16004] 1ªî{X¹¦: renamed from 30ªî{X¹¦ [ 440.865919][T16004] 1ªî{X¹¦: left promiscuous mode [ 440.889090][T16004] 1ªî{X¹¦: entered allmulticast mode [ 440.908510][T16004] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 440.969328][T16016] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2688'. [ 441.003897][T16016] openvswitch: netlink: Flow actions attr not present in new flow. [ 441.045650][T16016] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 441.184241][T16027] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 441.187608][T16022] netlink: 'syz.1.2690': attribute type 49 has an invalid length. [ 441.304208][T16034] lo: entered promiscuous mode [ 441.326651][T16034] netlink: 'syz.0.2691': attribute type 2 has an invalid length. [ 441.351147][T16034] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 441.741503][T16056] __nla_validate_parse: 5 callbacks suppressed [ 441.741525][T16056] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2701'. [ 442.864154][ T5869] Bluetooth: hci4: command 0x0405 tx timeout [ 445.130851][T16068] syzkaller0: entered promiscuous mode [ 445.139861][T16068] syzkaller0: entered allmulticast mode [ 445.172850][T16086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2707'. [ 445.351084][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 445.414286][T16095] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2710'. [ 447.368153][T16117] netlink: 'syz.4.2719': attribute type 33 has an invalid length. [ 447.379582][T16117] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2719'. [ 447.411454][T16117] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2719'. [ 447.555940][T16124] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2720'. [ 447.640942][T16128] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.717717][T16135] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2724'. [ 447.739756][T16128] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.816066][T16128] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.935170][T16128] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.961874][T16142] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 448.101356][ T7736] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.144673][T14577] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.177238][T14577] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.219430][T14577] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 448.543623][T16151] netlink: 'syz.2.2731': attribute type 2 has an invalid length. [ 448.746266][T16162] netlink: 'syz.2.2735': attribute type 1 has an invalid length. [ 448.842316][T16162] bond12: entered promiscuous mode [ 448.851228][T16162] 8021q: adding VLAN 0 to HW filter on device bond12 [ 448.861131][T16165] netlink: 'syz.0.2736': attribute type 12 has an invalid length. [ 448.988899][T16162] 8021q: adding VLAN 0 to HW filter on device bond13 [ 448.998944][T16162] bond12: (slave bond13): making interface the new active one [ 449.008082][T16162] bond13: entered promiscuous mode [ 449.029632][T16162] bond12: (slave bond13): Enslaving as an active interface with an up link [ 449.292587][T16189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2741'. [ 449.321174][T16189] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2741'. [ 449.555969][T16196] netlink: 191164 bytes leftover after parsing attributes in process `syz.0.2743'. [ 449.584649][T16203] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2745'. [ 449.704230][T16203] sock: sock_set_timeout: `syz.1.2745' (pid 16203) tries to set negative timeout [ 449.752478][T16208] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2747'. [ 449.830977][T16213] tipc: Enabled bearer , priority 12 [ 449.838481][T16203] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2745'. [ 449.849079][T16203] netlink: 'syz.1.2745': attribute type 3 has an invalid length. [ 449.863446][T16203] netlink: 'syz.1.2745': attribute type 3 has an invalid length. [ 451.092477][T16275] pim6reg: entered allmulticast mode [ 451.379801][T16292] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 451.598923][T16304] macvlan2: entered allmulticast mode [ 451.607287][T16304] bond0: (slave macvlan2): Opening slave failed [ 452.079912][T16330] netlink: 'syz.4.2789': attribute type 1 has an invalid length. [ 452.130116][T16330] 8021q: adding VLAN 0 to HW filter on device bond9 [ 452.240571][T16337] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 452.549134][T16351] __nla_validate_parse: 16 callbacks suppressed [ 452.549156][T16351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2794'. [ 452.566433][T16351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2794'. [ 452.579581][T16351] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2794'. [ 452.766375][T16364] IPVS: set_ctl: invalid protocol: 136 172.30.0.4:20000 [ 452.858519][T16368] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 453.309409][T16387] netlink: 'syz.0.2807': attribute type 1 has an invalid length. [ 453.326680][T16387] netlink: 'syz.0.2807': attribute type 2 has an invalid length. [ 453.335721][T16387] netlink: 'syz.0.2807': attribute type 1 has an invalid length. [ 453.377766][T16387] netlink: 1156 bytes leftover after parsing attributes in process `syz.0.2807'. [ 453.652966][T16401] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2810'. [ 453.704652][T16403] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2811'. [ 453.765498][T16407] netlink: 'syz.4.2813': attribute type 29 has an invalid length. [ 453.779515][T16407] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2813'. [ 453.999154][T16413] netlink: 284 bytes leftover after parsing attributes in process `syz.3.2814'. [ 454.533260][T16455] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2825'. [ 454.646762][T16453] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2827'. [ 455.002731][T16483] netlink: 'syz.2.2832': attribute type 2 has an invalid length. [ 455.162385][T16490] bond0: (slave team0): Releasing backup interface [ 455.176091][T16490] team0: left promiscuous mode [ 455.360183][T16450] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 455.554221][T16499] netlink: 'syz.0.2836': attribute type 11 has an invalid length. [ 455.583588][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 455.950413][T16514] tipc: Enabled bearer , priority 0 [ 456.000194][T16514] syzkaller0: entered promiscuous mode [ 456.031843][T16514] syzkaller0: entered allmulticast mode [ 456.101027][T16514] tipc: Resetting bearer [ 456.196231][T16513] tipc: Resetting bearer [ 456.291648][T16513] tipc: Disabling bearer [ 456.451304][T16498] infiniband !yz!: set down [ 456.468380][T16498] infiniband !yz!: added team_slave_0 [ 456.480541][T16498] !yz!: rxe_create_cq: returned err = -12 [ 456.487258][T16498] infiniband !yz!: Couldn't create ib_mad CQ [ 456.494470][T16498] infiniband !yz!: Couldn't open port 1 [ 456.684514][T16498] RDS/IB: !yz!: added [ 456.704370][T16498] smc: adding ib device !yz! with port count 1 [ 456.749920][T16498] smc: ib device !yz! port 1 has pnetid [ 457.226909][T16556] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 457.540259][T16569] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 457.541047][T16566] syzkaller0: refused to change device tx_queue_len [ 457.801133][ T5881] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 457.821702][ T5881] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 457.830513][ T5881] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 457.842597][ T5881] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 457.851665][ T5881] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 457.891690][T16577] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 457.922010][T16574] lo speed is unknown, defaulting to 1000 [ 458.141017][T16587] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 458.248944][T16593] __nla_validate_parse: 6 callbacks suppressed [ 458.248966][T16593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2862'. [ 458.622469][T16607] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2866'. [ 459.317448][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.328762][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.348601][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.361003][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.376886][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.387627][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.400682][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.409986][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.429178][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.440904][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.454181][T16634] nbd: must specify an index to disconnect [ 459.461308][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.475966][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.488207][T16634] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2876'. [ 459.511093][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.559211][T16632] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2875'. [ 459.587587][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.607830][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.617794][T16632] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 459.903621][ T5869] Bluetooth: hci2: command tx timeout [ 459.914226][T16574] chnl_net:caif_netlink_parms(): no params data found [ 460.256577][T16574] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.278242][T16574] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.293991][T16574] bridge_slave_0: entered allmulticast mode [ 460.312923][T16574] bridge_slave_0: entered promiscuous mode [ 460.352874][T16574] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.362610][T16574] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.370697][T16574] bridge_slave_1: entered allmulticast mode [ 460.379649][T16574] bridge_slave_1: entered promiscuous mode [ 460.388143][T16665] tap0: tun_chr_ioctl cmd 1074025678 [ 460.404767][T16665] tap0: group set to 0 [ 460.522107][T16574] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.539480][T16574] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.577497][T16648] siw: device registration error -23 [ 460.589271][T16649] siw: device registration error -23 [ 460.629380][T16669] tipc: Enabling of bearer rejected, failed to enable media [ 460.640756][T16574] team0: Port device team_slave_0 added [ 460.685431][T16574] team0: Port device team_slave_1 added [ 460.857199][T16574] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 460.884900][T16574] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 460.929665][T16574] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 460.970875][T16684] netdevsim netdevsim3 netdevsim3: entered allmulticast mode [ 460.988756][T16574] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.008582][T16574] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 461.036072][T16574] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 461.136761][T16574] hsr_slave_0: entered promiscuous mode [ 461.144730][T16574] hsr_slave_1: entered promiscuous mode [ 461.151067][T16574] debugfs: 'hsr0' already exists in 'hsr' [ 461.157604][T16574] Cannot create hsr debugfs directory [ 461.811428][T16574] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.836326][T16574] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.986654][ T5869] Bluetooth: hci2: command tx timeout [ 462.081566][T16574] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.108511][T16574] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.375500][T16574] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.398356][T16574] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.624908][ T55] block nbd3: Possible stuck request ffff888024ffe000: control (read@0,1024B). Runtime 150 seconds [ 462.636960][ T55] block nbd3: Possible stuck request ffff888024ffe1c0: control (read@1024,1024B). Runtime 150 seconds [ 462.653993][ T55] block nbd3: Possible stuck request ffff888024ffe380: control (read@2048,1024B). Runtime 150 seconds [ 462.665949][ T55] block nbd3: Possible stuck request ffff888024ffe540: control (read@3072,1024B). Runtime 150 seconds [ 462.720316][T16574] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.742010][T16574] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.804512][T16765] erspan0: entered promiscuous mode [ 463.299393][T16788] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 463.342371][T16574] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 463.405198][T16574] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 463.465378][T16574] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 463.518295][T16574] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 463.568796][T16796] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 463.596814][T16796] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 463.657377][T16803] __nla_validate_parse: 38 callbacks suppressed [ 463.657399][T16803] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2923'. [ 463.766392][T16803] IPVS: Unknown mcast interface: vcan0 [ 463.869698][T16815] openvswitch: netlink: Message has 4 unknown bytes. [ 464.035866][T16574] 8021q: adding VLAN 0 to HW filter on device bond0 [ 464.066898][ T5869] Bluetooth: hci2: command tx timeout [ 464.071302][T16574] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.125273][T14577] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.132594][T14577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.198584][T16835] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2931'. [ 464.215950][T14573] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.224174][T14573] bridge0: port 2(bridge_slave_1) entered forwarding state [ 464.359497][T16574] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 464.902596][T16867] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2940'. [ 464.919465][T16867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2940'. [ 465.066560][T16574] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 465.221853][T16574] veth0_vlan: entered promiscuous mode [ 465.261579][T16574] veth1_vlan: entered promiscuous mode [ 465.348439][T16876] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2944'. [ 465.388804][T16881] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2945'. [ 465.475336][T16574] veth0_macvtap: entered promiscuous mode [ 465.566866][T16574] veth1_macvtap: entered promiscuous mode [ 465.655213][T16574] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 465.687275][T16886] validate_nla: 30 callbacks suppressed [ 465.687295][T16886] netlink: 'syz.0.2946': attribute type 1 has an invalid length. [ 465.708038][T16886] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2946'. [ 465.727588][T16574] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 465.735961][T16888] hsr0 speed is unknown, defaulting to 1000 [ 465.753885][T16886] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2946'. [ 465.767002][T14580] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.777157][T14580] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.795813][T16888] hsr0 speed is unknown, defaulting to 1000 [ 465.802719][T16889] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2948'. [ 465.816522][T16886] 8021q: VLANs not supported on sit0 [ 465.827826][T14580] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.855105][T14580] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.875392][T16888] hsr0 speed is unknown, defaulting to 1000 [ 465.909347][T16888] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 465.968993][T16894] netlink: 'syz.4.2949': attribute type 10 has an invalid length. [ 466.051220][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.060335][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.115730][T16894] sctp: [Deprecated]: syz.4.2949 (pid 16894) Use of int in max_burst socket option. [ 466.115730][T16894] Use struct sctp_assoc_value instead [ 466.144662][ T5869] Bluetooth: hci2: command tx timeout [ 466.192144][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.211712][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.256335][T14576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.292298][T14576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.384810][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.410224][T16888] hsr0 speed is unknown, defaulting to 1000 [ 466.551713][T14573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.583633][T16906] openvswitch: netlink: Missing key (keys=40, expected=80) [ 466.615137][T14573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.139612][T16922] tipc: Enabled bearer , priority 0 [ 467.169718][T16922] syzkaller0: entered promiscuous mode [ 467.197342][T16922] syzkaller0: entered allmulticast mode [ 467.244204][T16922] tipc: Resetting bearer [ 467.271245][T16922] ip6gre0: Master is either lo or non-ether device [ 467.307013][T16922] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2956'. [ 467.479050][T16921] tipc: Resetting bearer [ 467.558673][T16921] tipc: Disabling bearer [ 467.658100][T16934] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.704068][T16934] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 467.897986][T16936] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 467.958547][ T5881] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 467.975399][ T5881] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 467.987936][ T5881] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 467.996490][ T5881] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 468.004654][ T5881] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 468.181465][T16947] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 468.240703][T16943] lo speed is unknown, defaulting to 1000 [ 468.518965][T16966] lo speed is unknown, defaulting to 1000 [ 468.792291][T16972] __nla_validate_parse: 3 callbacks suppressed [ 468.792310][T16972] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2970'. [ 468.886235][T16943] hsr0 speed is unknown, defaulting to 1000 [ 469.032345][T16983] netlink: 'syz.1.2973': attribute type 1 has an invalid length. [ 469.047437][T16983] netlink: 'syz.1.2973': attribute type 1 has an invalid length. [ 469.536838][T16943] chnl_net:caif_netlink_parms(): no params data found [ 469.778680][T16966] hsr0 speed is unknown, defaulting to 1000 [ 470.020137][T16943] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.041460][T16943] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.054176][T16943] bridge_slave_0: entered allmulticast mode [ 470.070702][ T5881] Bluetooth: hci4: command tx timeout [ 470.088903][T16943] bridge_slave_0: entered promiscuous mode [ 470.321088][T16943] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.370429][T16943] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.438518][T16943] bridge_slave_1: entered allmulticast mode [ 470.492927][T16943] bridge_slave_1: entered promiscuous mode [ 470.707614][T17046] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2984'. [ 470.871172][T17051] tipc: Enabling of bearer rejected, already enabled [ 470.901912][T16943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 470.965363][T16943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.270723][T16943] team0: Port device team_slave_0 added [ 471.302865][T16943] team0: Port device team_slave_1 added [ 471.492481][T16943] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 471.502675][T16943] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 471.502797][T17073] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2990'. [ 471.531534][T16943] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 471.547291][T17071] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 471.568334][T16943] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 471.576282][T16943] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 471.613789][T16943] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 471.638299][T17067] lo speed is unknown, defaulting to 1000 [ 471.780366][T16943] hsr_slave_0: entered promiscuous mode [ 471.798516][T16943] hsr_slave_1: entered promiscuous mode [ 471.814913][T16943] debugfs: 'hsr0' already exists in 'hsr' [ 471.820902][T16943] Cannot create hsr debugfs directory [ 472.045267][T17083] netlink: 'syz.2.2994': attribute type 3 has an invalid length. [ 472.144087][ T5881] Bluetooth: hci4: command tx timeout [ 472.195452][T17067] hsr0 speed is unknown, defaulting to 1000 [ 472.260982][T17089] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 472.661679][T16943] netdevsim netdevsim3 netdevsim3 (unregistering): left allmulticast mode [ 472.698687][T16943] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.726465][T16943] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.963602][T16943] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.999227][T16943] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.228514][T17111] netlink: 'syz.2.3005': attribute type 8 has an invalid length. [ 473.233137][T16943] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 473.257965][T16943] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.376816][T16943] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 473.393737][T16943] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 473.445544][T17117] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3007'. [ 473.456630][T17116] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3007'. [ 473.699511][T17125] netlink: 'syz.2.3010': attribute type 1 has an invalid length. [ 473.724853][T17125] netlink: 'syz.2.3010': attribute type 3 has an invalid length. [ 473.748172][T17125] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3010'. [ 473.779528][T17125] NCSI netlink: No device for ifindex 0 [ 473.797254][T16943] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 473.808710][T17128] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3012'. [ 473.948434][T16943] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 474.223276][ T5881] Bluetooth: hci4: command tx timeout [ 474.328924][T16943] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 474.388741][T16943] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 474.469762][T17148] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3018'. [ 474.491978][T17151] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3019'. [ 474.768241][T16943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 474.811946][T17174] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3024'. [ 474.839388][T16943] 8021q: adding VLAN 0 to HW filter on device team0 [ 474.892060][T14573] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.899316][T14573] bridge0: port 1(bridge_slave_0) entered forwarding state [ 474.951828][T14576] bridge0: port 2(bridge_slave_1) entered blocking state [ 474.959102][T14576] bridge0: port 2(bridge_slave_1) entered forwarding state [ 475.402002][T17197] netlink: 'syz.4.3029': attribute type 21 has an invalid length. [ 475.641483][T17197] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3029'. [ 475.682289][T17201] vlan2: entered allmulticast mode [ 475.697299][T17201] bond0: entered allmulticast mode [ 475.711312][T17201] bond_slave_0: entered allmulticast mode [ 475.718330][T17201] bond_slave_1: entered allmulticast mode [ 475.725409][T17217] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3035'. [ 475.744878][T17214] bond2: (slave veth0_to_bond): Releasing active interface [ 475.772252][T17214] team0: Port device team_slave_0 removed [ 475.784710][T17214] team0: Port device team_slave_1 removed [ 475.791115][T17214] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 475.806308][T17214] bond0: (slave gretap2): Releasing active interface [ 475.817260][T17214] gretap2: left promiscuous mode [ 475.822496][T17214] gretap2: left allmulticast mode [ 475.840269][T17214] bond2: (slave veth3): Releasing active interface [ 475.847772][T17214] bond2: (slave veth3): the permanent HWaddr of slave - a6:3a:7a:75:26:a7 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 475.869620][T17214] bond2: (slave veth5): Releasing active interface [ 476.313377][ T5881] Bluetooth: hci4: command tx timeout [ 478.082193][T17237] batadv1: entered allmulticast mode [ 478.118016][T17238] geneve5: entered promiscuous mode [ 478.127520][T17238] geneve5: entered allmulticast mode [ 478.169351][T14579] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 478.190659][T14579] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 478.232909][T14579] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 478.284554][T14579] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 478.387253][T17247] netlink: 'syz.1.3043': attribute type 4 has an invalid length. [ 478.591013][T16943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 478.789904][T16943] veth0_vlan: entered promiscuous mode [ 478.814106][T17267] netlink: 'syz.2.3050': attribute type 1 has an invalid length. [ 478.835075][T16943] veth1_vlan: entered promiscuous mode [ 479.274194][T16943] veth0_macvtap: entered promiscuous mode [ 479.314522][T16943] veth1_macvtap: entered promiscuous mode [ 479.356448][T16943] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 479.449529][T16943] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 479.505526][T14573] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.550078][T14573] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.620577][ T30] audit: type=1800 audit(1757894954.451:3): pid=17279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3055" name="memory.events" dev="tmpfs" ino=3322 res=0 errno=0 [ 479.651476][T14573] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.686954][T14573] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 479.712799][T17284] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 479.721224][ T30] audit: type=1804 audit(1757894954.461:4): pid=17279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.3055" name="/newroot/648/memory.events" dev="tmpfs" ino=3322 res=1 errno=0 [ 479.812846][T17288] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3057'. [ 479.824899][T17288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3057'. [ 480.021045][T14576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.049371][T14576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.128214][T14576] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 480.137331][T14576] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 480.640977][T17320] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3067'. [ 480.972628][T17295] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 481.244212][T17338] tipc: Enabled bearer , priority 0 [ 481.321676][T17342] netlink: 'syz.3.3072': attribute type 7 has an invalid length. [ 481.357490][T17338] syzkaller0: entered promiscuous mode [ 481.364738][T17338] syzkaller0: entered allmulticast mode [ 481.374735][T17338] tipc: Resetting bearer [ 481.395110][T17342] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3072'. [ 481.422488][T17342] tc_dump_action: action bad kind [ 481.468628][T17338] tipc: Resetting bearer [ 482.165200][ T5869] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 482.183908][ T5869] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 482.201510][ T5869] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 482.224903][ T5869] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 482.236717][ T5184] Bluetooth: hci4: command 0x0401 tx timeout [ 482.243670][ T5869] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 483.771283][T17338] tipc: Disabling bearer [ 483.902629][T17359] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3077'. [ 484.215112][T17376] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3081'. [ 484.250899][T14575] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.277735][T14575] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.291054][T14575] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 484.305387][ T5869] Bluetooth: hci3: command tx timeout [ 484.307757][T14575] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 484.840671][T14575] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.894890][T14575] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.918136][T14575] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 484.931560][T14575] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 484.988984][T17355] lo speed is unknown, defaulting to 1000 [ 485.047470][T14575] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.079965][T14575] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.108657][T14575] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 485.157086][T14575] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 485.326365][T14575] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 485.341088][T14575] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.357738][T14575] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 485.382930][T14575] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 485.470563][T17429] netlink: 'syz.4.3099': attribute type 1 has an invalid length. [ 485.572537][T17425] lo speed is unknown, defaulting to 1000 [ 485.940283][T17355] hsr0 speed is unknown, defaulting to 1000 [ 486.381808][T17447] netlink: 'syz.2.3102': attribute type 3 has an invalid length. [ 486.404354][ T5869] Bluetooth: hci3: command tx timeout [ 486.842266][T17460] openvswitch: netlink: Missing valid actions attribute. [ 486.862700][T17460] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.821255][T14575] bond0 (unregistering): left promiscuous mode [ 487.829290][T14575] bond0 (unregistering): Released all slaves [ 487.847253][T14575] bond1 (unregistering): Released all slaves [ 487.981885][T14575] bond2 (unregistering): Released all slaves [ 488.112731][T14575] bond3 (unregistering): Released all slaves [ 488.129974][T14575] bond4 (unregistering): Released all slaves [ 488.261327][T14575] bond5 (unregistering): Released all slaves [ 488.282166][T17425] hsr0 speed is unknown, defaulting to 1000 [ 488.283950][T17462] tipc: Enabling of bearer rejected, failed to enable media [ 488.310434][T17355] chnl_net:caif_netlink_parms(): no params data found [ 488.470690][ T5869] Bluetooth: hci3: command tx timeout [ 488.546549][T14575] tipc: Disabling bearer [ 488.610603][T14575] tipc: Disabling bearer [ 488.636564][T14575] tipc: Left network mode [ 489.171753][T17355] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.237098][T17355] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.245724][T17355] bridge_slave_0: entered allmulticast mode [ 489.341080][T17355] bridge_slave_0: entered promiscuous mode [ 489.384496][T17507] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3115'. [ 489.495741][T17355] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.545776][T17355] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.668639][T17355] bridge_slave_1: entered allmulticast mode [ 489.712554][T17355] bridge_slave_1: entered promiscuous mode [ 489.882887][T17355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 489.928670][T17355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 490.114541][T17355] team0: Port device team_slave_0 added [ 490.184180][T17355] team0: Port device team_slave_1 added [ 490.409462][T17355] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 490.434969][T17355] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 490.476177][T17355] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 490.499628][T17521] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3119'. [ 490.553500][ T5869] Bluetooth: hci3: command tx timeout [ 490.612175][T17525] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3120'. [ 490.713927][T17529] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3119'. [ 490.722962][T17529] nbd: illegal input index -8454144 [ 490.769749][T17355] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 490.791550][T17537] netlink: 'syz.3.3123': attribute type 10 has an invalid length. [ 490.812182][T17355] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 490.851415][T17542] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.3123'. [ 490.896247][T17355] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 490.966116][T14575] mac80211_hwsim hwsim5 wlan1 (unregistering): left promiscuous mode [ 491.098144][T17537] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 491.262016][T17549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3125'. [ 491.422617][T17355] hsr_slave_0: entered promiscuous mode [ 491.457098][T17355] hsr_slave_1: entered promiscuous mode [ 491.470389][T17355] debugfs: 'hsr0' already exists in 'hsr' [ 491.478872][T17355] Cannot create hsr debugfs directory [ 491.630178][T17562] netlink: 'syz.2.3130': attribute type 1 has an invalid length. [ 492.250704][T14575] hsr_slave_0: left promiscuous mode [ 492.252828][T17597] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3139'. [ 492.267792][T14575] hsr_slave_1: left promiscuous mode [ 492.301046][T14575] veth1_macvtap: left promiscuous mode [ 492.308076][T14575] veth1_vlan: left promiscuous mode [ 492.314519][T14575] veth0_vlan: left promiscuous mode [ 492.437509][T14575] pim6reg (unregistering): left allmulticast mode [ 492.709872][ T55] block nbd3: Possible stuck request ffff888024ffe000: control (read@0,1024B). Runtime 180 seconds [ 492.722584][ T55] block nbd3: Possible stuck request ffff888024ffe1c0: control (read@1024,1024B). Runtime 180 seconds [ 492.734972][ T55] block nbd3: Possible stuck request ffff888024ffe380: control (read@2048,1024B). Runtime 180 seconds [ 492.746889][ T55] block nbd3: Possible stuck request ffff888024ffe540: control (read@3072,1024B). Runtime 180 seconds [ 493.161804][T14584] smc: removing ib device !yz! [ 493.829384][T17610] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3141'. [ 493.989411][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 494.091758][T17622] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3144'. [ 494.112824][T17623] netem: incorrect ge model size [ 494.119620][T17623] netem: change failed [ 494.411743][T17620] syzkaller1: entered promiscuous mode [ 494.422379][T17620] syzkaller1: entered allmulticast mode [ 495.186075][T17653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3152'. [ 495.286235][T17661] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3155'. [ 495.298350][T17656] : entered promiscuous mode [ 495.354340][T17661] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 495.444505][T17659] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3155'. [ 495.507158][T17355] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 495.605928][T17355] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 495.690450][T17355] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 495.737267][T17355] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 496.051236][T17694] tipc: Enabled bearer , priority 0 [ 496.058730][T17696] tipc: Enabling of bearer rejected, already enabled [ 496.249087][T17700] netlink: 'syz.1.3164': attribute type 3 has an invalid length. [ 496.272472][T17693] syzkaller0: entered promiscuous mode [ 496.292494][T17693] syzkaller0: entered allmulticast mode [ 496.326158][T17693] tipc: Resetting bearer [ 496.542293][ T12] tipc: Resetting bearer [ 496.737814][T17693] tipc: Resetting bearer [ 498.773506][T17693] tipc: Disabling bearer [ 498.818119][T14575] IPVS: stop unused estimator thread 0... [ 498.830751][T17717] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -12 [ 498.834660][ T30] audit: type=1800 audit(1757894973.661:5): pid=17717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3168" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 498.847105][T17717] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -12 [ 498.886690][T17355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 498.894419][T17717] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 498.959433][T17355] 8021q: adding VLAN 0 to HW filter on device team0 [ 498.998183][T14573] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.005681][T14573] bridge0: port 1(bridge_slave_0) entered forwarding state [ 499.065576][T14573] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.073193][T14573] bridge0: port 2(bridge_slave_1) entered forwarding state [ 499.202519][T17729] lo speed is unknown, defaulting to 1000 [ 499.232748][T17729] hsr0 speed is unknown, defaulting to 1000 [ 499.249343][T17355] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 499.931836][T17757] nftables ruleset with unbound chain [ 500.385361][T17751] batadv_slave_0: left promiscuous mode [ 501.125653][T17751] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 501.191016][T17751] gtp0: left promiscuous mode [ 501.281057][T17751] gtp1: left promiscuous mode [ 501.291059][T17751] bond3: left promiscuous mode [ 501.299895][T17751] bond4: left promiscuous mode [ 501.315358][T17751] bridge5: left promiscuous mode [ 501.324256][T17751] gtp2: left promiscuous mode [ 501.331446][T17751] veth5: left promiscuous mode [ 501.340892][T17751] veth7: left promiscuous mode [ 501.365822][T17751] geneve5: left promiscuous mode [ 501.409546][T17800] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 501.437918][T17800] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 501.450677][T14576] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 501.460373][T14576] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.491071][T14576] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 19999 - 0 [ 501.523110][T14576] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 501.532091][T14576] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.600643][T14576] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 19999 - 0 [ 501.821414][T17355] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 501.847313][T14576] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 501.884547][T14576] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.925793][T14576] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 19999 - 0 [ 501.968717][T14576] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 501.990600][T14576] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.008265][T14576] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 19999 - 0 [ 502.040006][T17814] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 502.261480][T17355] veth0_vlan: entered promiscuous mode [ 502.300934][T17355] veth1_vlan: entered promiscuous mode [ 502.408254][T17355] veth0_macvtap: entered promiscuous mode [ 502.436646][T17355] veth1_macvtap: entered promiscuous mode [ 502.518692][T17355] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 502.551385][T17355] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 502.633891][T14575] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.672907][T14575] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.730915][T14577] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.767541][T14576] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 502.966841][T14577] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 502.983613][T14577] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.087437][T14573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 503.109310][T14573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 503.265714][T17852] pim6reg0: tun_chr_ioctl cmd 2147767507 [ 503.575014][T17863] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3229'. [ 503.610864][T17863] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3229'. [ 504.086704][T17879] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 504.154825][T17881] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3235'. [ 504.184770][T17881] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3235'. [ 504.231362][T17881] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3235'. [ 504.236397][T17885] delete_channel: no stack [ 504.277973][T17885] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3235'. [ 504.309893][T17881] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3235'. [ 504.404535][T17889] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 504.654584][T17901] openvswitch: netlink: IP tunnel TTL not specified. [ 504.771697][ T5881] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 504.784550][ T5881] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 504.795241][ T5881] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 504.806399][ T5881] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 504.848044][ T5881] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 504.954739][T17913] tipc: Enabled bearer , priority 0 [ 504.986411][T17916] syzkaller0: entered promiscuous mode [ 504.991942][T17916] syzkaller0: entered allmulticast mode [ 505.171673][T17906] lo speed is unknown, defaulting to 1000 [ 505.315026][T17913] tipc: Resetting bearer [ 505.352823][T17906] hsr0 speed is unknown, defaulting to 1000 [ 506.796600][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 506.944119][ T5881] Bluetooth: hci0: command tx timeout [ 507.270807][T17903] tipc: Resetting bearer [ 507.291115][T17903] tipc: Disabling bearer [ 507.964118][T17958] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3262'. [ 508.149759][T17906] chnl_net:caif_netlink_parms(): no params data found [ 508.304993][T17968] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 509.025170][ T5881] Bluetooth: hci0: command tx timeout [ 510.798338][T14575] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 510.807284][T14575] mac80211_hwsim hwsim11 wlan1: left allmulticast mode [ 510.814940][T14575] bond0 (unregistering): Released all slaves [ 510.936853][T14575] bond1 (unregistering): Released all slaves [ 510.955589][T14575] bond2 (unregistering): Released all slaves [ 511.077863][T14575] bond3 (unregistering): Released all slaves [ 511.113309][ T5881] Bluetooth: hci0: command tx timeout [ 511.199203][T14575] bond4 (unregistering): Released all slaves [ 511.319460][T14575] bond5 (unregistering): Released all slaves [ 511.335722][T14575] bond6 (unregistering): Released all slaves [ 511.460734][T14575] bond7 (unregistering): Released all slaves [ 511.476990][T14575] bond8 (unregistering): Released all slaves [ 511.483205][ T5234] udevd[5234]: worker [5920] /devices/virtual/block/nbd3 timeout; kill it [ 511.491864][ T5234] udevd[5234]: seq 16405 '/devices/virtual/block/nbd3' killed [ 511.619509][T14575] bond9 (unregistering): Released all slaves [ 511.945851][T17985] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.953722][T17985] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.205067][T17985] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 512.225305][T17985] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 512.374133][T17990] sch_tbf: burst 3298 is lower than device lo mtu (65550) ! [ 512.450376][T14575] tipc: Disabling bearer [ 512.469954][T14575] tipc: Disabling bearer [ 512.506285][T14578] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.514323][T14575] tipc: Left network mode [ 512.561861][T14578] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.572091][T14578] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.690053][T14578] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 512.755865][T14575] IPVS: stopping master sync thread 16027 ... [ 512.780202][T18010] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3286'. [ 512.929772][T17906] bridge0: port 1(bridge_slave_0) entered blocking state [ 512.950321][T17906] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.998108][T17906] bridge_slave_0: entered allmulticast mode [ 513.054523][T17906] bridge_slave_0: entered promiscuous mode [ 513.064879][T17906] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.072486][T17906] bridge0: port 2(bridge_slave_1) entered disabled state [ 513.113239][T17906] bridge_slave_1: entered allmulticast mode [ 513.133503][T17906] bridge_slave_1: entered promiscuous mode [ 513.194447][ T5881] Bluetooth: hci0: command tx timeout [ 513.281519][T18022] bridge0: port 2(bridge_slave_1) entered disabled state [ 513.290608][T18022] bridge0: port 1(bridge_slave_0) entered disabled state [ 513.431462][T18030] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.446590][T18031] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.512067][T18022] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 513.534869][T18022] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 513.748861][ T7736] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.770858][ T7736] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.894469][ T7736] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.913716][T18040] netlink: 'syz.3.3294': attribute type 1 has an invalid length. [ 513.915155][ T7736] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.997772][T17906] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 514.076629][T17906] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 514.151625][T18040] bond1 (unregistering): Released all slaves [ 514.344061][T18062] netlink: 168 bytes leftover after parsing attributes in process `syz.2.3299'. [ 514.478343][T17906] team0: Port device team_slave_0 added [ 514.485554][T18065] sctp: [Deprecated]: syz.1.3300 (pid 18065) Use of struct sctp_assoc_value in delayed_ack socket option. [ 514.485554][T18065] Use struct sctp_sack_info instead [ 514.526643][T18059] netdevsim netdevsim2: Direct firmware load for failed with error -2 [ 514.543858][T18059] netdevsim netdevsim2: Falling back to sysfs fallback for: [ 514.634694][T17906] team0: Port device team_slave_1 added [ 514.745187][T18076] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3303'. [ 514.764339][T17906] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 514.779672][T17906] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 514.827730][T17906] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 514.850181][T18078] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3304'. [ 514.902839][T17906] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 514.910057][T17906] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 514.947982][T18083] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3304'. [ 514.960327][T17906] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 514.976310][T18078] gretap0: entered promiscuous mode [ 515.025646][T18083] 0ªî{X¹¦: renamed from gretap0 [ 515.041133][T18083] 0ªî{X¹¦: left promiscuous mode [ 515.062436][T18083] 0ªî{X¹¦: entered allmulticast mode [ 515.076295][T18083] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 515.391944][T18096] netlink: 'syz.1.3308': attribute type 58 has an invalid length. [ 515.406063][T18096] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3308'. [ 516.267011][T18089] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3307'. [ 516.589329][T17906] hsr_slave_0: entered promiscuous mode [ 516.614978][T17906] hsr_slave_1: entered promiscuous mode [ 516.629408][T17906] debugfs: 'hsr0' already exists in 'hsr' [ 516.639147][T17906] Cannot create hsr debugfs directory [ 516.974525][T18121] tipc: Enabling of bearer rejected, failed to enable media [ 517.080568][T18125] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3316'. [ 517.950045][T14575] IPVS: stop unused estimator thread 0... [ 518.007738][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.050131][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.098131][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.116616][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.200898][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.231203][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.249456][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.309251][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.369194][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.397659][T18149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 518.477764][T17906] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 518.510857][T17906] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 518.546082][T17906] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 518.581616][T17906] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 518.718550][T18179] sctp: [Deprecated]: syz.3.3334 (pid 18179) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.718550][T18179] Use struct sctp_sack_info instead [ 518.787210][T18183] netlink: 'syz.1.3332': attribute type 10 has an invalid length. [ 518.830319][T18183] team0: Port device dummy0 added [ 518.936781][T17906] 8021q: adding VLAN 0 to HW filter on device bond0 [ 518.989300][T17906] 8021q: adding VLAN 0 to HW filter on device team0 [ 519.027342][T14577] bridge0: port 1(bridge_slave_0) entered blocking state [ 519.034624][T14577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 519.062941][T14577] bridge0: port 2(bridge_slave_1) entered blocking state [ 519.070222][T14577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 520.220490][T17906] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 520.970138][T18265] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.978113][T18265] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.178035][T18265] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 521.195416][T18265] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 521.454667][T18266] bond1: entered promiscuous mode [ 521.459855][T18266] bond1: entered allmulticast mode [ 521.467114][T18266] 8021q: adding VLAN 0 to HW filter on device bond1 [ 521.560844][T14584] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.591436][T14584] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.628313][T14584] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.648286][T14584] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 521.679367][T18287] dvmrp0: entered allmulticast mode [ 521.771096][T17906] veth0_vlan: entered promiscuous mode [ 521.798526][T17906] veth1_vlan: entered promiscuous mode [ 521.940084][T17906] veth0_macvtap: entered promiscuous mode [ 521.956275][T18296] netlink: 'syz.2.3359': attribute type 11 has an invalid length. [ 521.967506][T17906] veth1_macvtap: entered promiscuous mode [ 522.089846][T17906] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 522.188404][T17906] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 522.251203][T14580] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 522.284552][T14580] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 522.304826][T14580] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 522.362170][T18315] : entered promiscuous mode [ 522.381712][T14580] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 522.745982][T14584] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 522.757341][T18336] syzkaller1: entered promiscuous mode [ 522.782469][T18336] syzkaller1: entered allmulticast mode [ 522.789240][T14584] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 522.799676][ T55] block nbd3: Possible stuck request ffff888024ffe000: control (read@0,1024B). Runtime 210 seconds [ 522.822243][ T55] block nbd3: Possible stuck request ffff888024ffe1c0: control (read@1024,1024B). Runtime 210 seconds [ 522.835125][ T55] block nbd3: Possible stuck request ffff888024ffe380: control (read@2048,1024B). Runtime 210 seconds [ 522.848482][ T55] block nbd3: Possible stuck request ffff888024ffe540: control (read@3072,1024B). Runtime 210 seconds [ 522.944795][ T7736] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 522.952691][ T7736] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 524.184337][T18378] netlink: 'syz.0.3382': attribute type 1 has an invalid length. [ 524.207048][T18378] __nla_validate_parse: 61 callbacks suppressed [ 524.207073][T18378] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3382'. [ 524.261109][T18378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3382'. [ 524.412880][T18385] netlink: ct family unspecified [ 524.423119][T18385] openvswitch: netlink: Actions may not be safe on all matching packets [ 524.788566][ T5869] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 524.799612][ T5869] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 524.808936][ T5869] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 524.836877][ T5869] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 524.849107][ T5869] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 525.289294][T18394] netlink: 'syz.0.3387': attribute type 3 has an invalid length. [ 525.297474][T18394] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 525.444447][T18392] bridge2: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 525.572013][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3390'. [ 525.581857][T18408] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3390'. [ 525.599504][T18408] netlink: 'syz.0.3390': attribute type 11 has an invalid length. [ 525.622915][T18399] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.630587][T18399] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.659053][T18409] netlink: 'syz.2.3391': attribute type 1 has an invalid length. [ 525.792762][T18411] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.3392'. [ 525.839541][T18399] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 525.870381][T18399] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 526.099638][T18407] bond1: left promiscuous mode [ 526.130398][T14584] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.159959][T14584] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.195020][T14584] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.213279][T14584] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.270774][T18387] lo speed is unknown, defaulting to 1000 [ 526.317750][T18387] hsr0 speed is unknown, defaulting to 1000 [ 526.387182][T18422] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3395'. [ 526.778126][T18439] netlink: 'syz.4.3398': attribute type 1 has an invalid length. [ 526.786323][T18439] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3398'. [ 526.826131][T18439] netlink: 'syz.4.3398': attribute type 1 has an invalid length. [ 526.848427][T18387] chnl_net:caif_netlink_parms(): no params data found [ 526.850265][T18439] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3398'. [ 526.944145][ T5869] Bluetooth: hci5: command tx timeout [ 527.074497][T18453] netlink: 'syz.4.3400': attribute type 1 has an invalid length. [ 527.171327][T18453] vlan2: entered promiscuous mode [ 527.178429][T18453] dummy0: entered promiscuous mode [ 527.184785][T18453] vlan2: entered allmulticast mode [ 527.190100][T18453] dummy0: entered allmulticast mode [ 527.211062][T18461] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3403'. [ 527.238900][T18462] veth0: entered promiscuous mode [ 527.258339][T18387] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.270382][T18387] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.278233][T18387] bridge_slave_0: entered allmulticast mode [ 527.288050][T18387] bridge_slave_0: entered promiscuous mode [ 527.318683][T18387] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.328375][T18387] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.342863][T18387] bridge_slave_1: entered allmulticast mode [ 527.366166][T18387] bridge_slave_1: entered promiscuous mode [ 527.432033][T18452] veth0: left promiscuous mode [ 527.537109][T18387] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 527.618609][T18387] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 527.706076][T18387] team0: Port device team_slave_0 added [ 527.714432][T18479] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3409'. [ 527.716189][T18387] team0: Port device team_slave_1 added [ 527.812577][T18387] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 527.834505][T18387] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 527.868612][T18387] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 527.901397][T18387] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 527.927083][T18387] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 527.967324][T18387] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 528.092146][T18492] pim6reg: entered allmulticast mode [ 528.131933][T18387] hsr_slave_0: entered promiscuous mode [ 528.148320][T18387] hsr_slave_1: entered promiscuous mode [ 528.159383][T18387] debugfs: 'hsr0' already exists in 'hsr' [ 528.172885][T18387] Cannot create hsr debugfs directory [ 528.567266][T18510] tipc: Started in network mode [ 528.572205][T18510] tipc: Node identity 0ad5842c549, cluster identity 4711 [ 528.580887][T18510] tipc: Enabled bearer , priority 0 [ 528.597436][T18507] syzkaller0: entered promiscuous mode [ 528.614906][T18507] syzkaller0: entered allmulticast mode [ 528.639173][T18509] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 528.814228][T18387] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.862416][T18510] tipc: Resetting bearer [ 528.934006][T18510] tipc: Disabling bearer [ 529.002311][T18387] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.031108][ T5869] Bluetooth: hci5: command tx timeout [ 529.131771][T18387] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.234953][T18387] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 529.374448][T18553] __nla_validate_parse: 2 callbacks suppressed [ 529.374470][T18553] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3436'. [ 529.394926][T18545] veth3: entered allmulticast mode [ 529.492576][T18558] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge_slave_0 [ 529.531572][T18560] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3438'. [ 529.564645][T18560] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 529.683423][T18566] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3441'. [ 529.785639][T18571] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3441'. [ 529.801198][T18571] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3441'. [ 529.816881][T18572] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3443'. [ 529.822394][T18387] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 529.835725][T18572] openvswitch: netlink: Port -8 exceeds max allowable 65535 [ 529.887150][T18387] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 529.935670][T18387] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 529.978051][T18387] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 529.988807][T18578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3446'. [ 530.307167][T18598] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3451'. [ 530.316926][T18387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.360578][T18387] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.372889][T18600] netlink: 'syz.3.3452': attribute type 10 has an invalid length. [ 530.379632][T18601] bridge: RTM_NEWNEIGH with invalid ether address [ 530.397243][T14575] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.404511][T14575] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.430274][T18600] team0: Device hsr_slave_0 failed to register rx_handler [ 530.492010][T14575] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.499243][T14575] bridge0: port 2(bridge_slave_1) entered forwarding state [ 530.509067][T18605] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3454'. [ 530.736335][T18613] erspan0: entered allmulticast mode [ 531.106404][ T5869] Bluetooth: hci5: command tx timeout [ 531.159198][T18630] dvmrp0: entered allmulticast mode [ 531.192226][T18633] netlink: 'syz.2.3463': attribute type 1 has an invalid length. [ 531.201012][T18635] (unnamed net_device) (uninitialized): option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 531.217445][T18633] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3463'. [ 531.218197][T18626] scsi_nl_rcv_msg: discarding partial skb [ 531.259949][T18387] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 531.313899][T18630] dvmrp0: left allmulticast mode [ 531.501742][T18387] veth0_vlan: entered promiscuous mode [ 531.556410][T18387] veth1_vlan: entered promiscuous mode [ 531.745710][T18387] veth0_macvtap: entered promiscuous mode [ 531.761881][T18387] veth1_macvtap: entered promiscuous mode [ 531.764282][T18649] nbd0: detected capacity change from 0 to 63 [ 531.787248][T18387] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 531.806477][T18662] nbd: must specify an index to disconnect [ 531.817132][T18387] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 531.854130][ T7736] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 531.866447][ T5869] block nbd0: Receive control failed (result -104) [ 531.980677][ T7736] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.014792][ T7736] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.059495][ T7736] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.292777][T14575] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.316396][T14575] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.378410][ T7736] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.392499][ T7736] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 533.183757][ T5869] Bluetooth: hci5: command tx timeout [ 533.286711][T18719] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.294562][T18719] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.555591][T18719] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 533.572164][T18719] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 533.748087][T14584] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.779525][T14584] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.794838][T14584] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.838070][T14584] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.413134][T18773] __nla_validate_parse: 12 callbacks suppressed [ 534.413156][T18773] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3503'. [ 534.458427][T18773] netlink: 332 bytes leftover after parsing attributes in process `syz.3.3503'. [ 534.493364][ T7736] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 20002 - 0 [ 534.509413][ T7736] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20002 - 0 [ 534.515277][T18776] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3505'. [ 534.528044][T14577] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20002 - 0 [ 534.546045][T14577] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20002 - 0 [ 534.699793][T18784] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 534.741612][T18782] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3506'. [ 534.884839][T18788] : entered promiscuous mode [ 535.129117][T18802] netlink: 277 bytes leftover after parsing attributes in process `syz.0.3513'. [ 535.201717][T18807] syzkaller1: entered promiscuous mode [ 535.218352][T18807] syzkaller1: entered allmulticast mode [ 535.495444][T18824] tipc: Started in network mode [ 535.509884][T18824] tipc: Node identity 7e46e1c177c6, cluster identity 4711 [ 535.519517][T18824] tipc: Enabled bearer , priority 0 [ 535.547228][T18824] syzkaller0: entered promiscuous mode [ 535.552943][T18824] syzkaller0: entered allmulticast mode [ 535.640290][T18824] tipc: Resetting bearer [ 535.668095][T18834] netlink: 'syz.1.3523': attribute type 11 has an invalid length. [ 535.682699][T18823] tipc: Resetting bearer [ 535.707819][T18823] tipc: Disabling bearer [ 535.938201][T18842] Bluetooth: MGMT ver 1.23 [ 536.374418][T18871] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3534'. [ 536.398443][T18877] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3536'. [ 536.562818][T18880] ip6erspan0: entered allmulticast mode [ 536.588519][T18884] netlink: 'syz.4.3537': attribute type 21 has an invalid length. [ 536.635396][T18884] netlink: 'syz.4.3537': attribute type 22 has an invalid length. [ 536.643979][T18884] netlink: 'syz.4.3537': attribute type 23 has an invalid length. [ 536.651971][T18884] netlink: 'syz.4.3537': attribute type 25 has an invalid length. [ 536.661016][T18884] netlink: 'syz.4.3537': attribute type 26 has an invalid length. [ 536.669190][T18884] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3537'. [ 536.841733][T18882] team0 (unregistering): Port device team_slave_0 removed [ 536.851189][T18882] team0 (unregistering): Port device team_slave_1 removed [ 537.050589][T18896] batman_adv: batadv0: Adding interface: macsec1 [ 537.063739][T18896] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 537.117795][T18896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 537.138564][T18896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 537.159425][T18896] batman_adv: batadv0: Interface activated: macsec1 [ 537.201171][T18909] delete_channel: no stack [ 537.215510][T18897] netlink: 'syz.1.3543': attribute type 23 has an invalid length. [ 537.258685][T18906] bond1: left allmulticast mode [ 537.290434][T18911] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.3546'. [ 537.317275][T18911] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 537.340178][T18911] openvswitch: netlink: Duplicate key (type 0). [ 537.522858][T18919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3549'. [ 537.537045][T18919] netlink: 'syz.2.3549': attribute type 1 has an invalid length. [ 537.660479][T18919] 8021q: adding VLAN 0 to HW filter on device bond1 [ 537.912872][T18923] 8021q: adding VLAN 0 to HW filter on device bond1 [ 537.921335][T18923] bond1: (slave vxcan5): The slave device specified does not support setting the MAC address [ 537.955479][T18923] bond1: (slave vxcan5): Error -95 calling set_mac_address [ 538.011157][T18936] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 538.062326][T18936] netlink: 'syz.0.3554': attribute type 39 has an invalid length. [ 538.751608][T18975] netlink: 'syz.3.3566': attribute type 8 has an invalid length. [ 539.103889][T14577] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 20002 - 0 [ 539.172373][T14577] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 20002 - 0 [ 539.212559][T14577] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 20002 - 0 [ 539.218197][T18995] sctp: [Deprecated]: syz.4.3572 (pid 18995) Use of int in maxseg socket option. [ 539.218197][T18995] Use struct sctp_assoc_value instead [ 539.241723][T14577] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 20002 - 0 [ 539.613560][T19007] __nla_validate_parse: 1 callbacks suppressed [ 539.613583][T19007] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3575'. [ 539.640358][T19010] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3576'. [ 539.668980][T19005] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3575'. [ 540.271245][T19027] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.3582'. [ 540.339281][T19033] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3583'. [ 540.366101][T19034] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3581'. [ 540.551729][T19046] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3588'. [ 540.735057][T19051] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3589'. [ 540.895084][T19065] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3590'. [ 541.112088][T19072] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3594'. [ 541.129375][T19072] Unsupported xt match [ 541.129398][T19072] unable to load match [ 541.150112][T19074] Unsupported xt match [ 541.150133][T19074] unable to load match [ 541.314903][T19082] netlink: 'syz.2.3597': attribute type 15 has an invalid length. [ 541.698970][T19103] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 542.071090][T19118] tipc: Enabled bearer , priority 0 [ 542.094326][T19118] syzkaller0: entered promiscuous mode [ 542.099858][T19118] syzkaller0: entered allmulticast mode [ 542.715528][T19116] tipc: Resetting bearer [ 542.768240][T19116] tipc: Disabling bearer [ 542.850691][T19160] netlink: 'syz.3.3621': attribute type 1 has an invalid length. [ 543.292426][T19179] netlink: 'syz.2.3627': attribute type 1 has an invalid length. [ 543.831241][T19217] netlink: 'syz.3.3636': attribute type 29 has an invalid length. [ 544.251347][T19242] netlink: 'syz.2.3643': attribute type 16 has an invalid length. [ 544.268367][T19242] netlink: 'syz.2.3643': attribute type 17 has an invalid length. [ 544.369763][T19242] 8021q: adding VLAN 0 to HW filter on device bond0 [ 544.382376][T19242] 8021q: adding VLAN 0 to HW filter on device team0 [ 544.401339][T19242] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 544.594218][T19254] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 544.755475][T19260] __nla_validate_parse: 10 callbacks suppressed [ 544.755499][T19260] netlink: 1196 bytes leftover after parsing attributes in process `syz.0.3649'. [ 544.958370][T19275] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3652'. [ 545.063781][T19277] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 545.331457][T19294] netlink: 404 bytes leftover after parsing attributes in process `syz.1.3659'. [ 545.372094][T19294] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3659'. [ 545.388575][T19295] netlink: 'syz.0.3658': attribute type 1 has an invalid length. [ 545.406679][T19294] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3659'. [ 545.437340][T19294] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3659'. [ 545.511165][T19295] 8021q: adding VLAN 0 to HW filter on device bond1 [ 545.674950][T19313] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3662'. [ 545.694807][T19307] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 545.746074][T19300] batman_adv: batadv0: Interface deactivated: macsec1 [ 545.787317][T19302] bond1: (slave geneve3): making interface the new active one [ 545.817276][T19302] bond1: (slave geneve3): Enslaving as an active interface with an up link [ 545.878828][T14584] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.917255][T14584] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.952295][T14584] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 545.994101][T14584] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 546.206093][T19339] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3670'. [ 546.458531][T19355] netlink: 'syz.1.3674': attribute type 3 has an invalid length. [ 546.500352][T19355] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3674'. [ 546.526365][T19356] tipc: Enabling of bearer rejected, failed to enable media [ 546.590798][T19355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3674'. [ 546.761704][T19362] xt_HMARK: spi-set and port-set can't be combined [ 546.795728][T19362] Bluetooth: MGMT ver 1.23 [ 546.854755][T19364] openvswitch: netlink: IP tunnel dst address not specified [ 546.941055][T19364] tipc: Enabled bearer , priority 0 [ 546.974619][T19364] syzkaller0: entered promiscuous mode [ 546.985953][T19364] syzkaller0: entered allmulticast mode [ 546.993658][T19373] netlink: 'syz.2.3682': attribute type 1 has an invalid length. [ 547.014889][T19373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 547.046901][T19363] tipc: Resetting bearer [ 547.127315][T19378] netlink: 'syz.2.3683': attribute type 2 has an invalid length. [ 547.136729][T19363] tipc: Disabling bearer [ 547.160651][T19376] tipc: Started in network mode [ 547.170447][T19376] tipc: Node identity 1e2655d91971, cluster identity 4711 [ 547.182081][T19376] tipc: Enabled bearer , priority 0 [ 547.201661][T19380] syzkaller0: entered promiscuous mode [ 547.220243][T19380] syzkaller0: entered allmulticast mode [ 547.248076][T19374] unknown channel width for channel at 909000KHz? [ 547.277653][T19374] unknown channel width for channel at 909000KHz? [ 547.303527][T19374] unknown channel width for channel at 909000KHz? [ 547.347681][T19374] sch_tbf: burst 90 is lower than device syzkaller0 mtu (1514) ! [ 547.469336][T19391] bond2: entered promiscuous mode [ 547.476239][T19391] bond2: entered allmulticast mode [ 547.481915][T19391] 8021q: adding VLAN 0 to HW filter on device bond2 [ 547.498383][T19374] tipc: Resetting bearer [ 547.516836][T19371] tipc: Resetting bearer [ 547.548235][T19371] tipc: Disabling bearer [ 547.618691][T19397] syzkaller0: entered promiscuous mode [ 547.625449][T19397] syzkaller0: entered allmulticast mode [ 547.877757][T19415] netem: invalid attributes len -24 [ 547.883500][T19415] netem: change failed [ 550.164041][T19444] __nla_validate_parse: 8 callbacks suppressed [ 550.164075][T19444] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3702'. [ 550.213674][T19446] tipc: Enabling of bearer rejected, failed to enable media [ 550.230446][T19447] tipc: Enabling of bearer rejected, failed to enable media [ 550.525253][T19462] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3705'. [ 550.569537][T19462] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3705'. [ 551.075402][T19479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3712'. [ 551.133217][ T12] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.162871][ T12] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.201665][ T12] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.242592][ T12] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.329706][T19489] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3715'. [ 551.370080][T19492] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3717'. [ 551.575724][T19505] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3720'. [ 551.624248][T19505] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3720'. [ 551.771388][T19512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 552.060098][T19533] netlink: 'syz.3.3731': attribute type 1 has an invalid length. [ 552.331671][T19556] netlink: 'syz.3.3736': attribute type 30 has an invalid length. [ 552.354436][T19556] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 552.372924][T19556] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 552.421873][T19556] macsec0: entered promiscuous mode [ 552.440089][T19554] macsec0: left promiscuous mode [ 552.864898][ T55] block nbd3: Possible stuck request ffff888024ffe000: control (read@0,1024B). Runtime 240 seconds [ 552.876782][ T55] block nbd3: Possible stuck request ffff888024ffe1c0: control (read@1024,1024B). Runtime 240 seconds [ 552.888727][ T55] block nbd3: Possible stuck request ffff888024ffe380: control (read@2048,1024B). Runtime 240 seconds [ 552.901402][ T55] block nbd3: Possible stuck request ffff888024ffe540: control (read@3072,1024B). Runtime 240 seconds [ 553.119787][T19585] tipc: Enabled bearer , priority 0 [ 553.133997][T19585] syzkaller0: entered promiscuous mode [ 553.139657][T19585] syzkaller0: entered allmulticast mode [ 553.158614][T19585] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3744'. [ 553.177127][T19590] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 553.186066][T19589] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 553.192107][T19588] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3745'. [ 553.230701][T19589] openvswitch: netlink: Actions may not be safe on all matching packets [ 553.256408][T19592] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 553.345669][T19584] tipc: Resetting bearer [ 553.412644][T19584] tipc: Disabling bearer [ 553.763581][T19612] netlink: 'syz.3.3754': attribute type 4 has an invalid length. [ 553.811295][T19612] `: renamed from bond0 [ 554.055154][T19631] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 554.126323][T19634] netlink: 'syz.3.3759': attribute type 23 has an invalid length. [ 555.222876][T19677] openvswitch: netlink: Flow key attr not present in new flow. [ 555.435159][T19690] netlink: 'syz.0.3775': attribute type 1 has an invalid length. [ 555.444032][T19691] bond2: left promiscuous mode [ 555.459389][T19690] __nla_validate_parse: 2 callbacks suppressed [ 555.459410][T19690] netlink: 184 bytes leftover after parsing attributes in process `syz.0.3775'. [ 555.543689][T19690] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3775'. [ 555.838166][T19708] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 555.873209][T19708] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 556.345833][T14575] tipc: Subscription rejected, illegal request [ 556.483641][T19739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3794'. [ 556.496207][T19739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3794'. [ 556.520901][T19728] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3790'. [ 556.534104][T19728] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3790'. [ 556.570626][T19728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3790'. [ 556.619683][T19728] netlink: 140 bytes leftover after parsing attributes in process `syz.1.3790'. [ 556.648248][T19728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3790'. [ 556.661974][T19743] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3795'. [ 556.872721][T14575] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.941131][T14575] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.960543][T14575] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.991660][T14575] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 557.144886][T19768] syz.2.3802: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 557.186587][T19768] CPU: 1 UID: 0 PID: 19768 Comm: syz.2.3802 Not tainted syzkaller #0 PREEMPT(full) [ 557.186618][T19768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 557.186632][T19768] Call Trace: [ 557.186641][T19768] [ 557.186651][T19768] dump_stack_lvl+0x189/0x250 [ 557.186688][T19768] ? __pfx_dump_stack_lvl+0x10/0x10 [ 557.186713][T19768] ? __pfx__printk+0x10/0x10 [ 557.186746][T19768] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 557.186773][T19768] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 557.186801][T19768] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 557.186829][T19768] warn_alloc+0x214/0x310 [ 557.186869][T19768] ? __pfx_warn_alloc+0x10/0x10 [ 557.186914][T19768] ? __get_vm_area_node+0x28f/0x300 [ 557.186945][T19768] ? hash_netportnet_create+0x354/0xf90 [ 557.186975][T19768] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 557.187038][T19768] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 557.187078][T19768] ? rcu_is_watching+0x15/0xb0 [ 557.187101][T19768] ? hash_netportnet_create+0x354/0xf90 [ 557.187138][T19768] ? hash_netportnet_create+0x354/0xf90 [ 557.187161][T19768] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 557.187193][T19768] ? hash_netportnet_create+0x354/0xf90 [ 557.187218][T19768] ? hash_netportnet_create+0x2fa/0xf90 [ 557.187248][T19768] hash_netportnet_create+0x354/0xf90 [ 557.187283][T19768] ? __nla_parse+0x40/0x60 [ 557.187307][T19768] ? __pfx_hash_netportnet_create+0x10/0x10 [ 557.187335][T19768] ip_set_create+0xa94/0x1940 [ 557.187369][T19768] ? ip_set_create+0x4a2/0x1940 [ 557.187413][T19768] ? __pfx_ip_set_create+0x10/0x10 [ 557.187486][T19768] nfnetlink_rcv_msg+0xb4d/0x1130 [ 557.187523][T19768] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 557.187582][T19768] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 557.187673][T19768] netlink_rcv_skb+0x208/0x470 [ 557.187699][T19768] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 557.187735][T19768] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 557.187772][T19768] ? bpf_lsm_capable+0x9/0x20 [ 557.187803][T19768] ? security_capable+0x7e/0x2e0 [ 557.187845][T19768] nfnetlink_rcv+0x26a/0x2520 [ 557.187879][T19768] ? is_bpf_text_address+0x26/0x2b0 [ 557.187917][T19768] ? kernel_text_address+0xa5/0xe0 [ 557.187950][T19768] ? __kernel_text_address+0xd/0x40 [ 557.187980][T19768] ? unwind_get_return_address+0x4d/0x90 [ 557.188005][T19768] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 557.188032][T19768] ? arch_stack_walk+0xfc/0x150 [ 557.188075][T19768] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 557.188110][T19768] ? stack_depot_save_flags+0x40/0x860 [ 557.188156][T19768] ? __lock_acquire+0xab9/0xd20 [ 557.188218][T19768] ? __lock_acquire+0xab9/0xd20 [ 557.188262][T19768] ? netlink_deliver_tap+0x2e/0x1b0 [ 557.188293][T19768] ? netlink_deliver_tap+0x2e/0x1b0 [ 557.188323][T19768] netlink_unicast+0x82f/0x9e0 [ 557.188367][T19768] ? __pfx_netlink_unicast+0x10/0x10 [ 557.188401][T19768] ? netlink_sendmsg+0x642/0xb30 [ 557.188419][T19768] ? skb_put+0x11b/0x210 [ 557.188449][T19768] netlink_sendmsg+0x805/0xb30 [ 557.188481][T19768] ? __pfx_netlink_sendmsg+0x10/0x10 [ 557.188506][T19768] ? aa_sock_msg_perm+0xf1/0x1d0 [ 557.188529][T19768] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 557.188551][T19768] ? __pfx_netlink_sendmsg+0x10/0x10 [ 557.188572][T19768] __sock_sendmsg+0x21c/0x270 [ 557.188609][T19768] ____sys_sendmsg+0x505/0x830 [ 557.188643][T19768] ? __pfx_____sys_sendmsg+0x10/0x10 [ 557.188681][T19768] ? import_iovec+0x74/0xa0 [ 557.188714][T19768] ___sys_sendmsg+0x21f/0x2a0 [ 557.188744][T19768] ? __pfx____sys_sendmsg+0x10/0x10 [ 557.188822][T19768] ? __fget_files+0x2a/0x420 [ 557.188840][T19768] ? __fget_files+0x3a0/0x420 [ 557.188869][T19768] __x64_sys_sendmsg+0x19b/0x260 [ 557.188899][T19768] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 557.188939][T19768] ? rcu_is_watching+0x15/0xb0 [ 557.188966][T19768] ? do_syscall_64+0xbe/0x3b0 [ 557.188995][T19768] do_syscall_64+0xfa/0x3b0 [ 557.189017][T19768] ? lockdep_hardirqs_on+0x9c/0x150 [ 557.189038][T19768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.189059][T19768] ? clear_bhb_loop+0x60/0xb0 [ 557.189084][T19768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.189107][T19768] RIP: 0033:0x7f509c18eba9 [ 557.189137][T19768] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 557.189156][T19768] RSP: 002b:00007f509d040038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 557.189179][T19768] RAX: ffffffffffffffda RBX: 00007f509c3d5fa0 RCX: 00007f509c18eba9 [ 557.189196][T19768] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 557.189210][T19768] RBP: 00007f509c211e19 R08: 0000000000000000 R09: 0000000000000000 [ 557.189224][T19768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 557.189236][T19768] R13: 00007f509c3d6038 R14: 00007f509c3d5fa0 R15: 00007ffcb8d59268 [ 557.189270][T19768] [ 557.192748][T19768] Mem-Info: [ 557.684378][T19768] active_anon:6134 inactive_anon:0 isolated_anon:0 [ 557.684378][T19768] active_file:3227 inactive_file:40050 isolated_file:0 [ 557.684378][T19768] unevictable:768 dirty:73 writeback:0 [ 557.684378][T19768] slab_reclaimable:12956 slab_unreclaimable:117709 [ 557.684378][T19768] mapped:29396 shmem:1367 pagetables:1186 [ 557.684378][T19768] sec_pagetables:0 bounce:0 [ 557.684378][T19768] kernel_misc_reclaimable:0 [ 557.684378][T19768] free:1301942 free_pcp:12138 free_cma:0 [ 557.739590][T19768] Node 0 active_anon:24536kB inactive_anon:0kB active_file:12908kB inactive_file:160000kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117584kB dirty:292kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15548kB pagetables:4588kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 557.811803][T19768] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 557.849741][T19768] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 557.929459][T19768] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 557.950013][T19768] Node 0 DMA32 free:1306252kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24092kB inactive_anon:0kB active_file:12908kB inactive_file:158432kB unevictable:1536kB writepending:292kB present:3129332kB managed:2557416kB mlocked:0kB bounce:0kB free_pcp:34948kB local_pcp:21284kB free_cma:0kB [ 557.987913][T19768] lowmem_reserve[]: 0 0 1 1 1 [ 557.994090][T19768] Node 0 Normal free:24kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1568kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 558.074650][T19768] lowmem_reserve[]: 0 0 0 0 0 [ 558.079648][T19768] Node 1 Normal free:3886132kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16864kB local_pcp:5600kB free_cma:0kB [ 558.111974][T19768] lowmem_reserve[]: 0 0 0 0 0 [ 558.120336][T19768] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 558.134653][T19768] Node 0 DMA32: 976*4kB (UME) 368*8kB (UM) 149*16kB (M) 188*32kB (UME) 33*64kB (UM) 11*128kB (UME) 102*256kB (UM) 152*512kB (UME) 64*1024kB (UME) 26*2048kB (UME) 260*4096kB (UM) = 1306448kB [ 558.154326][T19768] Node 0 Normal: 0*4kB 1*8kB (M) 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 558.167111][T19768] Node 1 Normal: 175*4kB (UE) 49*8kB (UME) 39*16kB (UME) 78*32kB (UME) 21*64kB (UME) 5*128kB (UME) 4*256kB (UM) 2*512kB (M) 3*1024kB (UME) 2*2048kB (UE) 945*4096kB (M) = 3886132kB [ 558.191112][T19768] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 558.201321][T19768] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 558.211449][T19768] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 558.221126][T19768] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 558.243352][T19768] 44641 total pagecache pages [ 558.248189][T19768] 0 pages in swap cache [ 558.253409][T19768] Free swap = 124996kB [ 558.257604][T19768] Total swap = 124996kB [ 558.261784][T19768] 2097051 pages RAM [ 558.303112][T19768] 0 pages HighMem/MovableOnly [ 558.307866][T19768] 425671 pages reserved [ 558.312091][T19768] 0 pages cma reserved [ 558.329536][T19783] "syz.3.3808" (19783) uses obsolete ecb(arc4) skcipher [ 558.415887][T19797] netlink: 'syz.0.3812': attribute type 1 has an invalid length. [ 558.786259][T19823] netlink: 'syz.4.3820': attribute type 1 has an invalid length. [ 558.866070][T19829] siw: device registration error -23 [ 559.158484][T19841] netlink: 'syz.3.3825': attribute type 1 has an invalid length. [ 559.249342][T19841] ip6gre1: entered allmulticast mode [ 559.769596][ T7736] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 559.779129][ T7736] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 559.812450][ T7736] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 559.827417][ T7736] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 559.922425][T19869] bridge_slave_0: invalid flags given to default FDB implementation [ 560.176135][T19886] netlink: 'syz.0.3836': attribute type 7 has an invalid length. [ 560.212071][T19886] netlink: 'syz.0.3836': attribute type 8 has an invalid length. [ 560.418702][T19899] bond2: left allmulticast mode [ 561.292539][T19947] netlink: set zone limit has 8 unknown bytes [ 561.509082][T19962] __nla_validate_parse: 10 callbacks suppressed [ 561.509105][T19962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3857'. [ 561.578393][T19962] netlink: 'syz.3.3857': attribute type 10 has an invalid length. [ 561.590129][T19966] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.3859'. [ 561.599089][T19968] pim6reg1: entered promiscuous mode [ 561.605666][T19962] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3857'. [ 561.616887][T19968] pim6reg1: entered allmulticast mode [ 561.667284][T19962] batadv0: entered promiscuous mode [ 561.672689][T19962] batadv0: entered allmulticast mode [ 561.679391][T19962] bridge0: port 3(batadv0) entered blocking state [ 561.686267][T19962] bridge0: port 3(batadv0) entered disabled state [ 561.686732][T19972] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 561.824421][ T55] block nbd0: Possible stuck request ffff888024ef1a40: control (read@0,1024B). Runtime 30 seconds [ 561.836086][ T55] block nbd0: Possible stuck request ffff888024ef1c00: control (read@1024,1024B). Runtime 30 seconds [ 561.848271][ T55] block nbd0: Possible stuck request ffff888024ef1dc0: control (read@2048,1024B). Runtime 30 seconds [ 561.860365][ T55] block nbd0: Possible stuck request ffff888024ef1f80: control (read@3072,1024B). Runtime 30 seconds [ 561.994333][T19984] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3866'. [ 562.034203][T19977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3862'. [ 562.075441][T19984] Bluetooth: MGMT ver 1.23 [ 562.082757][T19984] netlink: 'syz.2.3866': attribute type 10 has an invalid length. [ 562.135201][ T7736] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 562.145649][ T7736] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 562.157549][T19984] team0: Device hsr_slave_0 failed to register rx_handler [ 562.697197][T20018] netlink: 'syz.0.3879': attribute type 1 has an invalid length. [ 562.705890][T20014] syzkaller0: entered promiscuous mode [ 562.705924][T20014] syzkaller0: entered allmulticast mode [ 562.722053][T20018] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3879'. [ 562.764167][T20019] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3878'. [ 565.758786][T20061] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3882'. [ 565.834747][T20061] dvmrp0: entered allmulticast mode [ 565.861366][T20061] dvmrp0: left allmulticast mode [ 565.888008][T20072] netlink: 'syz.1.3883': attribute type 7 has an invalid length. [ 566.258883][T20086] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 566.387676][T20086] netlink: 'syz.4.3887': attribute type 9 has an invalid length. [ 566.406809][T20091] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3889'. [ 566.438026][ T36] tipc: Subscription rejected, illegal request [ 566.537969][T20095] netlink: 'syz.1.3891': attribute type 1 has an invalid length. [ 566.552756][T20095] netlink: 'syz.1.3891': attribute type 10 has an invalid length. [ 566.561293][T20095] netlink: 236 bytes leftover after parsing attributes in process `syz.1.3891'. [ 566.588647][T20097] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3892'. [ 566.628564][T20097] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3892'. [ 566.647308][T20097] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3892'. [ 566.667201][T20095] sock: sock_set_timeout: `syz.1.3891' (pid 20095) tries to set negative timeout [ 566.687358][T20095] netlink: 'syz.1.3891': attribute type 58 has an invalid length. [ 566.713085][T20095] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3891'. [ 566.841699][T20113] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3895'. [ 567.064472][T20120] pim6reg1: entered promiscuous mode [ 567.076971][T20122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3900'. [ 567.096477][T20120] pim6reg1: entered allmulticast mode [ 567.100951][T20127] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3902'. [ 567.110944][T20122] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3900'. [ 567.401117][T20144] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3904'. [ 567.609420][T20155] netlink: 'syz.4.3909': attribute type 1 has an invalid length. [ 567.621983][T20158] nftables ruleset with unbound set [ 567.828268][T20168] netlink: 'syz.2.3913': attribute type 1 has an invalid length. [ 567.910182][T20173] netlink: 'syz.3.3916': attribute type 23 has an invalid length. [ 568.222653][T17909] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 568.234698][T17909] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 568.243178][T17909] CPU: 0 UID: 0 PID: 17909 Comm: kbnepd bnep0 Not tainted syzkaller #0 PREEMPT(full) [ 568.252843][T17909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 568.262917][T17909] RIP: 0010:klist_del+0x49/0x110 [ 568.267876][T17909] Code: f6 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 29 db b2 f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 0b db b2 f6 4d 8b 7e 58 4c 89 f7 e8 5f 74 [ 568.287589][T17909] RSP: 0018:ffffc9001bcbf768 EFLAGS: 00010202 [ 568.293682][T17909] RAX: 000000000000000b RBX: ffff8880595b4460 RCX: ffff888026f55a00 [ 568.301664][T17909] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 568.309647][T17909] RBP: ffffc9001bcbf890 R08: ffff8880277794b3 R09: 1ffff11004eef296 [ 568.317629][T17909] R10: dffffc0000000000 R11: ffffed1004eef297 R12: dffffc0000000000 [ 568.325615][T17909] R13: 1ffff1100b2b688c R14: 0000000000000000 R15: ffff88807c1c0750 [ 568.333602][T17909] FS: 0000000000000000(0000) GS:ffff888125c15000(0000) knlGS:0000000000000000 [ 568.342538][T17909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 568.349335][T17909] CR2: 00007feaa5858000 CR3: 0000000067f6a000 CR4: 00000000003526f0 [ 568.357322][T17909] Call Trace: [ 568.360616][T17909] [ 568.363561][T17909] device_del+0x280/0x8e0 [ 568.367909][T17909] ? _raw_spin_unlock_irq+0x2e/0x50 [ 568.373142][T17909] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 568.379357][T17909] ? __pfx_device_del+0x10/0x10 [ 568.384410][T17909] ? netdev_unregister_kobject+0x344/0x450 [ 568.390238][T17909] unregister_netdevice_many_notify+0x1a6b/0x1ff0 [ 568.396677][T17909] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 568.403461][T17909] ? rtnl_net_dev_lock+0x257/0x2f0 [ 568.408600][T17909] unregister_netdevice_queue+0x33c/0x380 [ 568.414338][T17909] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 568.420614][T17909] ? rtnl_net_dev_lock+0x36/0x2f0 [ 568.425649][T17909] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 568.430839][T17909] unregister_netdev+0x1f/0x60 [ 568.435966][T17909] bnep_session+0x294d/0x2b40 [ 568.440660][T17909] ? rcu_is_watching+0x15/0xb0 [ 568.445439][T17909] ? trace_sched_exit_tp+0x36/0x110 [ 568.450657][T17909] ? __lock_acquire+0xab9/0xd20 [ 568.455621][T17909] ? __pfx_bnep_session+0x10/0x10 [ 568.460656][T17909] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 568.466565][T17909] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 568.472913][T17909] ? __pfx_woken_wake_function+0x10/0x10 [ 568.478594][T17909] ? __kthread_parkme+0x7b/0x200 [ 568.483552][T17909] ? __kthread_parkme+0x1a1/0x200 [ 568.488606][T17909] kthread+0x70e/0x8a0 [ 568.492693][T17909] ? __pfx_bnep_session+0x10/0x10 [ 568.497732][T17909] ? __pfx_kthread+0x10/0x10 [ 568.502334][T17909] ? _raw_spin_unlock_irq+0x23/0x50 [ 568.507558][T17909] ? lockdep_hardirqs_on+0x9c/0x150 [ 568.512764][T17909] ? __pfx_kthread+0x10/0x10 [ 568.517367][T17909] ret_from_fork+0x436/0x7d0 [ 568.521971][T17909] ? __pfx_ret_from_fork+0x10/0x10 [ 568.527107][T17909] ? __switch_to_asm+0x39/0x70 [ 568.531884][T17909] ? __switch_to_asm+0x33/0x70 [ 568.536665][T17909] ? __pfx_kthread+0x10/0x10 [ 568.541271][T17909] ret_from_fork_asm+0x1a/0x30 [ 568.546051][T17909] [ 568.549086][T17909] Modules linked in: [ 568.553755][ T1303] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 568.554708][T17909] ---[ end trace 0000000000000000 ]--- [ 568.572381][T17909] RIP: 0010:klist_del+0x49/0x110 [ 568.581396][T17909] Code: f6 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 29 db b2 f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 0b db b2 f6 4d 8b 7e 58 4c 89 f7 e8 5f 74 [ 568.601992][T17909] RSP: 0018:ffffc9001bcbf768 EFLAGS: 00010202 [ 568.608865][T17909] RAX: 000000000000000b RBX: ffff8880595b4460 RCX: ffff888026f55a00 [ 568.617752][T17909] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 568.626717][T17909] RBP: ffffc9001bcbf890 R08: ffff8880277794b3 R09: 1ffff11004eef296 [ 568.635574][T17909] R10: dffffc0000000000 R11: ffffed1004eef297 R12: dffffc0000000000 [ 568.644234][T17909] R13: 1ffff1100b2b688c R14: 0000000000000000 R15: ffff88807c1c0750 [ 568.652348][T17909] FS: 0000000000000000(0000) GS:ffff888125c15000(0000) knlGS:0000000000000000 [ 568.662119][T17909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 568.669502][T17909] CR2: 00007feaa5858000 CR3: 0000000054908000 CR4: 00000000003526f0 [ 568.678370][T17909] Kernel panic - not syncing: Fatal exception [ 568.687812][T17909] Kernel Offset: disabled [ 568.692153][T17909] Rebooting in 86400 seconds..