last executing test programs: 16.888044667s ago: executing program 1 (id=1134): r0 = socket$netlink(0x10, 0x3, 0x15) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) (rerun: 32) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000029000000180001801400020073797a5f74756e000000000000000000"], 0x2c}}, 0x0) (async) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="594f5414135535703c108af4880a97cc93ba06ad9245e8dcc664ee18ec68bb57", 0x20, 0x810, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000100)='cpuset.cpu_exclusive\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000040)=0x2, 0x12) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000002c0), r0) sendmsg$WG_CMD_GET_DEVICE(r6, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r7, 0x2, 0x70bd25, 0x25dfdbff, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x41, &(0x7f0000000300)=0x16, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r8, &(0x7f0000000180)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @dev}, 0x14) (async) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) (async) sendmsg$netlink(r8, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141414e0000003808a8972bd0b72e41082b1a3d2061fd7fdfe4b88942a31f48597749c2d79c6fc26f7fbda34fb8825f80200e3c0aba61f6304000000ffffca88facae8d966310a2fd74133bb"], 0xdd12}], 0x1}, 0x0) (async) sendto$unix(r8, &(0x7f0000000140)="2c50cf2554691b3ad1ae3eb4dbe9a080583199a1", 0x14, 0x40044, &(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000600)=ANY=[@ANYBLOB="80010000", @ANYRESHEX=r1, @ANYBLOB="3501000000000000000001000000140002007767320000000000000000000000000058010880540100802400020065e82368edb690a0289eadc2f8aebbdb8094f0718efa73d1fdbe67dafa5c5c2b2401098094000080060001000200000008000200ac1414aa0500030002000000060001000a0000001400020000000000000000000000ffffac14142f0500030000000000060001000200000008000200ffffffff05000300010000000600010002000000080002007f0000010500030000000000060001000a00000014000200fe8000000000000000000000000000aa05000300000000000400008088000080060001000a00000014000200fe88000000000000000000000000010105000300010000000600010002000000080002007f00000105000300020000cd4b0c40000a00000014000200fc0000000000000000000000000000010500030001000000060001000a00000014000200ff01000000000000000000000000000105000300030000000800030005000000bbfdbd5230d8d9f3401f04978d652c82b0ed980c727dea336fb0859327f76a40c8"], 0x180}}, 0x4008000) (async, rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r0) (async, rerun: 32) syz_genetlink_get_family_id$mptcp(&(0x7f0000000940), r0) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)=@sco={0x1f, @none}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000200)}, {&(0x7f00000007c0)=""/172, 0xac}], 0x2, &(0x7f0000000880)=""/89, 0x59}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) 16.637437325s ago: executing program 1 (id=1138): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES8=r0], 0x1c}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)=@in={0x2, 0x3, @private=0xa010001}, 0x10, 0x0}, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f00000001c0)=0x8) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x84, 0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$SIOCAX25ADDUID(r3, 0x89e1, &(0x7f0000000240)={0x3, @bcast, 0xee00}) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={0x3, @bcast}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000001c0), 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) getsockopt$inet_int(r4, 0x0, 0x34, 0x0, &(0x7f00000006c0)) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000380)='cubic\x00', 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r6, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="cf040000000000f100001300000008000300", @ANYRES32=r10, @ANYBLOB="0400130006001200000000000600b500850100000a00060008021100000100003c008100050001"], 0x78}}, 0x0) openat$cgroup_ro(r6, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) 16.62957864s ago: executing program 2 (id=1139): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xfb, 0x0, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'pim6reg1\x00', 0x800}) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0x0, 0x16, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000004c0)) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000040), 0x12) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x4, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x1, 0x1, 0xfffffffc, 0x11}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x200000000000027b, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000080), &(0x7f0000000200)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='ext4_alloc_da_blocks\x00'}, 0x10) socketpair(0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.events\x00', 0x26e1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000400)='track_foreign_dirty\x00', r3}, 0x10) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r1, 0x40189429, &(0x7f0000000280)={0x1, 0x1, 0x1}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x5, 0x4, 0x8, 0xa}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c250000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='scsi_dispatch_cmd_start\x00', r5}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r6, &(0x7f0000000200), 0x43400) 16.421530136s ago: executing program 2 (id=1140): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)={0xb8, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x72, 0xe, {{{}, {}, @device_b, @device_b}, 0x0, @default, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @val={0x2a, 0x1}, @void, @val={0x2d, 0x1a}, @val={0x72, 0x6}, @val={0x71, 0x7}, @val={0x76, 0x6}}}, @NL80211_ATTR_FTM_RESPONDER={0x10, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x5, 0x3, '\n'}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x4a}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0xb8}}, 0x0) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x7c, r1, 0x4ee7a8102f4f5f, 0x70bd2d, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x7}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfff}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_MAC={0xa, 0x6, @random="e9d5861d9527"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="776037f89554"}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x7c}, 0x1, 0x0, 0x0, 0x5}, 0x850) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8e, 0x35}, [@call]}, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd0c}, 0x23) 16.213751036s ago: executing program 1 (id=1142): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x4, 0x4}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x50}, {0x28, 0x0, 0x0, 0xfffff034}, {0x6}]}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) 16.181197109s ago: executing program 2 (id=1144): bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x48) socket$can_j1939(0x1d, 0x2, 0x7) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$binfmt_misc(r3, &(0x7f0000000200)={'syz0', "39cc1ca080244e32923b669dd1e12a37c0e8c6b708"}, 0x19) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100)) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400000000019b573d3633f6098400"/28], 0x14}, 0xa}, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x54) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r8, 0x84, 0x79, &(0x7f00000000c0)={r10}, 0x8) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 16.086915432s ago: executing program 1 (id=1146): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000005000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000000009500000000000000b702000000000000739af8ff00000000b50a0200000000007a0af8ff00000000bf8900000000000007080000fffdffffbfa400000000000007040000f0ffffffc70200000800000018220000", @ANYRES32, @ANYBLOB="0000000000000000b6090000080000004608f0ff76000000180100002020752500000000002020207b94f8ff00000000bfa100000000000007010000f1ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000480)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f0000000200)='syzkaller\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r1, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x12, 0x5, &(0x7f0000000040)=@framed={{0xc6, 0xa, 0x0, 0x0, 0x0, 0x6b, 0x11, 0x8}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) ioctl$TUNSETLINK(r0, 0x400454d0, 0x325) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r2, 0x541b, &(0x7f0000000000)={0x0, @default, @bpq0, 0x0, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x0, 0x0, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x80}], 0x2c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e33, 0x0, @private0}, 0x1c) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r4, &(0x7f00000009c0)={0x0, 0x9, &(0x7f0000000180)={&(0x7f0000000100)={0x28, r5, 0x1, 0x0, 0x0, {0x4}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) 15.91134087s ago: executing program 2 (id=1147): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, &(0x7f0000000080)=""/220, 0x0, 0xdc, 0x1}, 0x20) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_rxfh_indir={0xb}}) 15.677291921s ago: executing program 1 (id=1149): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x1}, 0x48) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000580)="db56b84884ffc02c06bd0f01587a681de55a4df7714790716dddfa75831670014c811bd064f615db698adab368dafbf134b3d26a38503c3fe8a7c5ece07759b81233530ed432985e4feebb5d4ca49dcb8c490c015acacef99f7da736180800000000000000ba12b327f6b79ea0d90605040d84453eff84443a09ab5eeba1586f85c1e383f8095573726b1bf117d96c91d1349f4951ead7fd07838ce689e171c4bda933d8fc5c35ce2fcbc1c5bae12537482f023984c435e056b2e8a6613a841360d40172a17e494ae06d5af1305ffa1eb9cbcedd90b7de636015883d0d3473c4bdfd1f", 0xe3}, {0x0}, {&(0x7f00000004c0)}, {&(0x7f00000002c0)="2b4f2c23cd72e5f8c27c5125a38cc74027abf1994ab65ba7ca4e64b9ab8b357454e5abb6d754f1318dd05531dce7560e6e7d95526c4358848e67345b32b86de0ff15be80ddf3dab5b55443991f2b4d7276d4d6334a4385a70581c45a6926fc7874e38018387a2d6195df3281ba32a96811d4e9e40b1cf5b927", 0x79}], 0x5, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xb, 0x7, 0x8, 0x8, 0x5}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYRESDEC=r1, @ANYRES32=r2, @ANYRESHEX], &(0x7f0000000040)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x4e, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000001c0)='kfree\x00', r3}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001200)={{r2, 0xffffffffffffffff}, &(0x7f0000001180)=0x2, &(0x7f00000011c0)}, 0x20) socketpair$unix(0x1, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r4}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) r5 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r5, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = socket$qrtr(0x2a, 0x2, 0x0) r8 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r7, &(0x7f0000001080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) connect$qrtr(r8, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) ioctl$sock_qrtr_SIOCGIFADDR(r7, 0x890c, 0x0) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000080)='~', 0x1}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000700), &(0x7f0000000740)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x22d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) connect$inet(r5, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x8000, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x8000) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a0b0400000000000000000200000034000480100001800c0001006e6f747261636b0020000180070001007274000014000280080001400000000f08000240000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x88}}, 0x0) 15.625225317s ago: executing program 2 (id=1152): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES8=r0], 0x1c}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)=@in={0x2, 0x3, @private=0xa010001}, 0x10, 0x0}, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f00000001c0)=0x8) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x84, 0x0, &(0x7f0000000140)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$SIOCAX25ADDUID(r3, 0x89e1, &(0x7f0000000240)={0x3, @bcast, 0xee00}) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={0x3, @bcast}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000001c0), 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) getsockopt$inet_int(r4, 0x0, 0x34, 0x0, &(0x7f00000006c0)) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000380)='cubic\x00', 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r6, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="cf040000000000f100001300000008000300", @ANYRES32=r10, @ANYBLOB="0400130006001200000000000600b500850100000a00060008021100000100003c008100050001"], 0x78}}, 0x0) openat$cgroup_ro(r6, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) 15.49124436s ago: executing program 1 (id=1153): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000140)={0x0, 0x1c, '\x00', [@enc_lim, @generic={0x0, 0xce, "37c560fdc11b0b97fa59fc6fb33a849ed3d68b58485331877f0c31c3e63e05231de04d9405aa82d81f33dc026445f0f1f62921d8d0c2be99cd0be7599c2bc4a81dd7b2eefc9f318abce9716020193580a7951a42fecba2fcf2ceb57bf357d3dde247947c23171ff476ac8679dccc7755c6b783f00c27088fd3b9cc4d1635acfa701734e5d29a9fcaa91aac839ef02bcf689984651203337b5d572b75b9e7e8e4c9de6e63e257129db56ea9c894d00e962d6cac6f61f5768e27380776c3020aecb084eeb4327fba183ac0aa5dc83e"}, @calipso={0x7, 0x10, {0x0, 0x2, 0x0, 0x0, [0x0]}}]}, 0xf0) listen(r0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000c00)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "2a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x5, 0xc2}}}}}}}, 0x0) 15.270101152s ago: executing program 2 (id=1157): socket$kcm(0x29, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) (async) socketpair$nbd(0x1, 0x1, 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000003700)={0x77359400}) (async) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="0200000000008000740012000800010076746936"], 0xa0}}, 0x0) (async) r2 = socket(0x10, 0x3, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.bfq.io_queued\x00', 0x26e1, 0x0) close(r3) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r3, 0x18000000000002a0, 0xd04, 0x0, &(0x7f0000001240)="b9ff03076804268c989e", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmmsg(r2, &(0x7f0000000000), 0x400000000000235, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4400000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000800001c0012800b000100697036746e6c0100000000000000010018010490b0f882f0e0aa240b2868bf68059848f787a16c21", @ANYRES32], 0x44}}, 0x0) 5.211306163s ago: executing program 0 (id=1238): r0 = socket$inet(0x2, 0x6, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x3, 0x2, @TCA_HFSC_USC={0x10}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x4}, {0x4}}]}, @TCA_RATE={0x6}]}, 0x70}}, 0x0) 4.93973763s ago: executing program 0 (id=1240): r0 = socket$phonet(0x23, 0x2, 0x1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)={0x39, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x0, 0x0, 0x0, 0x500]}}]}]}]}, 0x44}}, 0x0) 4.58579833s ago: executing program 0 (id=1243): r0 = socket(0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @empty}, 0x10) socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @broadcast}, 0x10) unshare(0x0) socket$inet6_sctp(0xa, 0x0, 0x84) shutdown(0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x14, &(0x7f0000000b80)=ANY=[@ANYBLOB='-\x00'/20, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b0000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xe, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10, 0xffffffffffffffff, 0x0) getsockopt$llc_int(0xffffffffffffffff, 0x10c, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000300)=[{0x6, 0x0, 0x0, 0x7654}]}, 0x10) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r1, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) recvmsg(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001640)=""/4104, 0x1004}, {&(0x7f00000001c0)=""/57, 0x39}, {&(0x7f0000000340)=""/210, 0xffffffffffffff3f}], 0x3}, 0x700) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r5, 0x8983, &(0x7f0000000000)={0x3, 'syz_tun\x00', {0x4}, 0x4}) r6 = socket$rds(0x15, 0x5, 0x0) connect$rds(r6, &(0x7f0000000040)={0xa}, 0x10) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000440)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01e60000000000000000170000000c00068008000600dfffffff", @ANYRES32=r0, @ANYBLOB="4442c6bfd7cd853017ce50ed67a293a8d6f2b5e0937deff1377d33ec98ff6d02aaf31c2f"], 0x20}}, 0x1081) 4.584629454s ago: executing program 4 (id=1244): setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x0, 0x0, 0x0, 0xfffff034}]}, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0xfefc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r0, 0x0) (async) r1 = socket(0x15, 0x5, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x2710}, 0x10) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r2, 0x0, 0x0) (async) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='contention_end\x00', r4}, 0x10) (async, rerun: 64) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000180)={'team0\x00', 0x44}) (async, rerun: 64) recvmsg(r1, &(0x7f0000003780)={0x0, 0x0, 0x0}, 0x0) 3.641750296s ago: executing program 0 (id=1247): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="1e030600bfff980128876340860803702c1f"], 0xffdd) 2.6346219s ago: executing program 4 (id=1248): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x0, 0x0) getsockname$packet(r1, 0x0, 0x0) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(0xffffffffffffffff, 0x80286722, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$SIOCAX25DELFWD(r1, 0x89eb, &(0x7f0000000040)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default}) 2.550265275s ago: executing program 4 (id=1250): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x400}, 0x8) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x27, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000020000000000000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018470000fcffffff0000000000000000850000001d00000002157ff300800000850000001c00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200000000000085000000860000001800000003000000000000003f000000b7080000000000007b8af8ff00000000b70800003f0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a5000000bf91000002922f23b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000240)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000640)={0x1, 0x5, 0x333, 0x800}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x90) (async, rerun: 64) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x0, 0x2}, 0x48) (async, rerun: 64) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000001008500000001000000181100", @ANYRES32=r2, @ANYBLOB='\x00'], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) sendmsg$802154_raw(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)="e9bed67a875f9754d56a2007b21b77a4a930e0ebf25947b8834fa96f66693cc57c08c85c2eca2e6d29c3c431ac6e5ad1f904fc87c1b089599113ae63b157e7a81c5fe1422a96002f4c696f2051f87a9e55ee41c15fd4225f50f5a09d0c5cf58a6b9ed5172ef2aae1299dc12a9e042546f35b00bf3de64ec63ace660000008a23c8cb4d092c2d2911755d20dd1f1105802750485e195e42a7f4220800c3bacc1041446b83e9a64b853f0061e8430c6fc80e5ad96f1e0781339b947a6de461a5161c6b62889d6d84dd166de6e93abb2a1c4d81", 0xd2}}, 0x0) (async) r3 = socket(0x1d, 0x3, 0x1) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) close(r4) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000600)=0x14) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x0, '\x00', r5}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r6, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)='%-5lx \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000de6ca51021c1ab7bae0c52362f9a0000000000000000000095000000"], &(0x7f00000007c0)='syzkaller\x00'}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000140)={0xffffffffffffffff, r7}, 0xc) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async, rerun: 64) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000001c00), 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004c, '\x00', 0x0, 0x5}, 0x90) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async, rerun: 32) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f0000000340)=[@window, @mss, @window, @timestamp, @sack_perm, @timestamp, @mss, @sack_perm], 0x8) (async, rerun: 32) write$binfmt_elf64(r8, &(0x7f0000000280)=ANY=[], 0x40) unshare(0x0) 2.393181635s ago: executing program 4 (id=1252): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0xfffffffffffffe1a, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) 2.38613976s ago: executing program 3 (id=1253): r0 = socket(0x11, 0x80a, 0x0) sendto$packet(r0, 0x0, 0x2, 0x0, &(0x7f00000004c0)={0x11, 0xc00, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14) 2.307008945s ago: executing program 3 (id=1254): bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x0, 0x0, 0x4, 0x8}, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000002c00)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56561, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_TARGET={0x8}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x1}]}}]}, 0x44}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000600), 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xfee4, 0x44000000, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 2.179381668s ago: executing program 4 (id=1255): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket(0x2, 0x5, 0xc499) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, &(0x7f0000000000)={r3, @in={{0x2, 0x0, @empty}}}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r4 = socket$kcm(0x10, 0x0, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r6, &(0x7f0000000240)=ANY=[@ANYRESDEC, @ANYRESOCT=r5, @ANYRES16=r4, @ANYRES8=0x0], 0x32600) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.throttle.io_serviced_recursive\x00', 0x7a05, 0x1700) write$cgroup_int(r7, &(0x7f0000000200), 0x18000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000006604000008000300", @ANYRES32=r10, @ANYBLOB="0800b70004000000080026009409"], 0x4c}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000980)=ANY=[@ANYBLOB='e\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r13, @ANYBLOB="04008e005000330050000000ffffffffffff0802110000000802110000000000000000000000640000000406000000800000060200002d1a00"/82], 0x70}}, 0x0) write$cgroup_type(r6, &(0x7f0000000000), 0x248800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) 340.210137ms ago: executing program 4 (id=1256): pipe(0x0) (async) r0 = socket(0x10, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x4, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8}, 0x90) (async) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) (async) recvfrom$inet6(r1, &(0x7f0000000000)=""/45, 0x44, 0x0, 0x0, 0xffffffffffffffc3) (async, rerun: 32) socket$inet6(0xa, 0x5, 0x0) (async, rerun: 32) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private2, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) (async) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x7c, r3, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x16}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3b}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffd6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x800) (async) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 331.650894ms ago: executing program 3 (id=1257): r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname(r1, &(0x7f0000000280)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000040)=0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newlink={0x6c, 0x10, 0x581, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r2}, @IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x3}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x1}, @IFLA_BOND_UPDELAY={0x8, 0x4, 0x13}, @IFLA_BOND_AD_USER_PORT_KEY={0x6, 0x19, 0x101}, @IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6, 0x18, 0x1ff}, @IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0x101}]}}}]}, 0x6c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@bridge_newvlan={0x3c, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_RANGE={0x6, 0x2, 0x200c}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x5, 0x6, 0x77}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x4}}}]}, 0x3c}, 0x1, 0x5502000000000000}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) r5 = socket$inet_smc(0x2b, 0x1, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@ipv6_getaddrlabel={0x1c, 0x1e, 0x492dfc465ae32a8d, 0x0, 0x0, {0xa, 0x0, 0x38}}, 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010400000000000000009200000008000300", @ANYRES32=r9], 0x30}}, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='bridge_slave_1\x00', 0x10) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x37, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="00000050adba6640cd3b0016df250a10fdfd000000000000000000390eef4573697faae4f05ca54d2e0cf5310611b392904ba5723bda576f49ea921ceca70d2d94309e86", @ANYRES32=r4, @ANYBLOB="00000a000300000000000100fe88000000000000000000000000000100000100ff010000000000000000000000000001"], 0x30}}, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f00000006c0)={'vcan0\x00', 0x0}) r12 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r12, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r12, &(0x7f0000000040)={&(0x7f0000000080)={0x1d, r11, 0x10000000}, 0x10, &(0x7f0000000240)={&(0x7f0000000180)={0x4, 0x0, 0x8, {0x0, 0xea60}, {}, {}, 0x1, @can={{}, 0xfc, 0x0, 0x4, 0x0, "63bad47c2fbf2948"}}, 0x48}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) 302.770854ms ago: executing program 0 (id=1258): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@delchain={0x270, 0x65, 0x0, 0x0, 0x0, {}, [@TCA_CHAIN={0x8}, @filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth0_to_team\x00'}, @TCA_U32_CLASSID={0x8}, @TCA_U32_HASH={0x8}, @TCA_U32_CLASSID={0x8}, @TCA_U32_MARK={0x10}, @TCA_U32_FLAGS={0x8}]}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @filter_kind_options=@f_route={{0xa}, {0x1d8, 0x2, [@TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_ACT={0x1c0, 0x6, [@m_ife={0x130, 0x0, 0x0, 0x0, {{0x8}, {0x64, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_PARMS={0x1c}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_SKBMARK={0x8}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_PARMS={0x1c}]}, {0xa5, 0x6, "21b2caeba32a6f7c5900697624a17b85a9db3a31b129a4976a84cfb4f5d651fd8aa24a645c8f63c025fcca463a6b79a3d7e6c9a8b89a140805ef63939ac2e37b49004b0dc3b8446aa7038eceef52fe7bdca153fe865c65015a3b208b282c16472e451aa10a8631235c49cae271f5fc8ce5e34d9938e3d5f43ac7a0e31b0acfc73199ca90e81246819f4c740a4fa3247a2af88d6569da09be7179b89f9f024c9f46"}, {0xc}, {0xc}}}, @m_nat={0x58, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0x2d, 0x6, "ef93daeef78df7f9a037a0d7a2f92a1cc341deabba437fc636cbf66a843bc4e0304e79be1f16cfa199"}, {0xc}, {0xc}}}, @m_bpf={0x34, 0x0, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x270}}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x24c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 202.50967ms ago: executing program 3 (id=1259): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0xfff) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) write$bt_hci(r1, &(0x7f0000000000)={0x1, @link_key_reply={{0x40b, 0x16}, {@any, "034e01265ff834577f5bc6d57faa2b95"}}}, 0x1a) syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@sack_perm={0x22, 0x2}]}}}}}}}}, 0x0) 141.805582ms ago: executing program 0 (id=1260): r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r0, 0x80080400) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @remote}, 0x10) getsockopt$inet_int(r1, 0x10d, 0x84, &(0x7f0000000000), &(0x7f0000000080)=0x4) 86.226547ms ago: executing program 3 (id=1261): r0 = socket$inet(0x2, 0x3, 0x5) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x3d3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x2}, 0x48) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x12, 0x79, 0x8, 0x3, 0x0, 0x1}, 0x48) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r1, &(0x7f0000000000), &(0x7f0000000080)=@udp6=r2}, 0x20) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000140)=0xc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000009700)=[{{0x0, 0x0, &(0x7f0000005940)=[{&(0x7f00000016c0)="d269b384da9ebbd762fbb878b25406fcafb35a65c8831bb42a2eceb1085b93ba71051084437cbc6eefdff37b36f52417edba5bb5d6be0f47371d61c9b5a0787524424acfe9c22efd8d6137b0f2f1080d7148875b18b8507e71115d5ec17bb78193c11b52a2b56f30e7f2f90bb083da3bff33b2be5fc3fb418445df7209801df2b3cb15e0ae6582f54a2b62c4201b7eef45d5ef7be84af146301b39f809320bb84a7f0c6cb8b90bb1310cd09565df5cf55cee20ab067593eba9e4b7b3f25347d2e646831f312033c4f9631360a0fa693bc6d1049a6d7677f4ae348007badf162509757e5c056d1e30cc50bf9fc77b42cd5a47606c74610c75dc7bc628f0c0db5bc556a705680931a028526c391015f4d9b110c7fdaa567a1ec96a59982f88e35283d910b86cc870459160d3dfd5fbe6d04b0af970d59d4354f9afc7b56325da1d0d435ea8b5120fb4c4d88d57be15d18374e311092c1c80408130817b1c612e67951c7e6701e6166e0c3271e85841db722b4e746eda9c15329a4244936ee338cea6506cd67e57e0f424a0a0fbc4062a539a03974412cf056b135de19d3f707d1bfe36128efa5491972e51303c27dd0e970584c60d9e4879437430109caf9e5415484d12304c10d303f98ad07c04f4891e5ef845c7716369c16bba28f33ac4eda9a934a074aeaa9a2a25f3976c058fe229fbf98f2450be2ae688ee2cc1ae98ca854a0d346c1e2d2ced98b19f3586e226c22ad4a33b9aacbe31879699bd8d85852914404e03f27aa0ebe45a9146a8b5d594cb2fc3c117f13dd63dc7bdc166493f016d44820f4ee6613c3af37327aa92b24afae6c90f11da2c4bb71c63f2c47532a3ed2868eba7e8f3e33b39a834cf225ede1aef8146eb1c9a419cdbe47944ecfc4d783cd2b8ea970a04118ebe7a8892fa2588020642958d9f1811856a569c3d7b4f95e5d3800740cd92cd4a0ed48f487dee6386922a464ad202a98cb0f2b8de5fa15820d669c20d7860356d3cc1208ad95448fa0b71f447515749d9fcd9fc22e63de973d9f42df358b3ecce7f480eb9b4337e98af88bf9ff0cb465feba09e11472da9086547de5c705cf2588491a00a8e26746bb83be2b119d5d250649289ceb50c08adf4d55ccd71b8959bf63ab7f7c04bfa19dbbc79696e4e1f65624c25bedbde0a4a8bc82e36210a26fd66853ca9169a48ceb0f7715a5b3db7011c63e886ed78a1a1ec3218437a549e23557308b84fe3b4b52513422207bd4d95d2d8bdb375e1b82ba7ee0f5b612ba26fbbba752abd485771ada8562eeb03b4d944229f63b00768e7aabc55a54264f09edd286c6ec0f033a6ee009d87804ec24ec62a35bdb0130ae2ed93115db8df351a75093393518bf0cd8fb105d74013a37900aaa459587fa4b5d189c8d43b76f8ead5c1e02775814081b7ebc3325f6c11ce6bbfb88cd5b36a9126aadd50361f1c769c137eaca84cb270160490579fe48c03f53430f51fd773869b054cb5b5125fa2cd698612ec13054e746638c68fdc73bd8e31ffa5a169809a8d896614949442b6d268db08e8d7d8996fdb87581caaf853be151d062e61a77d3bce249d48f4ee5736a2450f48184d44dd86ded77402eb38e0e3f98de1632402b8188de20dec17dfdb7a8d924841107becbfdf4c329ff360302103b42c2b8cda81fb8eb76a26f72701eeb452aeaaee32f6bc9681f1f9805490a29e9e11ad189c9296e8906abc876b83964d939bca028c29d8b0ab9f54bb1a94baf630e1c9c7c38579480fdc52a262f4893d9e7ee181abf8671768ed4dfc624071fe5c770a661301be2c90c42cb61fa2fa07367a3939fcbb6df4af53e0abcd6854f2de4e016d89d9d81209b8d552c9c416be094967d27ff78f4d9e0dffec5b7cc98b6d50d686df42a25991797caaf2059debb3d91f0230224d2857dfdaf32e57717a223691e03ee14d38f8b40f027de55f1fac2da3cc5fb91d803e721a4553e9bf71fb1c50c6411939544f900a9de17398dab9d9db7dffbf3281fc312d527a2b01386970528c9c441af50156589d5ae56cca1a4e75f93dd1f256eaf42227138be975a2cb4f4cda640f0011d6901dd6c8995aed82c6623eafd4b9f04eb75159434049c27553f6aa7a393412d742c476d409e4b379393b746bdba73413912ce68494ededa6e7c92c684d0d59ccddebda8bace0be4caab154149f46adde877b7d4ad8b8b749841c2690cccaac8f88fa21d69ce843693fcffc3bdfb0521d5c4f5273686f1689ee1ca408c064891406e9c11c5df100ee91573eca06d4b8fd8b4b16b2bd29c06643b129daff9d5f76fc508f41d51d226fe801f64271a5d7dd4113f8b115543f83a129686405d33551d2bd12bc70d25d0e219f3ba752ffe42c03c72c13723e7b235a760b892546169173e324e30709214049ebfb78cb7312ab4fac5c700373f97bf5f3340bf68f9edee2795db6d1f9bdba1894296143e67514c1c8febac1273c50a6c81b563db7c7dd66972dd4d1d3910386cfe26a598566b2cba2f497d8bd11de0514bc70fa93125a0bb92dd538e79b98941abfe9ffcffe534d327c7c294bf26c654743eafd30b16966f2fe13976c54824b1145ff407869014aa28edbcccdc90d3103547684ee8da5bfbf43dcb107eef80b99150b1f2951d611692a331bb9680b54a559fdf79699e4b4aaed11b9f4a3fa9f3f6c96cfaff03f22c9b9e433b46c24dc71dbcf547b5eac2f0ad70e6f1e9da7562021f7b1a3e1353d2d39db47dd22349500e2dd01e37960d6f6cdc9fe25179b258b9858b17c25f084a13a955d2a3fb22187cc48b0c42721aecc91bb8fafa09c4855ad528c3502b92336631d27cc150e8059ad62b593767fb2a33b97957a0118cea6884ed83ae9f430e0c32e0d3a43e38f2213fd605bdcbf4f26876162f20c86d743e6aec6e48734811e44174adbb2eae46f7ecfea11a68e7023fa15d716cdb8cfa3f618a4ed7e69bbc0363f5d59e1a779f6", 0x841}], 0x1}}], 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r3, 0x111, 0x3, 0x0, 0x20001f00) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000000), &(0x7f0000000100)=@udp6=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f00000002c0)={r1, &(0x7f0000000000), &(0x7f00000000c0)=@udp6}, 0x20) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @multicast1}, 0x10) sendmmsg$inet(r0, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@ip_tos_int={{0x14}}], 0x18}}], 0x1, 0x4) 0s ago: executing program 3 (id=1262): socket$nl_generic(0x11, 0x3, 0x10) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x2, 0x2, 0x4}, 0x48) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) (async) syz_emit_ethernet(0x6e, &(0x7f0000000780)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000ed0400383a00fe8000000000000000000000000000bbff02000000000000000000000000000102009078000000006002e7dc0000010000000000040000000000000000000000fe8000000000000000000000000000bb0000000000000000"], 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="480010050010000004eb0000000000000001", @ANYRES32=r3, @ANYBLOB="00000000006b901ad4ab00280037800b000000000000000f0002921e5a13c00feed7a52b2cb224bf5531858e2700869a165b4bf4008b06dc"], 0x48}}, 0x0) (async) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) socket$inet6_tcp(0xa, 0x1, 0x0) close(0xffffffffffffffff) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket(0x2, 0x0, 0x0) (async) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f0000002e40)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)}], 0x1}], 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) (async) openat$ppp(0xffffffffffffff9c, 0x0, 0x22d701, 0x0) (async) r5 = socket$igmp6(0xa, 0x3, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004280), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000042c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r7, &(0x7f00000043c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="210400000000000000001200000008000300", @ANYRES32=r8, @ANYBLOB="0a0006000802110200110000180011800400030004008200f2ff01"], 0x40}}, 0x0) (async) getsockopt$SO_BINDTODEVICE(r0, 0x88, 0x67, 0x0, 0x20000000) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet(0xa, 0x801, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.174' (ED25519) to the list of known hosts. [ 67.177453][ T5085] cgroup: Unknown subsys name 'net' [ 67.312540][ T5085] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.071771][ T5085] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 69.941394][ T5105] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 69.941394][ T5107] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 69.943164][ T5105] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 69.950072][ T5107] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 69.959916][ T5105] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 69.963816][ T5107] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 69.984820][ T5105] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 69.985382][ T5107] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 69.993338][ T5110] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.002057][ T5107] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 70.007381][ T5110] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.014121][ T5107] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 70.022440][ T5110] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.029774][ T5107] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 70.035086][ T5110] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.043403][ T5113] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 70.049500][ T5110] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.055632][ T5107] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 70.062104][ T5110] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 70.068724][ T5113] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 70.084366][ T5107] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 70.089434][ T5105] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 70.094254][ T5113] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 70.099790][ T5105] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 70.113447][ T5105] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 70.119372][ T5113] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 70.122769][ T5105] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 70.136109][ T5105] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 70.140842][ T5113] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.143675][ T5105] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 70.718275][ T5095] chnl_net:caif_netlink_parms(): no params data found [ 70.852542][ T5096] chnl_net:caif_netlink_parms(): no params data found [ 70.957037][ T5097] chnl_net:caif_netlink_parms(): no params data found [ 71.012568][ T5095] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.021804][ T5095] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.033241][ T5095] bridge_slave_0: entered allmulticast mode [ 71.040788][ T5095] bridge_slave_0: entered promiscuous mode [ 71.050599][ T5108] chnl_net:caif_netlink_parms(): no params data found [ 71.088050][ T5095] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.095316][ T5095] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.102484][ T5095] bridge_slave_1: entered allmulticast mode [ 71.110188][ T5095] bridge_slave_1: entered promiscuous mode [ 71.168958][ T5095] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.226522][ T5094] chnl_net:caif_netlink_parms(): no params data found [ 71.247027][ T5095] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.262141][ T5096] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.270031][ T5096] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.279038][ T5096] bridge_slave_0: entered allmulticast mode [ 71.286469][ T5096] bridge_slave_0: entered promiscuous mode [ 71.325669][ T5096] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.333186][ T5096] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.340389][ T5096] bridge_slave_1: entered allmulticast mode [ 71.347909][ T5096] bridge_slave_1: entered promiscuous mode [ 71.421935][ T5095] team0: Port device team_slave_0 added [ 71.455004][ T5097] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.462159][ T5097] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.469970][ T5097] bridge_slave_0: entered allmulticast mode [ 71.477545][ T5097] bridge_slave_0: entered promiscuous mode [ 71.488042][ T5095] team0: Port device team_slave_1 added [ 71.539555][ T5097] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.547204][ T5097] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.554799][ T5097] bridge_slave_1: entered allmulticast mode [ 71.561874][ T5097] bridge_slave_1: entered promiscuous mode [ 71.594278][ T5108] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.601460][ T5108] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.609179][ T5108] bridge_slave_0: entered allmulticast mode [ 71.616732][ T5108] bridge_slave_0: entered promiscuous mode [ 71.629526][ T5096] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.671773][ T5095] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.679042][ T5095] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.705215][ T5095] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.717477][ T5108] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.724986][ T5108] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.732195][ T5108] bridge_slave_1: entered allmulticast mode [ 71.739636][ T5108] bridge_slave_1: entered promiscuous mode [ 71.761307][ T5096] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.801795][ T5095] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.809490][ T5095] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.835620][ T5095] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.851581][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.862802][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.902053][ T5094] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.909851][ T5094] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.917733][ T5094] bridge_slave_0: entered allmulticast mode [ 71.926810][ T5094] bridge_slave_0: entered promiscuous mode [ 71.937902][ T5097] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.962330][ T5108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.986219][ T5094] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.997223][ T5094] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.004699][ T5094] bridge_slave_1: entered allmulticast mode [ 72.011765][ T5094] bridge_slave_1: entered promiscuous mode [ 72.035618][ T5097] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.061329][ T5095] hsr_slave_0: entered promiscuous mode [ 72.068852][ T5095] hsr_slave_1: entered promiscuous mode [ 72.078592][ T5108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.091049][ T5096] team0: Port device team_slave_0 added [ 72.101572][ T5096] team0: Port device team_slave_1 added [ 72.139790][ T5097] team0: Port device team_slave_0 added [ 72.146481][ T5113] Bluetooth: hci3: command tx timeout [ 72.189686][ T5094] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.205794][ T5094] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.217580][ T5097] team0: Port device team_slave_1 added [ 72.224087][ T53] Bluetooth: hci0: command tx timeout [ 72.229886][ T53] Bluetooth: hci4: command tx timeout [ 72.235846][ T5109] Bluetooth: hci2: command tx timeout [ 72.241881][ T5113] Bluetooth: hci1: command tx timeout [ 72.327200][ T5097] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.334227][ T5097] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.360254][ T5097] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.377550][ T5108] team0: Port device team_slave_0 added [ 72.385596][ T5096] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.392578][ T5096] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.419166][ T5096] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.450246][ T5097] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.457471][ T5097] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.483670][ T5097] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.504531][ T5108] team0: Port device team_slave_1 added [ 72.511193][ T5096] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.518472][ T5096] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.544899][ T5096] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.567250][ T5094] team0: Port device team_slave_0 added [ 72.577027][ T5094] team0: Port device team_slave_1 added [ 72.674984][ T5108] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.682074][ T5108] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.712593][ T5108] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.727024][ T5108] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.734074][ T5108] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.760070][ T5108] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.773111][ T5094] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.780083][ T5094] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.806179][ T5094] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.870338][ T5094] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.878121][ T5094] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.905021][ T5094] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.950499][ T5096] hsr_slave_0: entered promiscuous mode [ 72.957939][ T5096] hsr_slave_1: entered promiscuous mode [ 72.965226][ T5096] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.973331][ T5096] Cannot create hsr debugfs directory [ 73.040682][ T5097] hsr_slave_0: entered promiscuous mode [ 73.047661][ T5097] hsr_slave_1: entered promiscuous mode [ 73.054563][ T5097] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.062158][ T5097] Cannot create hsr debugfs directory [ 73.107485][ T5108] hsr_slave_0: entered promiscuous mode [ 73.115816][ T5108] hsr_slave_1: entered promiscuous mode [ 73.122160][ T5108] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.130493][ T5108] Cannot create hsr debugfs directory [ 73.337457][ T5094] hsr_slave_0: entered promiscuous mode [ 73.345555][ T5094] hsr_slave_1: entered promiscuous mode [ 73.351862][ T5094] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.360124][ T5094] Cannot create hsr debugfs directory [ 73.424679][ T5095] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 73.473373][ T5095] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 73.490832][ T5095] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 73.545369][ T5095] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.749187][ T5108] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.762489][ T5108] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.779691][ T5108] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.791482][ T5108] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.851010][ T5097] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 73.871776][ T5097] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 73.882144][ T5097] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 73.904119][ T5097] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.016907][ T5096] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.028066][ T5096] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.039360][ T5096] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.050328][ T5096] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.195614][ T5094] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 74.215537][ T5094] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 74.225182][ T5113] Bluetooth: hci3: command tx timeout [ 74.234574][ T5094] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 74.271106][ T5094] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 74.309207][ T5113] Bluetooth: hci1: command tx timeout [ 74.309247][ T5105] Bluetooth: hci2: command tx timeout [ 74.314935][ T5113] Bluetooth: hci0: command tx timeout [ 74.320357][ T53] Bluetooth: hci4: command tx timeout [ 74.349087][ T5095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.370207][ T5108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.418756][ T5095] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.444165][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.451602][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.488766][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.496104][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.526251][ T5108] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.572068][ T5147] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.579317][ T5147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.620114][ T5147] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.627489][ T5147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.712143][ T5097] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.755619][ T5096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.820784][ T5097] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.851697][ T5096] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.879266][ T5148] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.886561][ T5148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.990420][ T5149] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.997677][ T5149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.030334][ T5149] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.037647][ T5149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.079400][ T5149] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.086617][ T5149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.121312][ T5094] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.197252][ T5095] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.254970][ T5094] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.295874][ T5149] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.303099][ T5149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.336489][ T5108] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.348777][ T5149] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.356010][ T5149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.548813][ T5095] veth0_vlan: entered promiscuous mode [ 75.616039][ T5095] veth1_vlan: entered promiscuous mode [ 75.641882][ T5108] veth0_vlan: entered promiscuous mode [ 75.706866][ T5108] veth1_vlan: entered promiscuous mode [ 75.802102][ T5095] veth0_macvtap: entered promiscuous mode [ 75.841165][ T5095] veth1_macvtap: entered promiscuous mode [ 75.935256][ T5096] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.950548][ T5108] veth0_macvtap: entered promiscuous mode [ 75.976641][ T5095] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.990027][ T5108] veth1_macvtap: entered promiscuous mode [ 76.015183][ T5097] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.027148][ T5095] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.073837][ T5095] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.082981][ T5095] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.091715][ T5095] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.102534][ T5095] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.146879][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.159394][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.171860][ T5108] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.187629][ T5094] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.216882][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.235916][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.255439][ T5108] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.311231][ T5108] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.313748][ T53] Bluetooth: hci3: command tx timeout [ 76.326600][ T5108] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.337378][ T5108] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.346618][ T5108] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.383634][ T53] Bluetooth: hci4: command tx timeout [ 76.383894][ T5113] Bluetooth: hci1: command tx timeout [ 76.389086][ T53] Bluetooth: hci0: command tx timeout [ 76.396138][ T5105] Bluetooth: hci2: command tx timeout [ 76.470923][ T5097] veth0_vlan: entered promiscuous mode [ 76.571256][ T5096] veth0_vlan: entered promiscuous mode [ 76.600638][ T5097] veth1_vlan: entered promiscuous mode [ 76.645312][ T5096] veth1_vlan: entered promiscuous mode [ 76.665555][ T1034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.678302][ T1034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.740945][ T5094] veth0_vlan: entered promiscuous mode [ 76.789195][ T2852] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.794702][ T5094] veth1_vlan: entered promiscuous mode [ 76.804225][ T2852] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.815623][ T2852] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.831984][ T2852] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.841272][ T5097] veth0_macvtap: entered promiscuous mode [ 76.896882][ T5097] veth1_macvtap: entered promiscuous mode [ 76.958636][ T5096] veth0_macvtap: entered promiscuous mode [ 77.017473][ T5096] veth1_macvtap: entered promiscuous mode [ 77.052069][ T5097] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.070704][ T5097] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.081191][ T5097] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.093332][ T5097] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.109889][ T5097] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.139453][ T5094] veth0_macvtap: entered promiscuous mode [ 77.151096][ T5097] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.169692][ T5097] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.180244][ T5097] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.193118][ T5097] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.207091][ T5097] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.219510][ T2820] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.240790][ T5094] veth1_macvtap: entered promiscuous mode [ 77.242984][ T2820] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.269197][ T5097] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.280497][ T5097] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.290855][ T5097] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.301917][ T5097] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.325661][ T5182] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1, syncid = 0, id = 0 [ 77.351216][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.365874][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.376344][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.395917][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.411380][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.422244][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.444318][ T5096] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.485255][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.525485][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.558881][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.578116][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.600697][ T5096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.611336][ T5096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.623766][ T5096] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.632415][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.643726][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.656549][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.667666][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.678069][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.689122][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.699401][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 77.715630][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.728141][ T5094] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.740367][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.758288][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.770086][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.770605][ T5191] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8'. [ 77.783998][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.799440][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.811554][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.824929][ T5094] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.836715][ T5094] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.839066][ T5193] netlink: 'syz.1.8': attribute type 2 has an invalid length. [ 77.849010][ T5094] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.878825][ T5096] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.888172][ T5096] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.897608][ T5096] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.910607][ T5096] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.940503][ T5189] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8'. [ 77.960842][ T5189] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.970039][ T5189] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.979062][ T5189] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.988015][ T5189] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 77.999716][ T5189] vxlan0: entered promiscuous mode [ 78.011091][ T5190] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1'. [ 78.020535][ T5190] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1'. [ 78.031111][ T5192] netlink: 'syz.0.1': attribute type 10 has an invalid length. [ 78.069962][ T5192] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 78.079241][ T5193] warning: `syz.1.8' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 78.098401][ T5094] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.107366][ T5094] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.118144][ T5094] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.135107][ T5094] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.224491][ T5196] netlink: 76 bytes leftover after parsing attributes in process `syz.0.9'. [ 78.360258][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.383796][ T5113] Bluetooth: hci3: command tx timeout [ 78.389282][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.463396][ T5113] Bluetooth: hci1: command tx timeout [ 78.468883][ T5113] Bluetooth: hci0: command tx timeout [ 78.474440][ T5105] Bluetooth: hci2: command tx timeout [ 78.474463][ T53] Bluetooth: hci4: command tx timeout [ 78.576522][ T2820] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.577803][ T5199] netlink: 'syz.0.10': attribute type 1 has an invalid length. [ 78.601826][ T2820] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.706869][ T1034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.739002][ T1034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.755134][ T5205] netlink: 260 bytes leftover after parsing attributes in process `syz.0.12'. [ 78.788367][ T2820] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.844677][ T2820] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.952797][ T2880] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.981856][ T2880] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.009955][ T2820] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.046201][ T2820] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.362087][ T5220] Zero length message leads to an empty skb [ 79.463633][ T5229] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 79.731976][ T5237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18'. [ 79.798017][ T5237] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 79.807458][ T5237] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 79.816395][ T5237] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 79.825439][ T5237] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 79.842221][ T5237] vxlan0: entered promiscuous mode [ 79.877821][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 79.940165][ T5237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18'. [ 79.958411][ T5237] netlink: 'syz.0.18': attribute type 2 has an invalid length. [ 79.971251][ T5236] netlink: 'syz.4.19': attribute type 1 has an invalid length. [ 80.024894][ T5246] netlink: 28 bytes leftover after parsing attributes in process `syz.1.21'. [ 80.136371][ T5249] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 80.184337][ T5249] netlink: 52 bytes leftover after parsing attributes in process `syz.2.24'. [ 81.130064][ T5282] netlink: 'syz.0.34': attribute type 1 has an invalid length. [ 81.939619][ T5300] dvmrp0: entered allmulticast mode [ 82.112894][ T5307] syz.3.41 uses obsolete (PF_INET,SOCK_PACKET) [ 82.119549][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 82.211082][ T5312] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.220128][ T5312] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.229955][ T5312] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.240622][ T5312] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 82.281974][ T5312] vxlan0: entered promiscuous mode [ 82.509554][ T5312] netlink: 'syz.2.40': attribute type 2 has an invalid length. [ 82.674517][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 83.019257][ T5339] __nla_validate_parse: 6 callbacks suppressed [ 83.019281][ T5339] netlink: 12 bytes leftover after parsing attributes in process `syz.0.48'. [ 83.107888][ T5340] netlink: 44 bytes leftover after parsing attributes in process `syz.0.48'. [ 83.245731][ T5348] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 83.370865][ T5353] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 83.576732][ T5356] netlink: 'syz.1.53': attribute type 3 has an invalid length. [ 83.602599][ T5356] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.53'. [ 83.995907][ T5368] netlink: 12 bytes leftover after parsing attributes in process `syz.4.54'. [ 84.468794][ T5382] netlink: 'syz.1.62': attribute type 3 has an invalid length. [ 84.656178][ T5389] Bluetooth: MGMT ver 1.22 [ 85.352377][ T5423] netlink: 12 bytes leftover after parsing attributes in process `syz.2.71'. [ 85.435685][ T5424] netlink: 12 bytes leftover after parsing attributes in process `syz.1.72'. [ 85.703959][ T5429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.75'. [ 85.959913][ T5439] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 86.008567][ T5440] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.78'. [ 86.547713][ T5456] netlink: 596 bytes leftover after parsing attributes in process `syz.0.81'. [ 86.609796][ T5458] netlink: 12 bytes leftover after parsing attributes in process `syz.0.84'. [ 86.830680][ T29] audit: type=1107 audit(1719561735.887:2): pid=5459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='<|KΟόΡ,χνΒ-ψΠ"5³)ΫυK©XΞιͺ΅$βύ‚χ‚}« RΎ˜…Ή,Ό`’ [ 86.830680][ T29] =υ·€˜°J,PV"’«χ%φψa›]؎Z”ξTe€‘u­Mϋz˜;ΡXΓ«d­ς²bΪΤrαP€z›ύa±ω׌πg$W©pk)Ο' [ 87.013822][ T5472] netlink: 'syz.1.87': attribute type 2 has an invalid length. [ 87.594993][ T5489] vlan2: entered allmulticast mode [ 87.600657][ T5489] bridge0: port 3(vlan2) entered blocking state [ 87.607987][ T5489] bridge0: port 3(vlan2) entered disabled state [ 87.760840][ T5491] nbd: must specify an index to disconnect [ 87.797605][ T5493] geneve2: entered promiscuous mode [ 87.815577][ T5493] geneve2: entered allmulticast mode [ 87.930485][ T5496] tipc: Started in network mode [ 87.946245][ T5496] tipc: Node identity 4, cluster identity 4711 [ 87.963175][ T5496] tipc: Node number set to 4 [ 88.291594][ T5509] syzkaller0: entered promiscuous mode [ 88.311449][ T5509] syzkaller0: entered allmulticast mode [ 88.328383][ T5521] __nla_validate_parse: 4 callbacks suppressed [ 88.328405][ T5521] netlink: 4 bytes leftover after parsing attributes in process `syz.3.102'. [ 88.344136][ T5523] batadv_slave_1: entered promiscuous mode [ 88.427577][ T5524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.100'. [ 89.727170][ T5533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.104'. [ 90.063000][ T5522] batadv_slave_1: left promiscuous mode [ 90.520520][ T5561] netlink: 4 bytes leftover after parsing attributes in process `syz.2.114'. [ 90.710296][ T5568] netlink: 24 bytes leftover after parsing attributes in process `syz.3.116'. [ 90.835426][ T5104] block nbd64: NBD_DISCONNECT [ 90.963892][ T5579] netlink: 4 bytes leftover after parsing attributes in process `syz.4.118'. [ 91.279132][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 91.517842][ T5602] netlink: 12 bytes leftover after parsing attributes in process `syz.2.122'. [ 91.563150][ T5596] netlink: 4 bytes leftover after parsing attributes in process `syz.4.125'. [ 91.879209][ T5616] netlink: 8 bytes leftover after parsing attributes in process `syz.4.130'. [ 91.914556][ T5615] netlink: 12 bytes leftover after parsing attributes in process `syz.0.127'. [ 92.327517][ T784] cfg80211: failed to load regulatory.db [ 93.482633][ T5659] netlink: 'syz.1.143': attribute type 11 has an invalid length. [ 93.579248][ T5653] __nla_validate_parse: 2 callbacks suppressed [ 93.579271][ T5653] netlink: 12 bytes leftover after parsing attributes in process `syz.3.140'. [ 93.918391][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 94.002461][ T5672] netlink: 'syz.0.148': attribute type 1 has an invalid length. [ 94.018554][ T5674] openvswitch: netlink: Message has 4 unknown bytes. [ 94.172216][ T5672] bond1 (unregistering): Released all slaves [ 94.518436][ T5691] netlink: 'syz.2.153': attribute type 1 has an invalid length. [ 94.537388][ T5691] netlink: 112848 bytes leftover after parsing attributes in process `syz.2.153'. [ 94.560479][ T5691] netlink: 'syz.2.153': attribute type 1 has an invalid length. [ 94.572027][ T5691] bond0: option miimon: invalid value (18446744073072082944) [ 94.584937][ T5691] bond0: option miimon: allowed values 0 - 2147483647 [ 95.331781][ T5725] netlink: 'syz.0.164': attribute type 10 has an invalid length. [ 95.407123][ T5725] batman_adv: batadv0: Adding interface: team0 [ 95.450980][ T5725] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.493089][ T5725] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 95.759637][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 95.896554][ T5747] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 96.643161][ T5762] netlink: 12 bytes leftover after parsing attributes in process `syz.1.174'. [ 97.022429][ T5777] netlink: 16 bytes leftover after parsing attributes in process `syz.0.179'. [ 97.047814][ T5777] ip6tnl1: entered promiscuous mode [ 97.077240][ T5777] ip6tnl1: entered allmulticast mode [ 97.359100][ T5784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.180'. [ 97.692451][ T5797] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 97.973539][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.001865][ T5109] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.013117][ T5109] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.021595][ T5109] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.040696][ T5109] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 98.048765][ T5109] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.139298][ T5807] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 98.512955][ T5821] netlink: 'syz.4.189': attribute type 10 has an invalid length. [ 98.769234][ T5833] netlink: 'syz.4.193': attribute type 322 has an invalid length. [ 98.778653][ T5832] IPv6: addrconf: prefix option has invalid lifetime [ 98.892033][ T5836] netlink: 12 bytes leftover after parsing attributes in process `syz.0.194'. [ 99.023473][ T2852] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 99.035241][ T2852] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.055204][ T5842] netlink: 'syz.2.196': attribute type 1 has an invalid length. [ 99.064099][ T5843] netlink: 8 bytes leftover after parsing attributes in process `syz.0.194'. [ 99.251054][ T2852] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 99.276934][ T29] audit: type=1804 audit(1719561748.327:3): pid=5852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.198" name="/root/syzkaller.5OVt0p/37/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 [ 99.311813][ T2852] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.327708][ T29] audit: type=1804 audit(1719561748.377:4): pid=5852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.198" name="/root/syzkaller.5OVt0p/37/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 [ 99.354424][ T5844] bond1 (unregistering): Released all slaves [ 99.379897][ T29] audit: type=1804 audit(1719561748.437:5): pid=5856 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.198" name="/root/syzkaller.5OVt0p/37/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 [ 99.477882][ T5852] netlink: 16 bytes leftover after parsing attributes in process `syz.4.198'. [ 99.493474][ T5852] netlink: 15 bytes leftover after parsing attributes in process `syz.4.198'. [ 99.572718][ T29] audit: type=1804 audit(1719561748.617:6): pid=5852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.198" name="/root/syzkaller.5OVt0p/37/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 [ 99.626682][ T2852] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 99.638563][ T29] audit: type=1804 audit(1719561748.627:7): pid=5852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.198" name="/root/syzkaller.5OVt0p/37/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 [ 99.668232][ T2852] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.895527][ T5866] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 100.006746][ T2852] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 100.070015][ T2852] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.145782][ T53] Bluetooth: hci0: command tx timeout [ 100.272765][ T5883] netlink: 'syz.2.205': attribute type 49 has an invalid length. [ 100.342488][ T5883] netlink: 'syz.2.205': attribute type 3 has an invalid length. [ 100.347202][ T5809] chnl_net:caif_netlink_parms(): no params data found [ 100.357006][ T5883] netlink: 48 bytes leftover after parsing attributes in process `syz.2.205'. [ 100.357084][ T5883] netlink: 'syz.2.205': attribute type 3 has an invalid length. [ 100.357101][ T5883] netlink: 48 bytes leftover after parsing attributes in process `syz.2.205'. [ 100.754978][ T2852] bridge_slave_1: left allmulticast mode [ 100.820102][ T2852] bridge_slave_1: left promiscuous mode [ 100.847220][ T2852] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.906183][ T2852] bridge_slave_0: left allmulticast mode [ 100.928501][ T2852] bridge_slave_0: left promiscuous mode [ 100.939087][ T2852] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.156821][ T2852] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 102.171571][ T2852] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.188884][ T2852] bond0 (unregistering): Released all slaves [ 102.225168][ T53] Bluetooth: hci0: command tx timeout [ 102.353373][ T5809] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.372924][ T5809] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.380834][ T5809] bridge_slave_0: entered allmulticast mode [ 102.428627][ T5809] bridge_slave_0: entered promiscuous mode [ 102.440663][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 102.467856][ T5809] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.502992][ T5809] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.518903][ T2852] IPVS: stopping backup sync thread 5182 ... [ 102.538316][ T5809] bridge_slave_1: entered allmulticast mode [ 102.571545][ T5809] bridge_slave_1: entered promiscuous mode [ 102.593333][ T5990] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 102.931979][ T5999] bridge1: entered promiscuous mode [ 102.948352][ T5999] bridge1: entered allmulticast mode [ 102.999756][ T5809] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.260141][ T5809] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.419589][ T29] audit: type=1804 audit(1719561752.477:8): pid=6016 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.223" name="/root/syzkaller.5OVt0p/42/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 [ 103.475274][ T2852] hsr_slave_0: left promiscuous mode [ 103.532403][ T2852] hsr_slave_1: left promiscuous mode [ 103.586917][ T2852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.628626][ T2852] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.697521][ T2852] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.726112][ T2852] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.865525][ T2852] veth1_macvtap: left promiscuous mode [ 103.894105][ T2852] veth0_macvtap: left promiscuous mode [ 104.222207][ T6045] netlink: 'syz.0.228': attribute type 2 has an invalid length. [ 104.236158][ T6045] netlink: 24 bytes leftover after parsing attributes in process `syz.0.228'. [ 104.304679][ T53] Bluetooth: hci0: command tx timeout [ 104.534608][ T2852] team0 (unregistering): Port device team_slave_1 removed [ 104.573954][ T2852] team0 (unregistering): Port device team_slave_0 removed [ 105.011878][ T6029] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 105.099069][ T6051] netlink: 'syz.0.230': attribute type 1 has an invalid length. [ 105.162471][ T6053] bond3 (unregistering): Released all slaves [ 105.235435][ T5809] team0: Port device team_slave_0 added [ 105.245685][ T5809] team0: Port device team_slave_1 added [ 105.592299][ T5809] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.618823][ T5809] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 105.702893][ T5809] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.810417][ T6068] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 105.891193][ T6073] bond0: entered promiscuous mode [ 105.936458][ T6073] bond_slave_0: entered promiscuous mode [ 105.954117][ T6073] bond_slave_1: entered promiscuous mode [ 105.972250][ T6073] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 106.003957][ T5809] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 106.011004][ T5809] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 106.059106][ T5809] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 106.377478][ T5809] hsr_slave_0: entered promiscuous mode [ 106.389198][ T53] Bluetooth: hci0: command tx timeout [ 106.456408][ T5809] hsr_slave_1: entered promiscuous mode [ 106.545085][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 106.581603][ T6103] netlink: 'syz.0.243': attribute type 1 has an invalid length. [ 106.619115][ T29] audit: type=1804 audit(1719561755.677:9): pid=6099 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.241" name="/root/syzkaller.5OVt0p/46/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 106.734571][ T6103] bond3 (unregistering): Released all slaves [ 107.086566][ T6120] netlink: 20 bytes leftover after parsing attributes in process `syz.0.244'. [ 107.527510][ T6134] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 107.786657][ T6143] netlink: 'syz.0.249': attribute type 11 has an invalid length. [ 108.152072][ T5809] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 108.188656][ T5809] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 108.224292][ T6148] veth0_vlan: entered allmulticast mode [ 108.357122][ T5809] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 108.446167][ T5809] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 108.814022][ T6171] netlink: 830 bytes leftover after parsing attributes in process `syz.3.254'. [ 109.044721][ T6181] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 109.135130][ T5809] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.217564][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 109.229102][ T5809] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.333806][ T5149] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.341036][ T5149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.487153][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.494459][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.578620][ T6198] netlink: 'syz.4.259': attribute type 11 has an invalid length. [ 109.731109][ T5809] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 109.899816][ T6201] macvlan2: entered promiscuous mode [ 110.470591][ T5809] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.689423][ T5809] veth0_vlan: entered promiscuous mode [ 110.773819][ T5809] veth1_vlan: entered promiscuous mode [ 110.840934][ T6241] netlink: 552 bytes leftover after parsing attributes in process `syz.0.267'. [ 110.970403][ T5809] veth0_macvtap: entered promiscuous mode [ 111.037775][ T5809] veth1_macvtap: entered promiscuous mode [ 111.156836][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.202880][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.226440][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.252758][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.262631][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.307305][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 111.311774][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.334459][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.359625][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.389454][ T5809] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.442356][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.505730][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.530610][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.573236][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.611841][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.669890][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.687593][ T5809] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.702217][ T5809] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.724975][ T5809] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.801458][ T5809] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.837610][ T5809] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.878135][ T5809] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.909048][ T5809] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.203702][ T6267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.273'. [ 112.618625][ T6290] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 112.711825][ T2820] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.741996][ T2820] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.879787][ T5963] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.919967][ T5963] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.950130][ T6301] netlink: 'syz.0.281': attribute type 5 has an invalid length. [ 113.013521][ T6303] netlink: 596 bytes leftover after parsing attributes in process `syz.0.281'. [ 113.189933][ T6310] netlink: 'syz.4.282': attribute type 1 has an invalid length. [ 113.470754][ T6318] bond1 (unregistering): Released all slaves [ 113.842797][ T6316] syz.0.284 (6316) used greatest stack depth: 18872 bytes left [ 114.466753][ T6353] netlink: 12 bytes leftover after parsing attributes in process `syz.0.287'. [ 115.122810][ T6380] netlink: 4 bytes leftover after parsing attributes in process `syz.3.292'. [ 115.483627][ T6392] netlink: 12 bytes leftover after parsing attributes in process `syz.4.293'. [ 115.531300][ T6394] netlink: 80 bytes leftover after parsing attributes in process `syz.3.298'. [ 116.287463][ T6424] netlink: 8 bytes leftover after parsing attributes in process `syz.3.304'. [ 116.529178][ T6437] netlink: 'syz.2.307': attribute type 10 has an invalid length. [ 116.658428][ T6437] batman_adv: batadv0: Adding interface: team0 [ 116.695950][ T6437] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 116.748061][ T6437] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 116.793052][ T6438] netlink: 'syz.2.307': attribute type 10 has an invalid length. [ 116.807239][ T6438] netlink: 2 bytes leftover after parsing attributes in process `syz.2.307'. [ 116.817695][ T6438] team0: entered promiscuous mode [ 116.862196][ T6438] team_slave_0: entered promiscuous mode [ 116.869612][ T6438] team_slave_1: entered promiscuous mode [ 116.884396][ T6438] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.913255][ T6438] batman_adv: batadv0: Interface activated: team0 [ 116.920192][ T6438] batman_adv: batadv0: Interface deactivated: team0 [ 116.949075][ T6438] batman_adv: batadv0: Removing interface: team0 [ 116.987372][ T6438] bridge0: port 3(team0) entered blocking state [ 117.000687][ T6438] bridge0: port 3(team0) entered disabled state [ 117.007426][ T6438] team0: entered allmulticast mode [ 117.012600][ T6438] team_slave_0: entered allmulticast mode [ 117.018950][ T6438] team_slave_1: entered allmulticast mode [ 117.102702][ T6438] bridge0: port 3(team0) entered blocking state [ 117.109464][ T6438] bridge0: port 3(team0) entered forwarding state [ 117.128446][ T6451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.308'. [ 117.237653][ T6451] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 117.399569][ T29] audit: type=1800 audit(1719561766.457:10): pid=6457 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.310" name="memory.events" dev="sda1" ino=1958 res=0 errno=0 [ 117.533555][ T6467] netlink: 'syz.3.314': attribute type 1 has an invalid length. [ 117.561008][ T6467] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.314'. [ 117.576637][ T6467] netlink: 1 bytes leftover after parsing attributes in process `syz.3.314'. [ 117.587602][ T6464] netlink: 256 bytes leftover after parsing attributes in process `syz.1.312'. [ 117.831822][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 118.030742][ T6471] netlink: 12 bytes leftover after parsing attributes in process `syz.2.313'. [ 119.182064][ T6532] Bluetooth: MGMT ver 1.22 [ 119.381216][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 119.560449][ T6520] netlink: 12 bytes leftover after parsing attributes in process `syz.4.334'. [ 120.040294][ T6564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.346'. [ 121.152308][ T6609] netlink: 4 bytes leftover after parsing attributes in process `syz.2.358'. [ 121.391639][ T6614] netlink: 'syz.0.361': attribute type 3 has an invalid length. [ 121.400410][ T6614] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.361'. [ 121.731988][ T6629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.365'. [ 121.758200][ T6629] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.767787][ T6629] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.776706][ T6629] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.785629][ T6629] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.797076][ T6629] vxlan0: entered promiscuous mode [ 122.081996][ T6637] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.091085][ T6637] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.132982][ T6637] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 122.209406][ T6637] netlink: 44 bytes leftover after parsing attributes in process `syz.4.370'. [ 124.933951][ T6669] netlink: 209840 bytes leftover after parsing attributes in process `syz.0.378'. [ 125.224929][ T6684] netlink: 4 bytes leftover after parsing attributes in process `syz.3.380'. [ 125.288223][ T6684] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.297329][ T6684] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.306158][ T6684] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.314988][ T6684] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.367348][ T6684] vxlan0: entered promiscuous mode [ 125.567152][ T6700] netlink: 4 bytes leftover after parsing attributes in process `syz.0.387'. [ 125.747095][ T6700] bridge: RTM_NEWNEIGH with invalid ether address [ 125.780221][ T6708] netlink: 'syz.4.390': attribute type 11 has an invalid length. [ 126.270666][ T6727] netlink: 12 bytes leftover after parsing attributes in process `syz.0.393'. [ 126.360039][ T6728] netlink: 4 bytes leftover after parsing attributes in process `syz.3.396'. [ 126.384310][ T6728] netlink: 'syz.3.396': attribute type 6 has an invalid length. [ 126.868020][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 127.327283][ T6772] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 127.478256][ T6778] netlink: 'syz.3.411': attribute type 25 has an invalid length. [ 127.502020][ T6778] netlink: 'syz.3.411': attribute type 44 has an invalid length. [ 127.564388][ T6780] netlink: 12 bytes leftover after parsing attributes in process `syz.0.412'. [ 127.779920][ T6783] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 127.897952][ T6783] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 128.400620][ T6810] IPVS: set_ctl: invalid protocol: 29 10.1.1.0:20001 [ 128.421448][ T6810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.419'. [ 128.655775][ T6825] netlink: 'syz.0.422': attribute type 1 has an invalid length. [ 128.775257][ T6827] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 128.958108][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 129.286025][ T6853] netlink: 12 bytes leftover after parsing attributes in process `syz.1.427'. [ 129.338541][ T6848] syz.0.430 uses old SIOCAX25GETINFO [ 129.349912][ T6856] netlink: 'syz.3.431': attribute type 3 has an invalid length. [ 129.359150][ T6856] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.431'. [ 129.604467][ T6864] vlan2: entered promiscuous mode [ 129.624537][ T6864] vlan2: entered allmulticast mode [ 129.752563][ T6871] netlink: 'syz.1.436': attribute type 1 has an invalid length. [ 130.177566][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 130.354536][ T6892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.443'. [ 130.663173][ T6898] netlink: 28 bytes leftover after parsing attributes in process `syz.1.445'. [ 130.822083][ T6905] netlink: 'syz.4.447': attribute type 2 has an invalid length. [ 130.844706][ T6905] netlink: 24 bytes leftover after parsing attributes in process `syz.4.447'. [ 131.212919][ T6917] netlink: 'syz.1.451': attribute type 1 has an invalid length. [ 131.380160][ T6928] netlink: zone id is out of range [ 131.388962][ T6919] netlink: 'syz.4.450': attribute type 5 has an invalid length. [ 131.433723][ T6928] netlink: set zone limit has 4 unknown bytes [ 131.547504][ T6936] netlink: 'syz.2.454': attribute type 1 has an invalid length. [ 132.250123][ T6969] netlink: 4 bytes leftover after parsing attributes in process `syz.2.464'. [ 132.304005][ T6969] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 132.328925][ T6970] netlink: 4 bytes leftover after parsing attributes in process `syz.2.464'. [ 132.357930][ T6969] netlink: 'syz.2.464': attribute type 6 has an invalid length. [ 132.647413][ T6984] validate_nla: 1 callbacks suppressed [ 132.647434][ T6984] netlink: 'syz.3.469': attribute type 1 has an invalid length. [ 132.693197][ T6984] netlink: 4 bytes leftover after parsing attributes in process `syz.3.469'. [ 132.839512][ T6993] netlink: 32 bytes leftover after parsing attributes in process `syz.0.471'. [ 133.133873][ T7000] netlink: 12 bytes leftover after parsing attributes in process `syz.1.470'. [ 133.272577][ T7015] dccp_invalid_packet: P.Data Offset(0) too small [ 133.276560][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.289177][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.437920][ T7003] netlink: 12 bytes leftover after parsing attributes in process `syz.2.476'. [ 133.598545][ T7028] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 134.089046][ T7046] netlink: 'syz.3.487': attribute type 3 has an invalid length. [ 134.242538][ T7059] x_tables: eb_tables: nflog.0 target: invalid size 80 (kernel) != (user) 0 [ 134.391814][ T7063] netlink: 12 bytes leftover after parsing attributes in process `syz.2.490'. [ 134.729101][ T7085] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.497'. [ 134.970685][ T7085] netlink: 36 bytes leftover after parsing attributes in process `syz.2.497'. [ 135.506808][ T7118] netlink: 'syz.3.508': attribute type 21 has an invalid length. [ 135.542824][ T7118] netlink: 'syz.3.508': attribute type 20 has an invalid length. [ 135.621056][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 135.663746][ T7131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.507'. [ 135.783386][ T7127] netlink: 'syz.3.508': attribute type 21 has an invalid length. [ 135.797019][ T7127] netlink: 'syz.3.508': attribute type 20 has an invalid length. [ 136.293823][ T7158] Cannot find add_set index 0 as target [ 136.428354][ T7163] sctp: [Deprecated]: syz.3.519 (pid 7163) Use of int in max_burst socket option. [ 136.428354][ T7163] Use struct sctp_assoc_value instead [ 136.642982][ T7168] x_tables: duplicate underflow at hook 1 [ 136.869043][ T7172] netlink: 'syz.1.522': attribute type 11 has an invalid length. [ 136.913875][ T7172] netlink: 'syz.1.522': attribute type 11 has an invalid length. [ 137.101710][ T7179] netlink: 12 bytes leftover after parsing attributes in process `syz.4.523'. [ 137.240204][ T7182] netlink: 'syz.0.525': attribute type 4 has an invalid length. [ 137.394452][ T7184] netlink: 24 bytes leftover after parsing attributes in process `syz.1.526'. [ 137.611731][ T7184] veth3: entered promiscuous mode [ 137.633455][ T7184] veth3: entered allmulticast mode [ 137.640176][ T7185] netlink: 'syz.0.525': attribute type 4 has an invalid length. [ 137.724397][ T7196] trusted_key: syz.3.530 sent an empty control message without MSG_MORE. [ 137.759581][ T7182] netlink: 8 bytes leftover after parsing attributes in process `syz.0.525'. [ 137.822942][ T7185] syz.0.525 (7185) used greatest stack depth: 17176 bytes left [ 137.847080][ T7202] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.531'. [ 137.857132][ T7202] openvswitch: netlink: IP tunnel attribute has 3048 unknown bytes. [ 138.566904][ T7227] netlink: 12 bytes leftover after parsing attributes in process `syz.3.538'. [ 138.733876][ T7229] netlink: 12 bytes leftover after parsing attributes in process `syz.1.539'. [ 138.885686][ T7238] sch_tbf: burst 3 is lower than device lo mtu (65550) ! [ 138.941350][ T7243] netlink: 12 bytes leftover after parsing attributes in process `syz.3.543'. [ 139.234555][ T7259] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 139.497618][ T7266] netlink: 'syz.1.550': attribute type 2 has an invalid length. [ 139.530019][ T7266] netlink: 8 bytes leftover after parsing attributes in process `syz.1.550'. [ 139.584013][ T7274] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 140.044941][ T7288] netlink: 12 bytes leftover after parsing attributes in process `syz.0.553'. [ 140.487690][ T7304] netlink: 12 bytes leftover after parsing attributes in process `syz.0.560'. [ 140.557293][ T7313] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 141.099898][ T7339] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 141.494018][ T7353] netlink: 168 bytes leftover after parsing attributes in process `syz.0.573'. [ 141.654182][ T7352] netlink: 12 bytes leftover after parsing attributes in process `syz.1.571'. [ 142.136602][ T7381] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 142.754587][ T7402] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 142.807358][ T7407] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 143.096204][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 143.120926][ T7416] __nla_validate_parse: 3 callbacks suppressed [ 143.120949][ T7416] netlink: 76 bytes leftover after parsing attributes in process `syz.1.589'. [ 143.260151][ T7424] Illegal XDP return value 4294967274 on prog (id 227) dev N/A, expect packet loss! [ 143.651524][ T7435] netlink: 'syz.0.594': attribute type 5 has an invalid length. [ 143.723559][ T7434] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 144.044406][ T7446] netlink: 'syz.4.597': attribute type 2 has an invalid length. [ 144.085516][ T7446] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.597'. [ 144.203595][ T7453] ieee802154 phy0 wpan0: encryption failed: -90 [ 144.494829][ T7465] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 144.866780][ T7475] netlink: 16 bytes leftover after parsing attributes in process `syz.3.604'. [ 144.940013][ T7475] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 145.141313][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 145.368982][ T7490] netlink: 12 bytes leftover after parsing attributes in process `syz.4.607'. [ 145.393106][ T7498] netlink: 12 bytes leftover after parsing attributes in process `syz.2.611'. [ 145.612362][ T7500] netlink: 'syz.4.612': attribute type 5 has an invalid length. [ 145.659713][ T7499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 145.785034][ T7507] netlink: 76 bytes leftover after parsing attributes in process `syz.3.614'. [ 145.980437][ T7508] netlink: 12 bytes leftover after parsing attributes in process `syz.2.613'. [ 146.084905][ T7515] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 146.846942][ T7553] netlink: 12 bytes leftover after parsing attributes in process `syz.2.622'. [ 147.004690][ T7566] netlink: 'syz.3.629': attribute type 1 has an invalid length. [ 147.403420][ T7579] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 147.432883][ T7576] netlink: 24 bytes leftover after parsing attributes in process `syz.3.633'. [ 147.484108][ T7588] netlink: 'syz.0.635': attribute type 1 has an invalid length. [ 147.665393][ T7595] netlink: 'syz.1.636': attribute type 5 has an invalid length. [ 147.824135][ T7601] netlink: 8 bytes leftover after parsing attributes in process `syz.4.638'. [ 147.875961][ T7602] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551615) [ 147.906822][ T7602] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647 [ 148.507564][ T7640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.645'. [ 148.706600][ T7637] netlink: 'syz.0.649': attribute type 2 has an invalid length. [ 148.745611][ T7644] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 149.333339][ T7666] netlink: 4 bytes leftover after parsing attributes in process `syz.2.655'. [ 149.537342][ T7678] netlink: 100 bytes leftover after parsing attributes in process `syz.4.659'. [ 149.578337][ T7678] pim6reg: entered allmulticast mode [ 149.589875][ T7674] vxcan1: entered allmulticast mode [ 149.680302][ T7680] netlink: 'syz.2.660': attribute type 1 has an invalid length. [ 149.693366][ T29] audit: type=1804 audit(1719561798.747:11): pid=7680 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.660" name="/root/syzkaller.f3nQDL/114/cgroup.controllers" dev="sda1" ino=1954 res=1 errno=0 [ 150.167979][ T7694] netlink: 12 bytes leftover after parsing attributes in process `syz.1.663'. [ 151.113897][ T7743] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 151.853837][ T5109] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 151.871911][ T5109] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 151.882464][ T5109] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 151.891660][ T5109] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 151.899750][ T5109] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 151.913251][ T5109] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 152.268633][ T7766] netlink: 32 bytes leftover after parsing attributes in process `syz.1.688'. [ 152.410875][ T7757] chnl_net:caif_netlink_parms(): no params data found [ 152.819643][ T7798] netlink: 'syz.3.699': attribute type 1 has an invalid length. [ 152.899582][ T7757] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.950291][ T7757] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.980706][ T7757] bridge_slave_0: entered allmulticast mode [ 153.014042][ T7757] bridge_slave_0: entered promiscuous mode [ 153.053567][ T7757] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.061052][ T7757] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.109565][ T7757] bridge_slave_1: entered allmulticast mode [ 153.134130][ T7757] bridge_slave_1: entered promiscuous mode [ 153.201796][ T7814] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 153.348203][ T7818] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 153.361062][ T7757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 153.396487][ T7757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 153.440707][ T7816] A link change request failed with some changes committed already. Interface batadv_slave_1 may have been left with an inconsistent configuration, please check. [ 153.585299][ T7757] team0: Port device team_slave_0 added [ 153.599465][ T7757] team0: Port device team_slave_1 added [ 153.609643][ T7825] netlink: 'syz.3.705': attribute type 1 has an invalid length. [ 153.757942][ T7833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.708'. [ 153.830804][ T7757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 153.848388][ T7757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 153.930498][ T7757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 153.965688][ T7839] netlink: 20 bytes leftover after parsing attributes in process `syz.0.710'. [ 153.984962][ T53] Bluetooth: hci3: command tx timeout [ 153.993510][ T7757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 154.021911][ T7757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.098124][ T7757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.204035][ T7843] syzkaller0: entered allmulticast mode [ 154.246943][ T7846] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 154.401590][ T7757] hsr_slave_0: entered promiscuous mode [ 154.431433][ T7757] hsr_slave_1: entered promiscuous mode [ 154.450551][ T7757] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 154.459856][ T7757] Cannot create hsr debugfs directory [ 154.513505][ T7857] netlink: 'syz.0.714': attribute type 10 has an invalid length. [ 154.828125][ T7757] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 154.880775][ T7757] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.108876][ T7757] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 155.132905][ T7757] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.315150][ T7757] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 155.359345][ T7757] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.506726][ T7757] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 155.551524][ T7757] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.606153][ T7884] netlink: 12 bytes leftover after parsing attributes in process `syz.3.722'. [ 155.737713][ T7889] netlink: 24 bytes leftover after parsing attributes in process `syz.1.723'. [ 155.796789][ T7896] netlink: 24 bytes leftover after parsing attributes in process `syz.0.724'. [ 155.899192][ T7896] netlink: 24 bytes leftover after parsing attributes in process `syz.0.724'. [ 156.063170][ T53] Bluetooth: hci3: command tx timeout [ 156.097405][ T7757] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 156.148518][ T7757] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 156.177512][ T7757] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 156.223025][ T7757] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 156.377816][ T7915] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 156.662416][ T7757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 156.777384][ T7757] 8021q: adding VLAN 0 to HW filter on device team0 [ 156.844533][ T5150] bridge0: port 1(bridge_slave_0) entered blocking state [ 156.852695][ T5150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 156.919909][ T5150] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.927197][ T5150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 157.185502][ T7938] geneve2: entered promiscuous mode [ 157.190796][ T7938] geneve2: entered allmulticast mode [ 157.331189][ T7757] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 157.440401][ T7944] netlink: 'syz.4.740': attribute type 15 has an invalid length. [ 157.491374][ T7946] sch_tbf: burst 0 is lower than device lo mtu (11337746) ! [ 157.940894][ T7965] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 158.065271][ T7757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 158.143274][ T53] Bluetooth: hci3: command tx timeout [ 158.206682][ T7970] netlink: 'syz.1.746': attribute type 3 has an invalid length. [ 158.242831][ T7970] netlink: 'syz.1.746': attribute type 3 has an invalid length. [ 158.286340][ T7757] veth0_vlan: entered promiscuous mode [ 158.342260][ T7757] veth1_vlan: entered promiscuous mode [ 158.511910][ T7757] veth0_macvtap: entered promiscuous mode [ 158.557382][ T7757] veth1_macvtap: entered promiscuous mode [ 158.666338][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 158.710231][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 158.752746][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 158.779607][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 158.809566][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 158.830627][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 158.863593][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 158.886899][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 158.920657][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 158.941832][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 158.979156][ T7757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 159.015153][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 159.044270][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 159.098658][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 159.144713][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 159.156007][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 159.167712][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 159.180499][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 159.195214][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 159.225613][ T7757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 159.237045][ T7757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 159.251479][ T7757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 159.296069][ T7999] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 159.312802][ T8005] netem: incorrect gi model size [ 159.321575][ T8005] netem: change failed [ 159.344258][ T7757] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.358188][ T7757] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.372296][ T7757] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.382740][ T7757] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.423539][ T8010] netlink: 24 bytes leftover after parsing attributes in process `syz.4.758'. [ 159.696676][ T8023] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 159.785631][ T2852] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 159.807757][ T2852] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 159.911554][ T5961] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 159.934203][ T5961] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 160.002417][ T8028] netlink: 12 bytes leftover after parsing attributes in process `syz.3.762'. [ 160.222794][ T53] Bluetooth: hci3: command tx timeout [ 160.257497][ T8038] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 160.359302][ T8043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.771'. [ 160.702860][ T8058] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 161.220921][ T8085] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 161.224215][ T8089] netlink: 40 bytes leftover after parsing attributes in process `syz.1.778'. [ 161.338594][ T8090] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 161.565410][ T8104] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 161.660015][ T8105] netlink: 44 bytes leftover after parsing attributes in process `syz.3.783'. [ 162.025787][ T8124] netlink: 4 bytes leftover after parsing attributes in process `syz.2.788'. [ 163.288935][ T8155] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 163.781591][ T8177] macvtap0: entered promiscuous mode [ 163.818055][ T8177] macvtap0: entered allmulticast mode [ 163.863848][ T8177] veth0_macvtap: entered allmulticast mode [ 164.045389][ T8189] netlink: 12 bytes leftover after parsing attributes in process `syz.0.804'. [ 164.155676][ T8197] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 164.648064][ T8223] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 165.246776][ T8235] netlink: 24 bytes leftover after parsing attributes in process `syz.1.815'. [ 165.581455][ T8243] netlink: 188 bytes leftover after parsing attributes in process `syz.1.815'. [ 165.602343][ T8241] netlink: 'syz.2.816': attribute type 1 has an invalid length. [ 165.677207][ T8241] netlink: 12 bytes leftover after parsing attributes in process `syz.2.816'. [ 166.041733][ T8268] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 166.109382][ T8269] do_dccp_getsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app [ 166.316772][ T8283] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 166.411070][ T8290] netlink: 4 bytes leftover after parsing attributes in process `syz.3.830'. [ 166.604704][ T8285] netlink: 24 bytes leftover after parsing attributes in process `syz.2.829'. [ 166.915190][ T8300] netlink: 'syz.1.833': attribute type 1 has an invalid length. [ 166.971230][ T8300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.833'. [ 166.999639][ T8285] netlink: 188 bytes leftover after parsing attributes in process `syz.2.829'. [ 167.207627][ T8317] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 167.303801][ T8322] netlink: 36 bytes leftover after parsing attributes in process `syz.4.839'. [ 167.523232][ T8332] netlink: 44 bytes leftover after parsing attributes in process `syz.4.840'. [ 167.544875][ T8332] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 167.667397][ T8338] netlink: 105108 bytes leftover after parsing attributes in process `syz.1.842'. [ 167.703954][ T8338] netlink: 'syz.1.842': attribute type 1 has an invalid length. [ 167.928972][ T8356] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 168.280091][ T8368] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 168.501533][ T8379] netlink: 'syz.4.853': attribute type 1 has an invalid length. [ 168.746692][ T8374] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 169.177588][ T8395] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 169.672199][ T8408] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 169.799059][ T8410] netlink: 'syz.2.862': attribute type 2 has an invalid length. [ 170.343914][ T8414] __nla_validate_parse: 5 callbacks suppressed [ 170.343936][ T8414] netlink: 24 bytes leftover after parsing attributes in process `syz.3.865'. [ 170.414976][ T8430] netlink: 24 bytes leftover after parsing attributes in process `syz.1.868'. [ 170.822981][ T8423] netlink: 188 bytes leftover after parsing attributes in process `syz.1.868'. [ 171.170913][ T8467] netlink: 'syz.2.874': attribute type 10 has an invalid length. [ 171.276638][ T8467] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 171.377128][ T8467] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 171.481037][ T8482] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 172.194401][ T8504] netlink: 28 bytes leftover after parsing attributes in process `syz.4.887'. [ 172.256015][ T8504] netlink: 28 bytes leftover after parsing attributes in process `syz.4.887'. [ 173.457724][ T8549] netlink: 32 bytes leftover after parsing attributes in process `syz.2.898'. [ 173.486865][ T8549] tipc: Invalid UDP bearer configuration [ 173.486943][ T8549] tipc: Enabling of bearer rejected, failed to enable media [ 174.034498][ T8573] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 174.389792][ T8584] netlink: 16 bytes leftover after parsing attributes in process `syz.3.909'. [ 174.621721][ T8599] netlink: 4 bytes leftover after parsing attributes in process `syz.0.912'. [ 174.754485][ T8605] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 174.908107][ T8608] netlink: 8 bytes leftover after parsing attributes in process `syz.0.916'. [ 175.094721][ T8579] delete_channel: no stack [ 175.372186][ T8622] netlink: 'syz.3.921': attribute type 16 has an invalid length. [ 175.397598][ T8621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.920'. [ 175.466853][ T29] audit: type=1804 audit(1719561824.527:12): pid=8626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.922" name="/root/syzkaller.b4AwfQ/205/memory.events" dev="sda1" ino=1973 res=1 errno=0 [ 176.260372][ T8651] netlink: 32 bytes leftover after parsing attributes in process `syz.0.929'. [ 176.285934][ T8653] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 176.555372][ T53] Bluetooth: hci0: command 0x0c1a tx timeout [ 176.708867][ T8659] syzkaller0: entered promiscuous mode [ 176.715087][ T8659] syzkaller0: entered allmulticast mode [ 179.641079][ C1] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 179.957606][ T8714] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 180.005454][ T8716] netlink: 8 bytes leftover after parsing attributes in process `syz.1.948'. [ 180.341545][ T8735] batadv_slave_1: entered promiscuous mode [ 180.578940][ T8734] batadv_slave_1: left promiscuous mode [ 181.323484][ T8771] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 181.524587][ T8776] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 182.010925][ T8798] netlink: 8 bytes leftover after parsing attributes in process `syz.3.966'. [ 182.064018][ T8798] hsr0: VLAN not yet supported [ 182.777363][ T5109] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 182.792761][ T5109] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 182.802141][ T5109] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 182.812393][ T5109] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 182.843389][ T5109] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 182.853919][ T5109] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 182.899148][ T8819] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 183.324099][ T8827] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.584447][ T8833] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 183.826932][ T8827] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.236792][ T8827] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.410017][ T8827] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.943085][ T5109] Bluetooth: hci1: command tx timeout [ 185.088882][ T8827] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.127562][ T8827] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.199778][ T8812] chnl_net:caif_netlink_parms(): no params data found [ 185.236421][ T8879] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 185.281810][ T8827] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.354577][ T8827] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.553694][ T8899] netlink: 4 bytes leftover after parsing attributes in process `syz.3.994'. [ 185.684415][ T8908] netlink: 'syz.1.997': attribute type 11 has an invalid length. [ 185.729886][ T8901] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 185.802866][ T8812] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.810102][ T8812] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.837725][ T8812] bridge_slave_0: entered allmulticast mode [ 185.869197][ T8812] bridge_slave_0: entered promiscuous mode [ 185.964560][ T8812] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.983394][ T8812] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.990726][ T8812] bridge_slave_1: entered allmulticast mode [ 186.025065][ T8812] bridge_slave_1: entered promiscuous mode [ 186.088765][ T8922] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1001'. [ 186.147996][ T8925] ieee802154 phy0 wpan0: encryption failed: -22 [ 186.184640][ T8922] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1001'. [ 186.243327][ T8812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.286844][ T8812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.415694][ T8812] team0: Port device team_slave_0 added [ 186.438522][ T8812] team0: Port device team_slave_1 added [ 186.609385][ T8946] netlink: 'syz.1.1006': attribute type 1 has an invalid length. [ 186.627486][ T8812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 186.656396][ T8812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 186.697975][ T8812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 186.752897][ T8812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 186.773456][ T8812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 186.827602][ T8812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 187.034575][ T5109] Bluetooth: hci1: command tx timeout [ 187.113774][ T8962] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 187.224799][ T8812] hsr_slave_0: entered promiscuous mode [ 187.253704][ T8812] hsr_slave_1: entered promiscuous mode [ 187.279473][ T8812] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 187.298752][ T8812] Cannot create hsr debugfs directory [ 187.858338][ T8981] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1018'. [ 187.869774][ T8812] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.029425][ T8812] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.195641][ T8812] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.354701][ T8812] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.648413][ T8812] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 188.680932][ T8812] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 188.695339][ T8996] netlink: 'syz.1.1023': attribute type 11 has an invalid length. [ 188.719298][ T8812] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 188.765553][ T8812] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 188.970326][ T9006] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 189.102850][ T5109] Bluetooth: hci1: command tx timeout [ 189.180440][ T8812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 189.280994][ T8812] 8021q: adding VLAN 0 to HW filter on device team0 [ 189.306727][ T9016] Bluetooth: MGMT ver 1.22 [ 189.321696][ T9016] Bluetooth: hci3: service_discovery: expected 4 bytes, got 7 bytes [ 189.335386][ T784] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.342598][ T784] bridge0: port 1(bridge_slave_0) entered forwarding state [ 189.492494][ T784] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.499804][ T784] bridge0: port 2(bridge_slave_1) entered forwarding state [ 189.698582][ T9028] netlink: 'syz.1.1033': attribute type 11 has an invalid length. [ 190.004276][ T9043] netlink: 'syz.3.1039': attribute type 1 has an invalid length. [ 190.011500][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.040753][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.060978][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.071828][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.080092][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.088438][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.098920][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.107533][ T9041] netlink: 'syz.2.1038': attribute type 2 has an invalid length. [ 190.197050][ T9053] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1040'. [ 190.230776][ T9049] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 190.267155][ T9049] bond5: (slave batadv1): Enslaving as a backup interface with an up link [ 190.339510][ T9055] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1040'. [ 190.357518][ T9043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1039'. [ 190.486399][ T9043] bond5 (unregistering): (slave batadv1): Releasing backup interface [ 190.535125][ T9043] bond5 (unregistering): Released all slaves [ 190.697060][ T8812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.114664][ T9087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1048'. [ 191.183560][ T5109] Bluetooth: hci1: command tx timeout [ 191.394347][ T29] audit: type=1804 audit(1719561840.457:13): pid=9090 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1050" name="/root/syzkaller.ogktY6/220/cgroup.controllers" dev="sda1" ino=1954 res=1 errno=0 [ 191.425943][ T8812] veth0_vlan: entered promiscuous mode [ 191.540540][ T8812] veth1_vlan: entered promiscuous mode [ 191.712372][ T8812] veth0_macvtap: entered promiscuous mode [ 191.759848][ T8812] veth1_macvtap: entered promiscuous mode [ 191.845451][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.877773][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.899974][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.923272][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.950483][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 191.971510][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 191.995840][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 192.014969][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.031613][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 192.048157][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.060660][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 192.072098][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.086831][ T8812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 192.118362][ T9122] netlink: 'syz.0.1059': attribute type 1 has an invalid length. [ 192.145171][ T9122] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 192.190046][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.233701][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.250540][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.301417][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.305460][ T9132] netlink: 'syz.2.1060': attribute type 10 has an invalid length. [ 192.321021][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.347227][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.352687][ T9132] netlink: 212848 bytes leftover after parsing attributes in process `syz.2.1060'. [ 192.370160][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.396646][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.424388][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.447436][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.469159][ T8812] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.502471][ T8812] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.558216][ T8812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.636995][ T8812] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.653908][ T8812] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.667657][ T9145] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1064'. [ 192.670054][ T9148] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1063'. [ 192.689805][ T8812] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.707797][ T8812] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.882527][ T9149] xt_CT: You must specify a L4 protocol and not use inversions on it [ 192.930191][ T9156] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-xor(2) [ 193.025459][ T2396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.060363][ T2396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.120844][ T9163] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1072'. [ 193.138866][ T2880] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.156232][ T2880] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.200964][ T9167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1072'. [ 193.248277][ T9169] netlink: set zone limit has 4 unknown bytes [ 193.311845][ T9170] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1074'. [ 193.467165][ T9170] Κό: entered promiscuous mode [ 193.803421][ T9186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1078'. [ 193.861792][ T9189] netlink: 'syz.1.1079': attribute type 10 has an invalid length. [ 193.915283][ T9189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.979523][ T9189] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 194.008397][ T9188] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1078'. [ 194.043328][ T9188] netlink: 'syz.0.1078': attribute type 13 has an invalid length. [ 194.076340][ T9188] netlink: 'syz.0.1078': attribute type 15 has an invalid length. [ 194.326632][ T9206] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1084'. [ 194.401618][ T9212] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1086'. [ 194.404452][ T9210] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1086'. [ 194.727570][ T9224] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1090'. [ 194.737455][ T9228] netlink: set zone limit has 4 unknown bytes [ 194.737824][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.754757][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.864835][ T9240] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 195.516003][ T9264] xt_NFQUEUE: number of total queues is 0 [ 195.891929][ T9281] netlink: set zone limit has 4 unknown bytes [ 195.907067][ T9282] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1108'. [ 196.425707][ T9307] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 196.773364][ T9313] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.785354][ T5109] Bluetooth: hci2: command 0x0406 tx timeout [ 197.812586][ T9360] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 33927 - 0 [ 197.824349][ T9360] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 33927 - 0 [ 197.836862][ T9360] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 33927 - 0 [ 197.848323][ T9360] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 33927 - 0 [ 197.867914][ T9360] geneve2: entered promiscuous mode [ 197.886021][ T9360] geneve2: entered allmulticast mode [ 198.119721][ T9379] tipc: Started in network mode [ 198.136970][ T9379] tipc: Node identity 4, cluster identity 4711 [ 198.146548][ T9379] tipc: Node number set to 4 [ 198.447736][ T9398] __nla_validate_parse: 10 callbacks suppressed [ 198.447759][ T9398] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1143'. [ 198.815719][ T9410] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1150'. [ 199.060069][ T9417] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1155'. [ 199.103255][ T8454] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.255594][ T8454] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.390232][ T8454] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.544561][ T9426] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1160'. [ 199.566831][ T8454] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.815064][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 199.839976][ T5113] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 199.856764][ T5113] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 199.869064][ T5113] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 199.877252][ T5113] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 199.893472][ T5113] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 199.979246][ T8454] bridge_slave_1: left allmulticast mode [ 200.002554][ T8454] bridge_slave_1: left promiscuous mode [ 200.003902][ T5113] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 200.019313][ T5113] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 200.028023][ T5113] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 200.028596][ T8454] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.065243][ T5113] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 200.076881][ T5113] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 200.085293][ T5113] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 200.097816][ T8454] bridge_slave_0: left allmulticast mode [ 200.115158][ T8454] bridge_slave_0: left promiscuous mode [ 200.122591][ T8454] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.285236][ T9451] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1166'. [ 200.842579][ T8454] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 200.857615][ T8454] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 200.870277][ T8454] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 200.882421][ T8454] bond0 (unregistering): Released all slaves [ 200.905832][ T9447] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1166'. [ 201.057324][ T9465] netlink: 'syz.3.1171': attribute type 1 has an invalid length. [ 201.850425][ T8454] hsr_slave_0: left promiscuous mode [ 201.873323][ T8454] hsr_slave_1: left promiscuous mode [ 201.894629][ T8454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 201.924329][ T8454] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 201.974318][ T8454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 201.982785][ T5113] Bluetooth: hci0: command tx timeout [ 201.983041][ T8454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 202.060176][ T8454] veth1_macvtap: left promiscuous mode [ 202.066003][ T8454] veth0_macvtap: left promiscuous mode [ 202.071863][ T8454] veth1_vlan: left promiscuous mode [ 202.078001][ T8454] veth0_vlan: left promiscuous mode [ 202.144549][ T5113] Bluetooth: hci3: command tx timeout [ 202.996297][ T8454] team0 (unregistering): Port device team_slave_1 removed [ 203.057726][ T8454] team0 (unregistering): Port device team_slave_0 removed [ 203.589597][ T9506] macvlan2: entered promiscuous mode [ 203.605398][ T9506] macvlan2: entered allmulticast mode [ 203.617200][ T9506] bridge0: entered promiscuous mode [ 203.623219][ T9506] bridge0: entered allmulticast mode [ 203.636550][ T9506] team0: Port device macvlan2 added [ 203.644624][ T9513] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1188'. [ 203.674492][ T9513] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 203.687264][ T9513] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 203.700346][ T9513] netlink: 'syz.0.1188': attribute type 1 has an invalid length. [ 203.718478][ T9513] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 203.749115][ T9514] netlink: 80 bytes leftover after parsing attributes in process `syz.0.1188'. [ 203.776234][ T9435] chnl_net:caif_netlink_parms(): no params data found [ 204.015317][ T9530] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 204.075691][ T5113] Bluetooth: hci0: command tx timeout [ 204.231765][ T5113] Bluetooth: hci3: command tx timeout [ 204.339835][ T9435] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.384258][ T9435] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.411550][ T9435] bridge_slave_0: entered allmulticast mode [ 204.429226][ T9435] bridge_slave_0: entered promiscuous mode [ 204.461391][ T9435] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.488755][ T9435] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.514224][ T9435] bridge_slave_1: entered allmulticast mode [ 204.540075][ T9435] bridge_slave_1: entered promiscuous mode [ 204.679570][ T9435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.729476][ T9440] chnl_net:caif_netlink_parms(): no params data found [ 204.831802][ T9435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.074045][ T9566] netlink: 'syz.3.1202': attribute type 29 has an invalid length. [ 205.152567][ T9435] team0: Port device team_slave_0 added [ 205.160790][ T9564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1201'. [ 205.195762][ T9566] netlink: 'syz.3.1202': attribute type 29 has an invalid length. [ 205.204698][ T9569] netlink: 'syz.4.1203': attribute type 5 has an invalid length. [ 205.225045][ T9435] team0: Port device team_slave_1 added [ 205.311417][ T9570] netlink: 'syz.3.1202': attribute type 29 has an invalid length. [ 205.527843][ T8454] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 205.562934][ T8454] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.740167][ T9580] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 205.863969][ T9435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 205.893102][ T9435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 205.939077][ T9435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 205.951737][ T9594] netlink: 'syz.3.1210': attribute type 1 has an invalid length. [ 205.991941][ T9594] netlink: 'syz.3.1210': attribute type 1 has an invalid length. [ 206.005542][ T9597] netlink: 'syz.4.1211': attribute type 29 has an invalid length. [ 206.023349][ T9594] netlink: 9328 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.024076][ T9435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 206.063951][ T9435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 206.063976][ T9591] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.120052][ T9591] netlink: 896 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.121359][ T9435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 206.136240][ T9591] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.149201][ T5113] Bluetooth: hci0: command tx timeout [ 206.155566][ T9591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.164828][ T9591] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.173977][ T9591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1210'. [ 206.222525][ T8454] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 206.237942][ T8454] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.289576][ T9597] netlink: 'syz.4.1211': attribute type 29 has an invalid length. [ 206.303488][ T5113] Bluetooth: hci3: command tx timeout [ 206.388037][ T9440] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.397571][ T9440] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.416555][ T9440] bridge_slave_0: entered allmulticast mode [ 206.434845][ T9440] bridge_slave_0: entered promiscuous mode [ 206.455682][ T9440] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.472847][ T9440] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.490495][ T9440] bridge_slave_1: entered allmulticast mode [ 206.504583][ T9440] bridge_slave_1: entered promiscuous mode [ 206.585256][ T8454] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 206.607268][ T8454] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.733425][ T9435] hsr_slave_0: entered promiscuous mode [ 206.755515][ T9435] hsr_slave_1: entered promiscuous mode [ 206.775561][ T9435] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 206.792265][ T9435] Cannot create hsr debugfs directory [ 206.896791][ T8454] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 206.907698][ T8454] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.995142][ T9627] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 207.007109][ T9627] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 207.028514][ T9627] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 207.086952][ T9440] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 207.139892][ T9440] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 207.276561][ T9642] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 207.356528][ T9440] team0: Port device team_slave_0 added [ 207.402176][ T9440] team0: Port device team_slave_1 added [ 207.496616][ T9440] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 207.542869][ T9440] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 207.593727][ T9440] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 207.633639][ T9440] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 207.640746][ T9440] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 207.670459][ T9440] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 207.919084][ T9440] hsr_slave_0: entered promiscuous mode [ 207.927694][ T9440] hsr_slave_1: entered promiscuous mode [ 207.936751][ T9440] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 207.944734][ T9440] Cannot create hsr debugfs directory [ 208.138445][ T8454] bridge_slave_1: left allmulticast mode [ 208.147701][ T8454] bridge_slave_1: left promiscuous mode [ 208.158086][ T8454] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.170782][ T8454] bridge_slave_0: left promiscuous mode [ 208.178553][ T8454] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.200259][ T9674] ipt_REJECT: ECHOREPLY no longer supported. [ 208.223645][ T5113] Bluetooth: hci0: command tx timeout [ 208.382941][ T5113] Bluetooth: hci3: command tx timeout [ 208.904153][ T8454] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 208.924976][ T8454] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 208.945241][ T8454] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 208.962360][ T8454] bond0 (unregistering): Released all slaves [ 208.982330][ T8454] bond1 (unregistering): Released all slaves [ 208.997949][ T8454] bond2 (unregistering): Released all slaves [ 209.346486][ T9691] __nla_validate_parse: 8 callbacks suppressed [ 209.346509][ T9691] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1238'. [ 209.443569][ T9696] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 209.545379][ T9703] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1240'. [ 209.597245][ T9705] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1241'. [ 209.833894][ T9708] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1242'. [ 209.873974][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 209.927387][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 209.948233][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 209.983342][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.010046][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.025646][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.070152][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.139261][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.173822][ T9710] sock: sock_set_timeout: `syz.4.1244' (pid 9710) tries to set negative timeout [ 210.256925][ T8454] hsr_slave_0: left promiscuous mode [ 210.275293][ T8454] hsr_slave_1: left promiscuous mode [ 210.290825][ T8454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 210.303427][ T8454] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 210.352375][ T8454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 210.362989][ T8454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 210.385787][ T8454] veth1_macvtap: left promiscuous mode [ 210.391468][ T8454] veth0_macvtap: left promiscuous mode [ 210.410077][ T8454] veth1_vlan: left promiscuous mode [ 210.419877][ T8454] veth0_vlan: left promiscuous mode [ 210.433856][ T9732] ipt_REJECT: ECHOREPLY no longer supported. [ 211.188109][ T8454] team0 (unregistering): Port device team_slave_1 removed [ 211.251523][ T8454] team0 (unregistering): Port device team_slave_0 removed [ 211.409681][ T8454] bridge_slave_0 (unregistering): left allmulticast mode [ 211.844630][ T9736] syzkaller0: entered promiscuous mode [ 211.850622][ T9736] syzkaller0: entered allmulticast mode [ 211.993278][ T9753] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1252'. [ 212.148513][ T5113] Bluetooth: hci4: command 0x0406 tx timeout [ 212.251965][ T9761] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1255'. [ 214.085200][ T9768] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1257'. [ 214.374613][ T2880] ================================================================== [ 214.382754][ T2880] BUG: KASAN: slab-use-after-free in l2tp_tunnel_del_work+0xe5/0x330 [ 214.390898][ T2880] Read of size 8 at addr ffff88801edff8b8 by task kworker/u8:13/2880 [ 214.399070][ T2880] [ 214.401415][ T2880] CPU: 0 PID: 2880 Comm: kworker/u8:13 Not tainted 6.10.0-rc4-syzkaller-00948-gcce346d44139 #0 [ 214.411770][ T2880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 214.421935][ T2880] Workqueue: l2tp l2tp_tunnel_del_work [ 214.427446][ T2880] Call Trace: [ 214.430743][ T2880] [ 214.433708][ T2880] dump_stack_lvl+0x241/0x360 [ 214.438584][ T2880] ? __pfx_dump_stack_lvl+0x10/0x10 [ 214.443800][ T2880] ? __pfx__printk+0x10/0x10 [ 214.448429][ T2880] ? _printk+0xd5/0x120 [ 214.452597][ T2880] ? __virt_addr_valid+0x183/0x520 [ 214.457737][ T2880] ? __virt_addr_valid+0x183/0x520 [ 214.462867][ T2880] print_report+0x169/0x550 [ 214.467383][ T2880] ? __virt_addr_valid+0x183/0x520 [ 214.472507][ T2880] ? __virt_addr_valid+0x183/0x520 [ 214.477633][ T2880] ? __virt_addr_valid+0x44e/0x520 [ 214.482759][ T2880] ? __phys_addr+0xba/0x170 [ 214.487314][ T2880] ? l2tp_tunnel_del_work+0xe5/0x330 [ 214.492651][ T2880] kasan_report+0x143/0x180 [ 214.497205][ T2880] ? l2tp_tunnel_del_work+0xe5/0x330 [ 214.502510][ T2880] l2tp_tunnel_del_work+0xe5/0x330 [ 214.507675][ T2880] ? process_scheduled_works+0x945/0x1830 [ 214.513441][ T2880] process_scheduled_works+0xa2c/0x1830 [ 214.519009][ T2880] ? __pfx_process_scheduled_works+0x10/0x10 [ 214.524999][ T2880] ? assign_work+0x364/0x3d0 [ 214.529598][ T2880] worker_thread+0x86d/0xd70 [ 214.534205][ T2880] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 214.540109][ T2880] ? __kthread_parkme+0x169/0x1d0 [ 214.545150][ T2880] ? __pfx_worker_thread+0x10/0x10 [ 214.550272][ T2880] kthread+0x2f0/0x390 [ 214.554350][ T2880] ? __pfx_worker_thread+0x10/0x10 [ 214.559467][ T2880] ? __pfx_kthread+0x10/0x10 [ 214.564066][ T2880] ret_from_fork+0x4b/0x80 [ 214.568494][ T2880] ? __pfx_kthread+0x10/0x10 [ 214.573109][ T2880] ret_from_fork_asm+0x1a/0x30 [ 214.577895][ T2880] [ 214.580944][ T2880] [ 214.583266][ T2880] Allocated by task 9776: [ 214.587600][ T2880] kasan_save_track+0x3f/0x80 [ 214.592283][ T2880] __kasan_kmalloc+0x98/0xb0 [ 214.596879][ T2880] __kmalloc_noprof+0x1f9/0x400 [ 214.601734][ T2880] l2tp_session_create+0x3b/0xc20 [ 214.606771][ T2880] pppol2tp_connect+0xca3/0x17a0 [ 214.611721][ T2880] __sys_connect+0x2df/0x310 [ 214.616322][ T2880] __x64_sys_connect+0x7a/0x90 [ 214.621094][ T2880] do_syscall_64+0xf3/0x230 [ 214.625610][ T2880] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.631518][ T2880] [ 214.633845][ T2880] Freed by task 2880: [ 214.637824][ T2880] kasan_save_track+0x3f/0x80 [ 214.642508][ T2880] kasan_save_free_info+0x40/0x50 [ 214.647536][ T2880] poison_slab_object+0xe0/0x150 [ 214.652482][ T2880] __kasan_slab_free+0x37/0x60 [ 214.657258][ T2880] kfree+0x149/0x360 [ 214.661208][ T2880] __sk_destruct+0x58/0x5f0 [ 214.665723][ T2880] rcu_core+0xafd/0x1830 [ 214.669971][ T2880] handle_softirqs+0x2c4/0x970 [ 214.674740][ T2880] __irq_exit_rcu+0xf4/0x1c0 [ 214.679334][ T2880] irq_exit_rcu+0x9/0x30 [ 214.683581][ T2880] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 214.689225][ T2880] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 214.695221][ T2880] [ 214.697547][ T2880] Last potentially related work creation: [ 214.703257][ T2880] kasan_save_stack+0x3f/0x60 [ 214.707942][ T2880] __kasan_record_aux_stack+0xac/0xc0 [ 214.713324][ T2880] call_rcu+0x167/0xa70 [ 214.717487][ T2880] pppol2tp_release+0x24b/0x350 [ 214.722341][ T2880] sock_close+0xbc/0x240 [ 214.726588][ T2880] __fput+0x406/0x8b0 [ 214.730574][ T2880] task_work_run+0x24f/0x310 [ 214.735177][ T2880] syscall_exit_to_user_mode+0x168/0x370 [ 214.740822][ T2880] do_syscall_64+0x100/0x230 [ 214.745422][ T2880] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.751327][ T2880] [ 214.753652][ T2880] The buggy address belongs to the object at ffff88801edff800 [ 214.753652][ T2880] which belongs to the cache kmalloc-1k of size 1024 [ 214.767710][ T2880] The buggy address is located 184 bytes inside of [ 214.767710][ T2880] freed 1024-byte region [ffff88801edff800, ffff88801edffc00) [ 214.781599][ T2880] [ 214.783938][ T2880] The buggy address belongs to the physical page: [ 214.790356][ T2880] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1edf8 [ 214.799123][ T2880] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 214.807625][ T2880] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 214.815184][ T2880] page_type: 0xffffefff(slab) [ 214.819869][ T2880] raw: 00fff00000000040 ffff888015041dc0 dead000000000100 dead000000000122 [ 214.828453][ T2880] raw: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000 [ 214.837041][ T2880] head: 00fff00000000040 ffff888015041dc0 dead000000000100 dead000000000122 [ 214.845715][ T2880] head: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000 [ 214.854390][ T2880] head: 00fff00000000003 ffffea00007b7e01 ffffffffffffffff 0000000000000000 [ 214.863099][ T2880] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 214.874571][ T2880] page dumped because: kasan: bad access detected [ 214.880991][ T2880] page_owner tracks the page as allocated [ 214.886708][ T2880] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 2852, tgid 2852 (kworker/u8:12), ts 80467373525, free_ts 80464451995 [ 214.907746][ T2880] post_alloc_hook+0x1f3/0x230 [ 214.912529][ T2880] get_page_from_freelist+0x2e43/0x2f00 [ 214.918087][ T2880] __alloc_pages_noprof+0x256/0x6c0 [ 214.923304][ T2880] alloc_slab_page+0x5f/0x120 [ 214.927985][ T2880] allocate_slab+0x5a/0x2f0 [ 214.932492][ T2880] ___slab_alloc+0xcd1/0x14b0 [ 214.937266][ T2880] __slab_alloc+0x58/0xa0 [ 214.941601][ T2880] __kmalloc_noprof+0x257/0x400 [ 214.946454][ T2880] ieee802_11_parse_elems_full+0xdb/0x2880 [ 214.952269][ T2880] ieee80211_ibss_rx_queued_mgmt+0x4c8/0x2d70 [ 214.958347][ T2880] ieee80211_iface_work+0x8a5/0xf20 [ 214.963559][ T2880] cfg80211_wiphy_work+0x2db/0x490 [ 214.968674][ T2880] process_scheduled_works+0xa2c/0x1830 [ 214.974223][ T2880] worker_thread+0x86d/0xd70 [ 214.978814][ T2880] kthread+0x2f0/0x390 [ 214.982889][ T2880] ret_from_fork+0x4b/0x80 [ 214.987314][ T2880] page last free pid 5261 tgid 5259 stack trace: [ 214.993658][ T2880] free_unref_page+0xd22/0xea0 [ 214.998450][ T2880] __folio_put+0x3b9/0x620 [ 215.002872][ T2880] free_large_kmalloc+0x105/0x1c0 [ 215.008076][ T2880] kfree+0x1c4/0x360 [ 215.011982][ T2880] nf_tables_newrule+0x2675/0x2950 [ 215.017104][ T2880] nfnetlink_rcv+0x1427/0x2a90 [ 215.021878][ T2880] netlink_unicast+0x7f0/0x990 [ 215.026670][ T2880] netlink_sendmsg+0x8e4/0xcb0 [ 215.031459][ T2880] __sock_sendmsg+0x221/0x270 [ 215.036145][ T2880] ____sys_sendmsg+0x525/0x7d0 [ 215.040916][ T2880] __sys_sendmsg+0x2b0/0x3a0 [ 215.045514][ T2880] do_syscall_64+0xf3/0x230 [ 215.050209][ T2880] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.056138][ T2880] [ 215.058461][ T2880] Memory state around the buggy address: [ 215.064091][ T2880] ffff88801edff780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 215.072249][ T2880] ffff88801edff800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 215.080400][ T2880] >ffff88801edff880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 215.088566][ T2880] ^ [ 215.094456][ T2880] ffff88801edff900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 215.102529][ T2880] ffff88801edff980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 215.110609][ T2880] ================================================================== [ 215.118788][ T2880] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 215.126013][ T2880] CPU: 0 PID: 2880 Comm: kworker/u8:13 Not tainted 6.10.0-rc4-syzkaller-00948-gcce346d44139 #0 [ 215.136716][ T2880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 215.146823][ T2880] Workqueue: l2tp l2tp_tunnel_del_work [ 215.152344][ T2880] Call Trace: [ 215.155649][ T2880] [ 215.158604][ T2880] dump_stack_lvl+0x241/0x360 [ 215.163421][ T2880] ? __pfx_dump_stack_lvl+0x10/0x10 [ 215.168677][ T2880] ? __pfx__printk+0x10/0x10 [ 215.173323][ T2880] ? vscnprintf+0x5d/0x90 [ 215.177690][ T2880] panic+0x349/0x860 [ 215.181636][ T2880] ? check_panic_on_warn+0x21/0xb0 [ 215.186799][ T2880] ? __pfx_panic+0x10/0x10 [ 215.191268][ T2880] ? mark_lock+0x9a/0x350 [ 215.195643][ T2880] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 215.201575][ T2880] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 215.207604][ T2880] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 215.213960][ T2880] ? print_report+0x502/0x550 [ 215.218666][ T2880] check_panic_on_warn+0x86/0xb0 [ 215.223619][ T2880] ? l2tp_tunnel_del_work+0xe5/0x330 [ 215.228921][ T2880] end_report+0x77/0x160 [ 215.233177][ T2880] kasan_report+0x154/0x180 [ 215.237696][ T2880] ? l2tp_tunnel_del_work+0xe5/0x330 [ 215.242999][ T2880] l2tp_tunnel_del_work+0xe5/0x330 [ 215.248127][ T2880] ? process_scheduled_works+0x945/0x1830 [ 215.253969][ T2880] process_scheduled_works+0xa2c/0x1830 [ 215.259532][ T2880] ? __pfx_process_scheduled_works+0x10/0x10 [ 215.265524][ T2880] ? assign_work+0x364/0x3d0 [ 215.270213][ T2880] worker_thread+0x86d/0xd70 [ 215.274818][ T2880] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 215.280722][ T2880] ? __kthread_parkme+0x169/0x1d0 [ 215.285756][ T2880] ? __pfx_worker_thread+0x10/0x10 [ 215.290875][ T2880] kthread+0x2f0/0x390 [ 215.294955][ T2880] ? __pfx_worker_thread+0x10/0x10 [ 215.300161][ T2880] ? __pfx_kthread+0x10/0x10 [ 215.304849][ T2880] ret_from_fork+0x4b/0x80 [ 215.309308][ T2880] ? __pfx_kthread+0x10/0x10 [ 215.313914][ T2880] ret_from_fork_asm+0x1a/0x30 [ 215.318696][ T2880] [ 215.322093][ T2880] Kernel Offset: disabled [ 215.326426][ T2880] Rebooting in 86400 seconds..