last executing test programs: 2.012898039s ago: executing program 1 (id=11751): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_REMOTE={0x8, 0x7, @rand_addr=0x64010101}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e22}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x54}}, 0x24000000) 1.855188549s ago: executing program 1 (id=11754): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002640)=@newtaction={0x14, 0x30, 0x800, 0x70bd2a, 0x25dfdbfc}, 0x14}}, 0x4008800) recvmmsg$unix(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000004d40)=@newtfilter={0xa30, 0x2c, 0x2, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0x5}, {0x1, 0xffe0}, {0xfff1, 0x1}}, [@TCA_CHAIN={0x8, 0xb, 0x1000}, @TCA_CHAIN={0x8, 0xb, 0x503}, @filter_kind_options=@f_flow={{0x9}, {0x84c, 0x2, [@TCA_FLOW_XOR={0x8, 0x7, 0x3d}, @TCA_FLOW_POLICE={0x840, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_RATE={0x404, 0x2, [0xc, 0x401, 0x8, 0x1ff, 0x9, 0xee, 0x100, 0x5, 0x5, 0x8, 0x5, 0xffff, 0x6, 0x400, 0x0, 0x1000, 0xfffffffb, 0x8, 0x647, 0x3, 0x80000001, 0x3fc5, 0x5, 0x9, 0x800, 0xe28, 0x0, 0x4, 0x8, 0xffffff48, 0xc8c5, 0x0, 0x7, 0x8001, 0x0, 0x6, 0x7, 0x1, 0x3, 0x2, 0x2, 0x42d, 0x8, 0xca9, 0x1a3, 0x0, 0x5, 0x1, 0x3, 0x9, 0x6, 0xa9, 0xde000000, 0x1000, 0x4, 0x31c, 0x0, 0xfb6e, 0x5, 0x6b, 0xe, 0x3, 0x7ff, 0xa, 0x1, 0xfc000000, 0x40, 0x3, 0x2, 0xb9, 0x9e6, 0x8, 0x4, 0x1, 0x2, 0x1, 0xffffffa2, 0x8, 0x6, 0xffffffff, 0x1, 0xfffffff1, 0xffff, 0x8, 0xf5e, 0x6e, 0x6, 0x0, 0xffffff01, 0x4, 0x1, 0xffff, 0x80000000, 0x4c, 0x9, 0xcf, 0x6b41, 0xe, 0x0, 0x2571, 0x8, 0xe52, 0x1000, 0x40, 0x91f, 0xe, 0x4, 0xfffffffa, 0x0, 0x101, 0xfffffffb, 0x8, 0x9, 0x0, 0xf8, 0x8, 0x54e, 0x2, 0x80000000, 0x4938, 0x7fff, 0x9, 0x1cdb, 0x8, 0x5, 0x8, 0x800000, 0x101, 0x2, 0x40, 0x85a, 0x1, 0x3, 0x4, 0x401, 0x1, 0x5, 0x6, 0xffffffff, 0x8001, 0x1, 0xfffffffd, 0x4, 0x7, 0x8, 0x2f, 0xa39, 0x6, 0xf0, 0x80, 0x4, 0x8000, 0x7c07, 0x0, 0x2, 0x5, 0x8, 0x80000000, 0x7, 0x8, 0x7, 0x6, 0x7fff, 0x7, 0xf6, 0x7, 0xff, 0x96, 0x5, 0x88, 0x8, 0x9, 0x49, 0x2, 0x0, 0x4, 0x8, 0x10, 0x3, 0xffff, 0x7fff, 0x80, 0x6, 0x7, 0xb4d5, 0x3, 0x5815, 0x3, 0xe, 0x5dab, 0xc, 0x8, 0xc, 0x5, 0x28, 0xffffffff, 0x6, 0x6, 0x6, 0x100, 0x9, 0x3, 0xe, 0x6, 0x5, 0x35bd, 0xc254, 0x2, 0x0, 0x1, 0x2, 0x8, 0x7, 0x6, 0x1, 0x3, 0x3, 0x8, 0x0, 0x1, 0x2a62, 0xffffff81, 0xfffffff8, 0x1, 0xb3d, 0x81, 0x18000000, 0xe, 0xb, 0x6, 0x8, 0x6, 0x6, 0x8, 0x40, 0x8, 0x2, 0x8, 0xf, 0xfff, 0x8, 0x0, 0x4, 0x65, 0x1000, 0x3, 0x5, 0x6, 0xfffffffd, 0x5, 0x4, 0x870, 0xd, 0x0, 0x4, 0x3ff]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1, 0x800, 0x3, 0x8001, 0x6, 0x7, 0xffffff00, 0x9, 0x1000, 0x8, 0xb, 0x80000000, 0x40, 0x3, 0x39, 0x5c1, 0x7, 0x100, 0x0, 0x9, 0x8000, 0x6c, 0x6, 0x9, 0x1ff8000, 0xfffffff9, 0x0, 0x7fffffff, 0x1e4, 0x6, 0x5, 0xd8e, 0x7, 0xc21a, 0x5d4a, 0x6, 0x8000, 0x9, 0x10001, 0x35, 0xff, 0xff, 0x4, 0x8, 0x80000000, 0x4, 0xfffffffe, 0x1ff, 0x6, 0x1, 0x1, 0x40, 0xfffff000, 0x6, 0xffffffff, 0xe, 0x6, 0x4e, 0x6, 0x9, 0x9, 0x8, 0x0, 0x1, 0x2, 0x4, 0x6, 0xea, 0x80, 0xffffff77, 0xff, 0x7f, 0xbe, 0x9, 0xb, 0x80, 0xffc2, 0x80, 0xe3, 0x6, 0x81, 0x8, 0xd, 0xffffff2c, 0xc, 0x80000000, 0x9, 0x1, 0x15d1, 0x7fff, 0x8000, 0x10001, 0x7ff, 0x1, 0x8, 0x4807, 0x4, 0xfffffffd, 0x0, 0x7, 0x800, 0x3, 0x1, 0x0, 0xfffffff7, 0x6, 0x4, 0x9, 0x1, 0x1, 0xffff, 0xffffffff, 0xb7b0, 0x380000, 0x10001, 0x702, 0x1ff, 0x4, 0x0, 0x6, 0x5b, 0x7, 0xd9e, 0x9, 0x5, 0x5, 0x0, 0xfff, 0xffffffff, 0x4, 0x1, 0xa, 0x11, 0x40, 0x10000, 0xffff4010, 0xe9800000, 0x2, 0x1, 0x410e, 0x77f, 0xfffffbbf, 0x88, 0xd, 0xd1, 0xff, 0x7f, 0x3, 0x8, 0x7f, 0x4, 0x2, 0x6, 0x5, 0x8, 0x4, 0xcd9a, 0x800, 0x1d, 0xc, 0xa9, 0x2, 0xd9a, 0x4, 0x4, 0x4, 0x9, 0x0, 0xdfcd, 0x101, 0x0, 0x0, 0x5, 0x8001, 0x80, 0xfffffff7, 0xc, 0x3, 0x9, 0x8f2, 0x0, 0x10, 0x6, 0x5, 0xa8, 0x9, 0x2, 0x65d, 0xfff, 0x58d, 0x0, 0x5, 0x1, 0x7b0f0eac, 0x100, 0xffffffff, 0x4, 0x2e7, 0x5, 0x1, 0xe2, 0x4, 0x7f, 0x2, 0x7, 0x1, 0x400, 0x9d, 0x2, 0x4, 0x8001, 0x9, 0x82, 0xe, 0x9, 0x1ff, 0x8, 0x6, 0x4, 0x4, 0x7, 0x7, 0x0, 0x1, 0x9, 0x78, 0x2ffe, 0xff, 0x9, 0x4, 0x5f, 0x5, 0x800, 0x7f, 0x9, 0x6, 0x7, 0x8000, 0x0, 0xfffffff7, 0x3, 0x8, 0x2, 0x3, 0x40, 0x0, 0x81, 0x7fffffff, 0x800, 0x3e7, 0x1, 0xe, 0x2, 0x8, 0x1, 0x9]}, @TCA_POLICE_RESULT={0x8, 0x5, 0xff}, @TCA_POLICE_RESULT={0x8, 0x5, 0x78f}]}]}}, @TCA_CHAIN={0x8, 0xb, 0x10000}, @TCA_CHAIN={0x8, 0xb, 0xd}, @filter_kind_options=@f_cgroup={{0xb}, {0x188, 0x2, [@TCA_CGROUP_EMATCHES={0x1c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xa9e}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xdfa6}}]}, @TCA_CGROUP_ACT={0x164, 0x1, [@m_xt={0xb0, 0xa, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}]}, {0x75, 0x6, "43eb6a0e24ae2bbd9901cd66e0580f00845152f705235b931248ab301559502bd2478b01d9fd33d9d354979ccaa926b16d7f88d069e21077719ee929b7b8c3fe4b46007c5843c4267a0b89453d0451337081caeeb757d8633f5bd71fa0ee20460f6babb289f68026be65039a63807887fd"}, {0xc, 0x7, {0x5ad198ef153aa5b4, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ct={0xb0, 0x12, 0x0, 0x0, {{0x7}, {0x18, 0x2, 0x0, 0x1, [@TCA_CT_LABELS={0x14, 0x7, "f62059b82fe894327c865b1017a963b7"}]}, {0x71, 0x6, "c3101d392209915c931bfe7a7e67864e99926e5ed6fbc1a92239badd7c0615c4cebe757215ab741e14dc8edceebd6c50d9d268f0ee1e5a00ff56760f2328727139cbfafab9e5826c02db4c1678c52966659a61245aff6f9f33249b07f2888ba05748bd11b119b4a3632338ab3e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}, @TCA_CGROUP_POLICE={0x4}]}}]}, 0xa30}, 0x1, 0x0, 0x0, 0x4000800}, 0x4002) 1.789969057s ago: executing program 3 (id=11755): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois', 0x8) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.686737135s ago: executing program 1 (id=11759): recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=""/156, 0x9c}], 0x1}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), r0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x2c, r1, 0x1, 0x70bd29, 0x7, {}, [@NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40810}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.630759371s ago: executing program 1 (id=11760): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001"], 0x104}, 0x1, 0x0, 0x0, 0xc850}, 0x0) 1.444087589s ago: executing program 4 (id=11764): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg$unix(r0, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/240, 0xf0}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) 1.229253399s ago: executing program 0 (id=11768): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000003c0)='GPL\x00'}, 0x94) sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x400c4) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x140, 0x0) syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0) close(0x4) 1.228039173s ago: executing program 2 (id=11769): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080), &(0x7f0000000100)=0x8) 1.095125848s ago: executing program 2 (id=11770): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a54000000030a0fdb00000000000000000a0060050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f757465000000080005400000000014000000110001"], 0x7c}}, 0x24000840) r1 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x5000, 0x0, @loopback, 0x5}, 0x1c) writev(r1, &(0x7f00000000c0)=[{&(0x7f00000001c0)="2c1e20", 0x3}], 0x1) socket$nl_route(0x10, 0x3, 0x0) 1.041484586s ago: executing program 0 (id=11771): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket$can_bcm(0x1d, 0x2, 0x2) shutdown(0xffffffffffffffff, 0x1) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x100003, {0x0, 0x0, 0x0, r2, {0xb, 0xfff3}, {0x3, 0xfff9}, {0xd}}}, 0x24}}, 0x0) 972.218939ms ago: executing program 2 (id=11772): ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) unshare(0x2c020400) openat$cgroup_ro(r1, &(0x7f0000000000)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) 953.918754ms ago: executing program 4 (id=11773): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f00000002c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002ac0)=@newtfilter={0x840, 0x2c, 0x20, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x3, 0x2}, {0x7, 0xf}, {0xfff2, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x810, 0x2, [@TCA_CGROUP_POLICE={0x80c, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x13, 0x800, 0x4, 0x7, 0x8000, 0x73446b73, 0x7, 0x9, 0x6, 0x0, 0x1, 0x2, 0x7fff, 0x2, 0x5, 0x7, 0x5, 0x6, 0x3, 0xd, 0x2, 0xdc, 0x200, 0x5, 0xfffffff8, 0x401, 0x2, 0x2000, 0x4, 0x9, 0x1, 0x2, 0x48aa, 0xdd3, 0x400, 0x5404, 0x10000, 0x5, 0x4, 0xf, 0x0, 0x8, 0x4, 0x4, 0xffffff2d, 0x5, 0x200, 0x4, 0x7, 0x1d, 0x8, 0x6, 0x7, 0x240000, 0x2, 0x4, 0x1, 0x0, 0x4, 0x8, 0x1, 0x7ff, 0x10, 0x1, 0x9, 0x8, 0xf17b, 0xe3bb, 0x9, 0x4, 0x8, 0x81, 0x9, 0xac26, 0x9, 0x0, 0x5, 0x5, 0x3, 0x3, 0x7fff, 0x9, 0x1, 0x5, 0x7d8, 0xfe, 0x8, 0x2, 0x401, 0x100, 0x1, 0x2, 0x6, 0x5, 0x5dde, 0x3, 0xfe61, 0x9, 0x807f, 0x7, 0x1, 0xfffffffc, 0x4, 0x0, 0x2, 0xd2f, 0x7, 0xf, 0xa, 0x7631, 0x4, 0x80000000, 0x3, 0x3, 0x95c2, 0x5, 0x5, 0x3, 0x2, 0x362b, 0xd, 0x1, 0xc92, 0xfff, 0x375, 0xcb, 0xb, 0xb815, 0x5, 0x9, 0x7, 0x3, 0x33e, 0x3, 0x800, 0x4, 0x0, 0x401, 0x10000, 0x8e, 0x8, 0x7, 0xfffffc01, 0x9, 0xa2, 0x6, 0x7, 0x932, 0x6, 0x6a3, 0x2, 0x6, 0x8, 0x80, 0x8, 0x2, 0x8, 0x7fff, 0x2, 0x4c, 0x2, 0x2c, 0x7, 0x0, 0x1, 0x7fffffff, 0x4d, 0x5a442e5c, 0x400001, 0x10000, 0x8, 0x8, 0x8001, 0x10001, 0xae, 0x7, 0xc8, 0x5, 0x81, 0x6, 0x433, 0x8, 0x2, 0x6, 0x4b25, 0x8001, 0x5, 0x4, 0x8, 0x0, 0x79e, 0x10000, 0x4, 0x7946, 0x8870, 0x100, 0x3, 0x9, 0x1, 0x5, 0x81, 0x3, 0x7ff, 0x8, 0xa2, 0x1, 0x0, 0xd, 0x7, 0x92b, 0x3, 0x8, 0x8, 0x0, 0x400, 0x2, 0x8ff3, 0x0, 0x3, 0x7fffffff, 0x7, 0x4, 0x9, 0xfffffff7, 0x1, 0x4, 0x4, 0x1, 0x7fff, 0x2, 0x9, 0x6, 0x5f9, 0x6, 0x401, 0x0, 0x1, 0x40, 0x2, 0x2f, 0x8, 0x1, 0x80000000, 0x1, 0x4, 0x81, 0x10000, 0x6, 0x92f, 0xb, 0xa3, 0x8, 0x62d4d7a3, 0x2, 0x5]}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x3, 0x7, 0x4, 0x5, 0xfffffffc, 0x1, 0x9, 0x4, 0x4, 0x3, 0x3, 0x200, 0x0, 0x6, 0x3, 0x7, 0x0, 0x5ef, 0x9, 0x6, 0xfffffff8, 0x1, 0x2, 0x0, 0x4, 0x0, 0x5, 0x9, 0x0, 0x42, 0x8, 0x9, 0xe09, 0x800, 0x4, 0x1, 0x7ff, 0x0, 0x6, 0x10001, 0x0, 0x423e573a, 0x9, 0x7, 0x2, 0x1, 0x6, 0x6, 0x9, 0x2, 0xfff, 0x40, 0xffff7fff, 0x2, 0x6dc, 0x9f, 0x7fffffff, 0xa, 0xb, 0xe0000000, 0x3, 0x6, 0xf, 0x3, 0x10, 0x4000000, 0x0, 0x10000, 0x8001, 0x9, 0x3, 0x1, 0x1ff, 0x8d14, 0x401, 0xffff, 0x10000, 0x6, 0x3180, 0x8, 0x8, 0x1f1, 0xffff7fff, 0x8, 0x81, 0x40400, 0x0, 0x2, 0x150, 0x7, 0x9, 0x8, 0x9, 0x9fa0, 0x3, 0xd97c, 0xf, 0x4, 0xd7, 0x2, 0x4, 0x6, 0x7f, 0x6, 0xa, 0x2, 0x97, 0xfffffff8, 0x1, 0x3, 0xa, 0xffffffb5, 0x8, 0x8, 0x7, 0x10, 0x0, 0x990, 0x3, 0xff, 0x400, 0x6, 0x7, 0xfff, 0x400, 0x1, 0x7, 0xc9f, 0x7, 0x0, 0x2, 0x569, 0x9, 0xffffff59, 0x95, 0x2, 0x8, 0x1f0, 0x5, 0x4, 0x7, 0x163025b1, 0xffff, 0x3498, 0x7, 0x5, 0x4d3, 0xffffff0f, 0x8, 0x81c, 0x3, 0x1, 0x1, 0x401, 0xfffffffc, 0x7, 0x6a8, 0x1, 0x8, 0xb, 0x7fffffff, 0x3, 0x7502, 0x0, 0x40, 0x7fffffff, 0x10, 0xde, 0x0, 0x697f, 0xc, 0x2, 0x0, 0x40, 0x3, 0x8, 0xaed, 0x7, 0x12, 0xffffffff, 0x8, 0x7fffffff, 0x9, 0x80000000, 0xffffff98, 0x200, 0x4, 0x6, 0xfffffde1, 0x1, 0xc0c, 0x81, 0x7fffffff, 0x8, 0x9f0, 0x80000001, 0x5, 0xa, 0x8, 0x81, 0x9, 0x1, 0x10001, 0x1, 0xa, 0x80000000, 0xffffac00, 0xb, 0xd31, 0x4, 0x4, 0xaa8b, 0x6, 0x7fff, 0x3bc, 0x10000, 0x3d7b, 0x3c, 0xfffffffc, 0x1b, 0xffffffb3, 0xf, 0x3, 0x2, 0x0, 0x7f, 0x8000, 0x4dd4, 0x2, 0x800, 0x6, 0x1ff, 0x50, 0x109d, 0x10001, 0xe11, 0x1000000, 0x20d, 0xa88, 0x1ff, 0x24f, 0xc, 0x1, 0x100, 0x2, 0x5, 0xbc3d, 0x2, 0xfffffffa, 0x4, 0x2, 0x9, 0x5, 0x1, 0x101]}]}]}}]}, 0x840}, 0x1, 0x0, 0x0, 0x4000}, 0xc050) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) 935.651635ms ago: executing program 3 (id=11774): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="05df25016f00000800010000000000000000", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN={0x8}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 805.827178ms ago: executing program 4 (id=11775): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001800dd8d00000000000000000a00000000000006"], 0x30}}, 0x4090) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0xfeffffff, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800efe000000000000000000a00000000000000000000000c00090008000000", @ANYRES32=0x0, @ANYBLOB="1400050000000000000000000000000000000002"], 0x3c}, 0x1, 0x11}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0x4924b68, 0x0) 779.945499ms ago: executing program 3 (id=11776): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000007c0)=0x42000401, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) listen(r0, 0xb5d6) 778.986983ms ago: executing program 2 (id=11777): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x7ff}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 710.676829ms ago: executing program 0 (id=11778): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[], 0x8) 598.049888ms ago: executing program 3 (id=11779): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x1, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0xe}}]}]}]}, 0x3c}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfe, {0x1d, 0x1, 0x6}, [@CGW_SRC_IF={0x8, 0x9, r3}, @CGW_DST_IF={0x8, 0xa, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) 564.854998ms ago: executing program 0 (id=11780): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x3, 0x1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r3, 0x1, 0x0, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x1, 0x9, 0x0, 0x1}}}}, 0x30}}, 0x0) 482.929751ms ago: executing program 4 (id=11781): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x0, 0xfff2}, {}, {0xa, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x81}]}]}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 427.658953ms ago: executing program 3 (id=11782): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x322, 0x19) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000000)=0x7b, 0x4) recvfrom$inet(r0, 0x0, 0x0, 0x2043, 0x0, 0x0) 426.825368ms ago: executing program 0 (id=11792): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x68, 0x2c, 0xd27, 0x70bd2a, 0x8000002, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_EMATCHES={0x34, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x24, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x4}, {{0x1, 0x0, 0x1}, {0x4, 0x1, 0x1, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0x3}, {0xffffffffffffffff, 0x1, 0x8}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008004}, 0x0) 381.42055ms ago: executing program 2 (id=11783): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd06, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0xe}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x60, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_META={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_LVALUE={0x4}, @TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0xe, 0x1}, {0x5, 0x40}}}]}}]}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x0) 343.773693ms ago: executing program 3 (id=11784): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x8, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x7, 0xa, 0xfffffff3}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newtfilter={0x3c, 0x2c, 0xd2b, 0x803, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x6}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x240440d4) 338.3654ms ago: executing program 1 (id=11785): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) writev(r0, &(0x7f0000000280)=[{&(0x7f00000000c0)="a18d13d2", 0x4}], 0x1) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000d40)=""/4083, 0xff3}], 0x1}, 0xfffffff7}], 0x1, 0x102, 0x0) 224.451098ms ago: executing program 1 (id=11786): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x74, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x7, 0xf}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x44, 0x2, [@TCA_FLOW_EMATCHES={0x40, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x5, 0x7, 0x4c2}, {{0x2}, {0xf0ffff, 0x1, 0x0, 0x1}}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x1fde, 0x3, 0x5}, {0x2, 0x2, 0x2}}}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x24000045}, 0x2008c014) 185.413773ms ago: executing program 4 (id=11787): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) close(0x3) 97.984456ms ago: executing program 4 (id=11788): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x24, r1, 0x1, 0x70bd2c, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_VERSION={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 85.349038ms ago: executing program 2 (id=11789): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) 0s ago: executing program 0 (id=11790): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x38, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r1, {0x5, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x93}]}}]}, 0x38}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): 285.592301][T17405] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5568'. [ 285.825457][T17424] openvswitch: netlink: Multiple metadata blocks provided [ 286.102298][T17445] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5588'. [ 286.361860][T17464] netlink: 'syz.1.5599': attribute type 11 has an invalid length. [ 286.400869][T17464] netlink: 199788 bytes leftover after parsing attributes in process `syz.1.5599'. [ 286.884152][T17502] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5619'. [ 286.905898][T17502] vlan2: entered allmulticast mode [ 286.911321][T17502] gretap0: entered allmulticast mode [ 286.992682][T17450] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 287.050268][T17510] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 287.368143][T17532] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5634'. [ 287.795382][T17562] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 287.817717][T17562] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 288.251960][ T6008] Bluetooth: hci1: command 0x0406 tx timeout [ 288.436636][T17605] Bluetooth: MGMT ver 1.23 [ 288.477128][T17610] netlink: 176 bytes leftover after parsing attributes in process `syz.3.5667'. [ 288.503216][T17610] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5667'. [ 288.665523][T17622] lo speed is unknown, defaulting to 1000 [ 288.804673][T17632] xt_l2tp: wrong L2TP version: 0 [ 289.154864][T17660] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5691'. [ 289.302497][T17669] netlink: 'syz.2.5695': attribute type 1 has an invalid length. [ 289.319076][T17669] netlink: 'syz.2.5695': attribute type 1 has an invalid length. [ 289.400067][T17674] netlink: 'syz.3.5698': attribute type 1 has an invalid length. [ 289.434000][T17674] netlink: 'syz.3.5698': attribute type 3 has an invalid length. [ 289.442828][T17674] netlink: 172 bytes leftover after parsing attributes in process `syz.3.5698'. [ 289.453828][T17674] NCSI netlink: No device for ifindex 813332851 [ 289.580758][T17682] netlink: 'syz.2.5701': attribute type 1 has an invalid length. [ 289.744304][T17691] netlink: 'syz.3.5706': attribute type 1 has an invalid length. [ 289.761569][T17691] netlink: 'syz.3.5706': attribute type 1 has an invalid length. [ 290.210242][T17713] xt_l2tp: unknown flags: 10 [ 290.966075][T17769] Bluetooth: MGMT ver 1.23 [ 291.406415][T17803] __nla_validate_parse: 2 callbacks suppressed [ 291.406436][T17803] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5760'. [ 291.474669][T17807] raw_sendmsg: syz.4.5761 forgot to set AF_INET. Fix it! [ 292.206558][T17858] : entered promiscuous mode [ 292.906033][T17910] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5813'. [ 293.096020][T17924] netlink: 'syz.1.5819': attribute type 3 has an invalid length. [ 293.707884][T17966] syz.4.5839 (17966) used obsolete PPPIOCDETACH ioctl [ 294.336654][T18001] "syz.0.5854" (18001) uses obsolete ecb(arc4) skcipher [ 294.423523][T18015] netlink: 1 bytes leftover after parsing attributes in process `syz.0.5860'. [ 294.735459][T18034] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 294.742842][T18034] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 294.820285][T18038] netlink: 'syz.0.5872': attribute type 2 has an invalid length. [ 294.831021][T18038] netlink: 188 bytes leftover after parsing attributes in process `syz.0.5872'. [ 294.868880][T18040] xt_limit: Overflow, try lower: 271964/0 [ 295.153473][T18062] sctp: [Deprecated]: syz.0.5885 (pid 18062) Use of int in maxseg socket option. [ 295.153473][T18062] Use struct sctp_assoc_value instead [ 295.191091][T18068] veth1_macvtap: default FDB implementation only supports local addresses [ 295.909682][T18120] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5913'. [ 295.939511][T18123] vlan1: entered allmulticast mode [ 295.957418][T18120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5913'. [ 295.967066][T18120] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5913'. [ 296.199516][T18137] Zero length message leads to an empty skb [ 296.323216][T14326] IPVS: starting estimator thread 0... [ 296.443835][T18149] IPVS: using max 30 ests per chain, 72000 per kthread [ 296.741856][T18175] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5935'. [ 296.789766][T18181] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5937'. [ 296.800493][T18181] netlink: 35 bytes leftover after parsing attributes in process `syz.0.5937'. [ 296.823829][T18181] netlink: 'syz.0.5937': attribute type 5 has an invalid length. [ 296.845013][T18181] netlink: 'syz.0.5937': attribute type 6 has an invalid length. [ 296.871876][T18181] netlink: 35 bytes leftover after parsing attributes in process `syz.0.5937'. [ 296.998312][T18190] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5940'. [ 297.262612][T18207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5948'. [ 297.941560][T18255] xt_limit: Overflow, try lower: 604147548/4200216962 [ 298.373188][T18288] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5978'. [ 298.643283][T18305] netlink: 'syz.2.5987': attribute type 32 has an invalid length. [ 298.665657][T18305] netlink: 776 bytes leftover after parsing attributes in process `syz.2.5987'. [ 299.032452][T18332] xt_hashlimit: size too large, truncated to 1048576 [ 300.500677][T18433] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.6049'. [ 301.196926][T18474] netlink: 220 bytes leftover after parsing attributes in process `syz.2.6069'. [ 301.215518][T18474] netlink: 'syz.2.6069': attribute type 2 has an invalid length. [ 301.348188][T18485] vlan2: entered promiscuous mode [ 301.360844][T18485] bridge0: entered promiscuous mode [ 301.898420][T18524] pim6reg527: entered allmulticast mode [ 301.991932][T18529] __nla_validate_parse: 1 callbacks suppressed [ 301.991951][T18529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6095'. [ 302.052669][T18529] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6095'. [ 302.082067][T18529] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6095'. [ 302.808583][T18594] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 303.016962][T18607] IPVS: ip_vs_edit_dest(): server weight less than zero [ 304.667120][T18736] netlink: 'syz.4.6197': attribute type 3 has an invalid length. [ 304.893108][T18755] netlink: 'syz.2.6205': attribute type 83 has an invalid length. [ 305.224248][T18775] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6215'. [ 305.262223][T18778] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 305.438819][T18786] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6221'. [ 305.468697][T18786] tipc: Invalid UDP bearer configuration [ 305.468748][T18786] tipc: Enabling of bearer rejected, failed to enable media [ 305.605677][T18800] xt_l2tp: v2 sid > 0xffff: 1114112 [ 305.717733][T18807] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6232'. [ 305.727059][T18807] netlink: 176 bytes leftover after parsing attributes in process `syz.0.6232'. [ 305.738595][T18807] netlink: 'syz.0.6232': attribute type 5 has an invalid length. [ 306.166397][T18836] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6244'. [ 306.513013][T18860] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6256'. [ 306.611164][T18868] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6259'. [ 306.859399][T18883] syz_tun: entered allmulticast mode [ 306.983830][T18889] lo speed is unknown, defaulting to 1000 [ 307.654440][T18932] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6290'. [ 308.161320][T18962] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6302'. [ 308.477814][T18971] IPVS: Scheduler module ip_vs_sip not found [ 309.051989][T19017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6327'. [ 309.557105][T19060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6346'. [ 309.741455][T19065] Bluetooth: MGMT ver 1.23 [ 309.801572][T19072] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 309.809381][T19072] team0: Device macvlan2 is already an upper device of the team interface [ 310.023217][T19088] tipc: Enabling of bearer rejected, media not registered [ 310.297610][T19105] netlink: 165 bytes leftover after parsing attributes in process `syz.1.6371'. [ 310.554454][T19124] netlink: 216 bytes leftover after parsing attributes in process `syz.2.6380'. [ 310.564515][T19124] netlink: 'syz.2.6380': attribute type 2 has an invalid length. [ 310.665065][T19129] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.796672][T19139] tipc: Enabling of bearer rejected, failed to enable media [ 311.264990][T19174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6402'. [ 311.786166][T19212] tipc: Enabling of bearer rejected, failed to enable media [ 312.036688][T19230] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 312.111289][T19235] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 312.189894][T19239] bond0: left promiscuous mode [ 312.200778][T19239] bond_slave_0: left promiscuous mode [ 312.212949][T19239] bond_slave_1: left promiscuous mode [ 312.223117][T19239] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 312.397396][T19256] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6443'. [ 312.453690][T19256] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6443'. [ 312.682680][T19274] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 312.689357][T19274] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 312.724192][T19274] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 312.730629][T19274] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 312.740034][T19274] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 312.746515][T19274] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 312.755676][T19274] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 313.032123][T19294] tipc: Enabling of bearer rejected, failed to enable media [ 313.252588][T19307] netlink: 252 bytes leftover after parsing attributes in process `syz.0.6466'. [ 313.517336][T19325] sctp: [Deprecated]: syz.1.6476 (pid 19325) Use of int in max_burst socket option deprecated. [ 313.517336][T19325] Use struct sctp_assoc_value instead [ 313.750433][T19343] netlink: 1 bytes leftover after parsing attributes in process `syz.0.6484'. [ 313.760038][T19343] xt_policy: neither incoming nor outgoing policy selected [ 313.936555][T19350] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6487'. [ 314.848518][T19395] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.6509'. [ 314.951272][T19400] netlink: 'syz.0.6512': attribute type 4 has an invalid length. [ 315.160210][T19413] tipc: Started in network mode [ 315.185163][T19413] tipc: Node identity 4, cluster identity 4711 [ 315.194195][T19413] tipc: Node number set to 4 [ 315.858630][T19457] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6539'. [ 315.902176][T19457] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6539'. [ 316.358205][T19477] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6549'. [ 316.504988][T19483] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6552'. [ 317.136806][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.245549][T19519] netlink: 'syz.3.6570': attribute type 2 has an invalid length. [ 317.872213][T19543] netlink: 'syz.0.6581': attribute type 1 has an invalid length. [ 318.118637][T19565] sctp: [Deprecated]: syz.4.6592 (pid 19565) Use of int in max_burst socket option. [ 318.118637][T19565] Use struct sctp_assoc_value instead [ 318.626529][T19600] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6608'. [ 318.689939][T19603] tipc: Enabling of bearer rejected, failed to enable media [ 319.086386][T19634] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6625'. [ 319.164984][T19640] tipc: Enabling of bearer rejected, media not registered [ 319.376212][T19650] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6630'. [ 320.352557][T19704] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 320.513401][T19715] netlink: 'syz.0.6658': attribute type 32 has an invalid length. [ 320.539196][T19715] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6658'. [ 320.596384][T19715] bond3: Setting coupled_control to off (0) [ 320.621407][T19722] netlink: 'syz.2.6659': attribute type 1 has an invalid length. [ 321.035752][T19751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6672'. [ 321.061620][T19751] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6672'. [ 321.430579][T19777] tipc: Invalid UDP bearer configuration [ 321.430627][T19777] tipc: Enabling of bearer rejected, failed to enable media [ 321.535152][T19784] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6689'. [ 321.644322][T19791] atomic_op ffff888056551998 conn xmit_atomic 0000000000000000 [ 321.949328][T19814] nbd: couldn't find device at index 65536 [ 322.020516][T19820] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 322.096819][T19823] net_ratelimit: 1993 callbacks suppressed [ 322.096838][T19823] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 322.166188][T19830] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6712'. [ 322.713387][T19853] sctp: [Deprecated]: syz.3.6723 (pid 19853) Use of struct sctp_assoc_value in delayed_ack socket option. [ 322.713387][T19853] Use struct sctp_sack_info instead [ 322.763519][T19861] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6724'. [ 322.767712][T19853] sctp: [Deprecated]: syz.3.6723 (pid 19853) Use of struct sctp_assoc_value in delayed_ack socket option. [ 322.767712][T19853] Use struct sctp_sack_info instead [ 322.917032][T19867] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6729'. [ 323.429257][T19908] netlink: 'syz.2.6748': attribute type 29 has an invalid length. [ 323.439531][T19908] netlink: 'syz.2.6748': attribute type 29 has an invalid length. [ 323.613677][T19912] syz.0.6751 (19912) used greatest stack depth: 17472 bytes left [ 323.646004][T19921] netlink: 'syz.4.6756': attribute type 1 has an invalid length. [ 323.690910][T19921] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 324.130324][T14326] IPVS: starting estimator thread 0... [ 324.250917][T19953] IPVS: using max 28 ests per chain, 67200 per kthread [ 324.362695][T19966] tipc: Started in network mode [ 324.370380][T19966] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 324.380255][T19966] tipc: Enabling of bearer rejected, failed to enable media [ 324.542405][T19976] __nla_validate_parse: 3 callbacks suppressed [ 324.542425][T19976] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6782'. [ 324.586171][T19976] netlink: 120 bytes leftover after parsing attributes in process `syz.0.6782'. [ 324.613393][T19976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6782'. [ 324.784591][T19993] Cannot find add_set index 46338 as target [ 324.948076][T20004] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6794'. [ 325.057758][T20012] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 325.081260][T20016] netlink: 'syz.3.6801': attribute type 2 has an invalid length. [ 325.671896][T20061] netlink: 100 bytes leftover after parsing attributes in process `syz.2.6819'. [ 325.836862][T20073] pimreg: entered allmulticast mode [ 325.852342][T20075] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6826'. [ 325.946329][T20083] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6829'. [ 326.094540][T20092] netlink: 'syz.4.6832': attribute type 5 has an invalid length. [ 326.359875][T20111] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6842'. [ 326.491921][T20119] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6845'. [ 326.830470][T20146] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6859'. [ 326.849614][T20146] netlink: 'syz.2.6859': attribute type 14 has an invalid length. [ 326.863520][T20146] netlink: 'syz.2.6859': attribute type 13 has an invalid length. [ 326.939781][T20151] netlink: 'syz.0.6862': attribute type 58 has an invalid length. [ 327.356797][T20182] netlink: 'syz.0.6876': attribute type 1 has an invalid length. [ 327.369798][T20182] netlink: 'syz.0.6876': attribute type 2 has an invalid length. [ 327.973900][T20221] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 328.178617][T20238] xt_HMARK: spi-set and port-set can't be combined [ 329.168851][T20310] pim6reg: entered allmulticast mode [ 329.379606][T20319] bond3: Invalid ad_actor_system MAC address. [ 329.390210][T20319] bond3: option ad_actor_system: invalid value (1) [ 329.404390][T20319] bond3 (unregistering): Released all slaves [ 330.278292][T20387] delete_channel: no stack [ 331.901731][T20498] __nla_validate_parse: 9 callbacks suppressed [ 331.901751][T20498] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7010'. [ 332.264763][T20524] xt_hashlimit: size too large, truncated to 1048576 [ 333.102470][T20566] tipc: Started in network mode [ 333.107411][T20566] tipc: Node identity ac141441, cluster identity 4711 [ 333.165600][T20566] tipc: Enabled bearer , priority 10 [ 334.292869][T14327] tipc: Node number set to 2886997057 [ 334.381424][T20657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7070'. [ 334.450801][T20659] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7071'. [ 335.048985][T20705] netlink: 348 bytes leftover after parsing attributes in process `syz.1.7089'. [ 335.315041][T20724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7098'. [ 336.084577][T20775] netlink: 312 bytes leftover after parsing attributes in process `syz.3.7121'. [ 336.244862][T20785] sock: sock_timestamping_bind_phc: sock not bind to device [ 336.283773][T20787] netlink: 52 bytes leftover after parsing attributes in process `syz.2.7128'. [ 336.310200][T20787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7128'. [ 336.319870][T20787] netlink: 52 bytes leftover after parsing attributes in process `syz.2.7128'. [ 336.332733][T20787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7128'. [ 337.318800][T20848] __nla_validate_parse: 1 callbacks suppressed [ 337.318821][T20848] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7158'. [ 337.591285][T20863] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7164'. [ 337.613428][T20864] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7166'. [ 338.165058][T20900] Bluetooth: MGMT ver 1.23 [ 338.915324][T20946] validate_nla: 3 callbacks suppressed [ 338.915344][T20946] netlink: 'syz.4.7204': attribute type 1 has an invalid length. [ 338.930806][T20946] netlink: 96 bytes leftover after parsing attributes in process `syz.4.7204'. [ 338.939785][T20946] netlink: 1 bytes leftover after parsing attributes in process `syz.4.7204'. [ 338.980809][T20946] netlink: 'syz.4.7204': attribute type 1 has an invalid length. [ 338.999019][T20946] netlink: 618 bytes leftover after parsing attributes in process `syz.4.7204'. [ 339.345301][T20963] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7213'. [ 339.493951][T20970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7217'. [ 339.511052][T20970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7217'. [ 339.886439][T20998] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7231'. [ 342.601758][T21157] __nla_validate_parse: 3 callbacks suppressed [ 342.601779][T21157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7310'. [ 343.066565][T21182] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 573 [ 343.102887][T21180] ieee802154 phy1 wpan1: encryption failed: -22 [ 343.641103][T21205] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7332'. [ 343.911942][T21220] netlink: 'syz.0.7339': attribute type 4 has an invalid length. [ 343.930904][T21220] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7339'. [ 344.411611][T21243] netlink: 'syz.3.7350': attribute type 1 has an invalid length. [ 344.424613][T21243] netlink: 236 bytes leftover after parsing attributes in process `syz.3.7350'. [ 344.875502][T21273] vcan1: entered promiscuous mode [ 344.892987][T21273] vcan1: entered allmulticast mode [ 345.013523][T21284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7371'. [ 345.267212][T21302] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 345.464184][T21316] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7385'. [ 345.749976][ T6144] IPVS: starting estimator thread 0... [ 345.841187][T21340] IPVS: using max 28 ests per chain, 67200 per kthread [ 346.383822][T21384] netlink: 'syz.0.7417': attribute type 1 has an invalid length. [ 346.393620][T21384] netlink: 96 bytes leftover after parsing attributes in process `syz.0.7417'. [ 346.404071][T21384] netlink: 'syz.0.7417': attribute type 1 has an invalid length. [ 346.412492][T21384] netlink: 'syz.0.7417': attribute type 8 has an invalid length. [ 346.420443][T21384] netlink: 606 bytes leftover after parsing attributes in process `syz.0.7417'. [ 346.574506][T21393] vlan2: entered promiscuous mode [ 346.586454][T21393] bridge0: entered promiscuous mode [ 346.876048][T21411] nbd: must specify a size in bytes for the device [ 346.920823][T21416] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7434'. [ 347.638288][T21465] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7454'. [ 347.834810][T21478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7460'. [ 347.912719][T21484] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 348.263271][T21501] veth3: entered allmulticast mode [ 348.392121][T21514] tipc: MTU too low for tipc bearer [ 348.862887][T21550] macsec0: entered promiscuous mode [ 348.868298][T21550] macsec0: entered allmulticast mode [ 348.875560][T21550] veth1_macvtap: entered allmulticast mode [ 348.881991][T21550] macsec0: left promiscuous mode [ 348.887197][T21550] macsec0: left allmulticast mode [ 348.893042][T21550] veth1_macvtap: left allmulticast mode [ 349.160983][T21567] netlink: 'syz.0.7503': attribute type 62 has an invalid length. [ 349.489030][T21590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7515'. [ 349.541959][T21590] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7515'. [ 349.903554][T21621] vlan3: entered promiscuous mode [ 349.935271][T21621] geneve1: entered promiscuous mode [ 349.951364][T21621] vlan3: entered allmulticast mode [ 349.964231][T21621] geneve1: entered allmulticast mode [ 350.056743][T21627] xt_policy: too many policy elements [ 350.229873][T21643] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7541'. [ 350.239304][T21643] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7541'. [ 350.428427][T21648] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 350.446207][T21652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7544'. [ 350.456082][T21652] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7544'. [ 350.469735][T21648] bond5 (unregistering): Released all slaves [ 351.142006][T21692] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7563'. [ 351.528832][T21716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7575'. [ 352.213109][T21768] netlink: 'syz.0.7600': attribute type 3 has an invalid length. [ 352.270068][T21770] IPVS: ip_vs_add_dest(): server weight less than zero [ 353.051616][T21825] netlink: 'syz.1.7627': attribute type 1 has an invalid length. [ 353.070285][T21825] __nla_validate_parse: 1 callbacks suppressed [ 353.070304][T21825] netlink: 232 bytes leftover after parsing attributes in process `syz.1.7627'. [ 353.583754][T21850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7639'. [ 353.763022][T21862] netlink: 'syz.3.7645': attribute type 2 has an invalid length. [ 353.768446][T21861] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7644'. [ 353.984991][T21877] veth0_to_bond: entered allmulticast mode [ 354.007780][T21880] netlink: 272 bytes leftover after parsing attributes in process `syz.3.7653'. [ 354.166944][T21890] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7657'. [ 354.846029][T21933] pimreg3: entered allmulticast mode [ 355.615515][T21981] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7701'. [ 355.635205][T21981] netlink: 43 bytes leftover after parsing attributes in process `syz.4.7701'. [ 355.655427][T21981] netlink: 'syz.4.7701': attribute type 5 has an invalid length. [ 355.670789][T21981] netlink: 43 bytes leftover after parsing attributes in process `syz.4.7701'. [ 356.125987][T22016] lo: entered allmulticast mode [ 356.157291][T22016] lo: left allmulticast mode [ 356.345419][T22031] : entered promiscuous mode [ 356.426498][T22036] netlink: 'syz.1.7728': attribute type 11 has an invalid length. [ 356.439150][T22036] netlink: 'syz.1.7728': attribute type 4 has an invalid length. [ 356.447072][T22036] netlink: 199768 bytes leftover after parsing attributes in process `syz.1.7728'. [ 356.608509][T22046] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7734'. [ 357.183816][T22087] netlink: zone id is out of range [ 357.188990][T22087] netlink: zone id is out of range [ 357.194790][T22087] netlink: zone id is out of range [ 357.200003][T22087] netlink: zone id is out of range [ 357.205268][T22087] netlink: zone id is out of range [ 357.217516][T22087] netlink: zone id is out of range [ 357.230917][T22087] netlink: zone id is out of range [ 357.236084][T22087] netlink: zone id is out of range [ 357.260626][T22087] netlink: zone id is out of range [ 357.283483][T22087] netlink: zone id is out of range [ 358.443616][T22167] __nla_validate_parse: 1 callbacks suppressed [ 358.443638][T22167] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.7789'. [ 358.659853][T22181] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.990907][T22202] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7808'. [ 359.011856][T22202] netlink: 176 bytes leftover after parsing attributes in process `syz.2.7808'. [ 359.033003][T22202] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7808'. [ 359.046472][T22207] ip6gre0: Master is either lo or non-ether device [ 359.182275][T22214] sctp: [Deprecated]: syz.2.7812 (pid 22214) Use of struct sctp_assoc_value in delayed_ack socket option. [ 359.182275][T22214] Use struct sctp_sack_info instead [ 359.281076][T22221] tipc: Started in network mode [ 359.286132][T22221] tipc: Node identity ac14140f, cluster identity 5 [ 359.301426][T22221] tipc: New replicast peer: 255.255.255.255 [ 359.318715][T22221] tipc: Enabled bearer , priority 10 [ 359.339671][T22221] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7816'. [ 359.368071][T22221] tipc: Disabling bearer [ 359.667085][T22246] netlink: 'syz.1.7829': attribute type 3 has an invalid length. [ 359.685014][T22246] netlink: 'syz.1.7829': attribute type 1 has an invalid length. [ 359.695848][T22246] netlink: 212 bytes leftover after parsing attributes in process `syz.1.7829'. [ 359.705356][T22246] NCSI netlink: No device for ifindex 813332851 [ 360.055079][T22274] sch_fq: defrate 0 ignored. [ 360.597732][T22304] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7855'. [ 360.711388][T22311] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7859'. [ 360.768759][T22311] hsr_slave_0: left promiscuous mode [ 360.783935][T22313] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7860'. [ 360.810821][T22311] hsr_slave_1: left promiscuous mode [ 361.103630][T22329] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7869'. [ 361.554427][T22364] netlink: 'syz.3.7884': attribute type 1 has an invalid length. [ 363.447392][T22495] net_ratelimit: 44 callbacks suppressed [ 363.447435][T22495] IPVS: dh: TCP 172.20.20.170:0 - no destination available [ 363.750853][T22514] __nla_validate_parse: 6 callbacks suppressed [ 363.750869][T22514] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7954'. [ 363.768659][T22514] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7954'. [ 363.823967][T22517] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7957'. [ 363.898724][T22524] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7960'. [ 364.230560][T22545] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7968'. [ 364.240590][T22545] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7968'. [ 364.256823][T22547] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7967'. [ 364.363304][T22549] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7969'. [ 364.753915][T22581] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7984'. [ 365.119500][T22605] syz.0.7995: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 365.139400][T22605] CPU: 1 UID: 0 PID: 22605 Comm: syz.0.7995 Not tainted syzkaller #0 PREEMPT(full) [ 365.139444][T22605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 365.139475][T22605] Call Trace: [ 365.139484][T22605] [ 365.139494][T22605] dump_stack_lvl+0xe8/0x150 [ 365.139532][T22605] warn_alloc+0x249/0x340 [ 365.139561][T22605] ? stack_trace_save+0xa9/0x100 [ 365.139588][T22605] ? __pfx_warn_alloc+0x10/0x10 [ 365.139622][T22605] ? kasan_save_track+0x4f/0x80 [ 365.139645][T22605] ? kasan_save_track+0x3e/0x80 [ 365.139668][T22605] ? __kasan_kmalloc+0x93/0xb0 [ 365.139692][T22605] ? __kmalloc_cache_noprof+0x31c/0x660 [ 365.139716][T22605] ? xskq_create+0x56/0x170 [ 365.139743][T22605] ? xsk_setsockopt+0x54c/0x990 [ 365.139766][T22605] ? do_sock_setsockopt+0x17c/0x1b0 [ 365.139793][T22605] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 365.139821][T22605] ? do_syscall_64+0x14d/0xf80 [ 365.139856][T22605] __vmalloc_node_range_noprof+0x132/0x1730 [ 365.139916][T22605] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 365.139948][T22605] ? __kasan_kmalloc+0x93/0xb0 [ 365.139981][T22605] vmalloc_user_noprof+0xad/0xe0 [ 365.140006][T22605] ? xskq_create+0xbf/0x170 [ 365.140034][T22605] xskq_create+0xbf/0x170 [ 365.140070][T22605] xsk_init_queue+0x8a/0xe0 [ 365.140101][T22605] xsk_setsockopt+0x54c/0x990 [ 365.140131][T22605] ? __pfx_xsk_setsockopt+0x10/0x10 [ 365.140157][T22605] ? __pfx_aa_sk_perm+0x10/0x10 [ 365.140194][T22605] ? aa_sock_opt_perm+0xff/0x1a0 [ 365.140219][T22605] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 365.140245][T22605] ? __pfx_xsk_setsockopt+0x10/0x10 [ 365.140273][T22605] do_sock_setsockopt+0x17c/0x1b0 [ 365.140307][T22605] __x64_sys_setsockopt+0x13d/0x1b0 [ 365.140346][T22605] do_syscall_64+0x14d/0xf80 [ 365.140376][T22605] ? trace_irq_disable+0x3b/0x150 [ 365.140394][T22605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.140417][T22605] ? clear_bhb_loop+0x40/0x90 [ 365.140445][T22605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.140472][T22605] RIP: 0033:0x7fc471b9c819 [ 365.140496][T22605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.140527][T22605] RSP: 002b:00007fc472988028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 365.140549][T22605] RAX: ffffffffffffffda RBX: 00007fc471e15fa0 RCX: 00007fc471b9c819 [ 365.140565][T22605] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 365.140578][T22605] RBP: 00007fc471c32c91 R08: 0000000000000004 R09: 0000000000000000 [ 365.140591][T22605] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.140604][T22605] R13: 00007fc471e16038 R14: 00007fc471e15fa0 R15: 00007ffe32bd4698 [ 365.140637][T22605] [ 365.423272][T22605] Mem-Info: [ 365.426573][T22605] active_anon:5504 inactive_anon:0 isolated_anon:0 [ 365.426573][T22605] active_file:3204 inactive_file:40089 isolated_file:0 [ 365.426573][T22605] unevictable:768 dirty:333 writeback:0 [ 365.426573][T22605] slab_reclaimable:12397 slab_unreclaimable:104303 [ 365.426573][T22605] mapped:29134 shmem:1355 pagetables:3376 [ 365.426573][T22605] sec_pagetables:0 bounce:0 [ 365.426573][T22605] kernel_misc_reclaimable:0 [ 365.426573][T22605] free:1325086 free_pcp:7393 free_cma:0 [ 365.473034][T22605] Node 0 active_anon:21916kB inactive_anon:0kB active_file:12816kB inactive_file:160156kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116536kB dirty:1332kB writeback:0kB shmem:3884kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12980kB pagetables:13364kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 365.509818][T22605] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 365.543602][T22605] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 365.601162][T22605] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 365.607029][T22605] Node 0 DMA32 free:1347044kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21916kB inactive_anon:0kB active_file:12816kB inactive_file:160156kB unevictable:1536kB writepending:1332kB zspages:0kB present:3129332kB managed:2552564kB mlocked:0kB bounce:0kB free_pcp:29628kB local_pcp:12984kB free_cma:0kB [ 365.641474][T22605] lowmem_reserve[]: 0 0 0 0 0 [ 365.646248][T22605] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:872kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 365.676207][T22605] lowmem_reserve[]: 0 0 0 0 0 [ 365.681213][T22605] Node 1 Normal free:3937812kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 365.713745][T22605] lowmem_reserve[]: 0 0 0 0 0 [ 365.718521][T22605] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 365.731857][T22605] Node 0 DMA32: 3695*4kB (UME) 3391*8kB (UM) 2063*16kB (UM) 625*32kB (UM) 623*64kB (UME) 654*128kB (UME) 516*256kB (UM) 320*512kB (U) 129*1024kB (UM) 22*2048kB (UME) 160*4096kB (UM) = 1346948kB [ 365.753040][T22605] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 365.816591][T22619] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7999'. [ 365.853743][T22605] Node 1 Normal: 1*4kB (U) 6*8kB (UM) 6*16kB (UM) 8*32kB (UM) 12*64kB (UM) 7*128kB (UM) 2*256kB (M) 2*512kB (M) 2*1024kB (UM) 2*2048kB (U) 959*4096kB (M) = 3937812kB [ 365.910335][T22605] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 365.936461][T22605] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 365.963241][T22605] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 366.003063][T22605] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 366.070852][T22605] 45669 total pagecache pages [ 366.081156][T22605] 0 pages in swap cache [ 366.085346][T22605] Free swap = 124996kB [ 366.089518][T22605] Total swap = 124996kB [ 366.131740][T22605] 2097051 pages RAM [ 366.135602][T22605] 0 pages HighMem/MovableOnly [ 366.140298][T22605] 427077 pages reserved [ 366.157502][T22605] 0 pages cma reserved [ 366.392016][T22649] netlink: 'syz.0.8014': attribute type 3 has an invalid length. [ 366.399813][T22649] netlink: 'syz.0.8014': attribute type 3 has an invalid length. [ 367.258951][T22715] tipc: New replicast peer: 255.255.255.255 [ 367.268423][T22715] tipc: Enabled bearer , priority 10 [ 367.790397][T22754] netlink: 'syz.4.8061': attribute type 4 has an invalid length. [ 368.258276][T22781] netlink: 'syz.1.8075': attribute type 1 has an invalid length. [ 368.266197][T14327] tipc: Node number set to 2886997007 [ 368.943955][T22821] __nla_validate_parse: 10 callbacks suppressed [ 368.943972][T22821] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8093'. [ 369.217281][T22842] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8105'. [ 369.402247][T22854] netlink: 27 bytes leftover after parsing attributes in process `syz.3.8110'. [ 369.513004][T22863] blkio.reset_stats is deprecated [ 369.610586][T22872] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8119'. [ 369.634212][T22868] netlink: 'syz.1.8117': attribute type 1 has an invalid length. [ 369.655226][T22868] netlink: 'syz.1.8117': attribute type 7 has an invalid length. [ 369.690935][T22868] netlink: 'syz.1.8117': attribute type 8 has an invalid length. [ 369.698721][T22868] netlink: 208 bytes leftover after parsing attributes in process `syz.1.8117'. [ 369.733069][T22868] NCSI netlink: No device for ifindex 65584 [ 370.273000][T22901] netlink: 'syz.3.8134': attribute type 6 has an invalid length. [ 370.300473][T22903] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8133'. [ 370.572656][T22919] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8141'. [ 370.977064][T22948] Bluetooth: hci1: too big key_count value 32778 [ 371.184866][T22962] syz_tun: left allmulticast mode [ 371.696938][T22993] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8175'. [ 372.320154][T23020] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8187'. [ 372.378416][T23020] ipvlan2: entered allmulticast mode [ 372.401067][T23020] syz_tun: entered allmulticast mode [ 372.540472][T23032] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8193'. [ 372.988666][T23058] netlink: 'syz.0.8205': attribute type 8 has an invalid length. [ 374.429179][T23164] netlink: 'syz.0.8254': attribute type 1 has an invalid length. [ 374.450762][T23164] __nla_validate_parse: 3 callbacks suppressed [ 374.450781][T23164] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8254'. [ 374.769495][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.818022][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.848903][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.870227][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.894541][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.913766][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 374.922281][T23190] netlink: 'syz.3.8268': attribute type 29 has an invalid length. [ 375.038501][T23205] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8275'. [ 375.117953][T23209] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.8277'. [ 375.774688][T23249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8294'. [ 375.791544][T23252] netlink: 64 bytes leftover after parsing attributes in process `syz.1.8293'. [ 376.059953][T23263] netlink: 'syz.3.8300': attribute type 5 has an invalid length. [ 376.326236][T23278] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8307'. [ 377.300290][T23260] syz.0.8299 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 377.398214][T23260] CPU: 1 UID: 0 PID: 23260 Comm: syz.0.8299 Not tainted syzkaller #0 PREEMPT(full) [ 377.398244][T23260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 377.398256][T23260] Call Trace: [ 377.398265][T23260] [ 377.398273][T23260] dump_stack_lvl+0xe8/0x150 [ 377.398307][T23260] dump_header+0xd3/0x4c0 [ 377.398335][T23260] oom_kill_process+0x3ab/0x970 [ 377.398363][T23260] out_of_memory+0x106c/0x1410 [ 377.398385][T23260] ? percpu_ref_put+0x19/0x180 [ 377.398413][T23260] ? __pfx___mutex_lock+0x10/0x10 [ 377.398451][T23260] ? __pfx_out_of_memory+0x10/0x10 [ 377.398471][T23260] ? do_raw_spin_unlock+0xf5/0x210 [ 377.398503][T23260] try_charge_memcg+0xc53/0x1560 [ 377.398548][T23260] ? __pfx_try_charge_memcg+0x10/0x10 [ 377.398578][T23260] ? get_mem_cgroup_from_mm+0x38/0x290 [ 377.398614][T23260] ? get_mem_cgroup_from_mm+0x38/0x290 [ 377.398641][T23260] ? get_mem_cgroup_from_mm+0x38/0x290 [ 377.398670][T23260] ? get_mem_cgroup_from_mm+0x1b2/0x290 [ 377.398699][T23260] __mem_cgroup_charge+0xab/0x1e0 [ 377.398724][T23260] filemap_add_folio+0x152/0x530 [ 377.398759][T23260] __filemap_get_folio_mpol+0x500/0xb00 [ 377.398792][T23260] filemap_fault+0x9ac/0x1320 [ 377.398825][T23260] ? __pfx_filemap_fault+0x10/0x10 [ 377.398851][T23260] ? __pfx_filemap_map_pages+0x10/0x10 [ 377.398886][T23260] __do_fault+0x138/0x390 [ 377.398911][T23260] do_pte_missing+0x228f/0x3490 [ 377.398932][T23260] ? do_pte_missing+0x130a/0x3490 [ 377.398964][T23260] ? handle_mm_fault+0xee/0x3310 [ 377.398997][T23260] handle_mm_fault+0x1bec/0x3310 [ 377.399041][T23260] ? handle_mm_fault+0xee/0x3310 [ 377.399077][T23260] ? __pfx_handle_mm_fault+0x10/0x10 [ 377.399105][T23260] ? lock_vma_under_rcu+0x45a/0x500 [ 377.399153][T23260] do_user_addr_fault+0xa73/0x1340 [ 377.399186][T23260] ? rcu_is_watching+0x15/0xb0 [ 377.399214][T23260] ? trace_page_fault_user+0x84/0x210 [ 377.399241][T23260] exc_page_fault+0x6a/0xc0 [ 377.399268][T23260] asm_exc_page_fault+0x26/0x30 [ 377.399286][T23260] RIP: 0033:0x7fc471b6a514 [ 377.399304][T23260] Code: 74 5f 40 c5 fe 6f 66 60 c5 dd 74 67 60 c5 ed db e9 c5 dd db f3 c5 cd db fd c5 fd d7 cf ff c1 75 78 eb 11 0f 1f 00 f3 0f bc c0 <0f> b6 0c 06 0f b6 04 07 29 c8 0f 01 d6 75 04 c5 f8 77 c3 c5 fc 77 [ 377.399321][T23260] RSP: 002b:00007ffe32bd4728 EFLAGS: 00010202 [ 377.399338][T23260] RAX: 0000000000000002 RBX: 00007fc472945720 RCX: 0000000000003d74 [ 377.399351][T23260] RDX: 0000000000000fac RSI: 0000001b3432028c RDI: 0000001b34323738 [ 377.399363][T23260] RBP: 0000001b3432028c R08: 00000000005ffde8 R09: 0000000000000006 [ 377.399375][T23260] R10: 0000001b33d24218 R11: 000000000000000c R12: 0000000000003d68 [ 377.399386][T23260] R13: 00000000000008c8 R14: 0000001b33d2421c R15: 0000001b33d24218 [ 377.399416][T23260] [ 377.399424][T23260] memory: usage 307200kB, limit 307200kB, failcnt 587 [ 377.843581][T23260] memory+swap: usage 307392kB, limit 9007199254740988kB, failcnt 0 [ 377.885738][T23260] kmem: usage 307200kB, limit 9007199254740988kB, failcnt 0 [ 377.900235][T23260] Memory cgroup stats for /syz0: [ 377.900465][T23260] cache 0 [ 377.918147][T23260] rss 0 [ 377.921157][T23260] rss_huge 0 [ 377.924375][T23260] shmem 0 [ 377.927326][T23260] mapped_file 0 [ 377.945609][T23260] dirty 0 [ 377.948735][T23260] writeback 0 [ 377.970796][T23260] workingset_refault_anon 3 [ 377.975334][T23260] workingset_refault_file 80 [ 377.996911][T23260] swap 196608 [ 378.005879][T23260] swapcached 208896 [ 378.019900][T23260] pgpgin 70496 [ 378.028991][T23260] pgpgout 70496 [ 378.043559][T23260] pgfault 183011 [ 378.054961][T23260] pgmajfault 9 [ 378.066144][T23260] inactive_anon 0 [ 378.078642][T23260] active_anon 0 [ 378.089985][T23260] inactive_file 0 [ 378.102159][T23260] active_file 0 [ 378.114584][T23260] unevictable 0 [ 378.126759][T23260] hierarchical_memory_limit 314572800 [ 378.143476][T23260] hierarchical_memsw_limit 9223372036854771712 [ 378.165567][T23260] total_cache 0 [ 378.177971][T23260] total_rss 0 [ 378.189884][T23260] total_rss_huge 0 [ 378.206135][T23260] total_shmem 0 [ 378.215194][T23260] total_mapped_file 0 [ 378.228544][T23260] total_dirty 0 [ 378.240468][T23260] total_writeback 0 [ 378.253475][T23260] total_workingset_refault_anon 3 [ 378.273111][T23260] total_workingset_refault_file 80 [ 378.290024][T23260] total_swap 196608 [ 378.304222][T23260] total_swapcached 208896 [ 378.318571][T23260] total_pgpgin 70496 [ 378.339750][T23260] total_pgpgout 70496 [ 378.373135][T23260] total_pgfault 183011 [ 378.377243][T23260] total_pgmajfault 9 [ 378.387110][T23260] total_inactive_anon 0 [ 378.417408][T23260] total_active_anon 0 [ 378.427554][T23341] netlink: 68 bytes leftover after parsing attributes in process `syz.4.8338'. [ 378.440719][T23260] total_inactive_file 0 [ 378.444916][T23260] total_active_file 0 [ 378.448921][T23260] total_unevictable 0 [ 378.481036][T23260] anon_cost 0 [ 378.484352][T23260] file_cost 0 [ 378.487683][T23260] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/ [ 378.497428][T23346] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.8340'. [ 378.503212][T23260] ,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.8299,pid=23260,uid=0 [ 378.569355][T23260] Memory cgroup out of memory: Killed process 23260 (syz.0.8299) total-vm:104336kB, anon-rss:1240kB, file-rss:22344kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 378.596338][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.771652][T23352] IPv6: NLM_F_REPLACE set, but no existing node found! [ 379.057488][T23366] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8349'. [ 379.094227][T23366] xfrm1: entered promiscuous mode [ 379.106793][T23366] xfrm1: entered allmulticast mode [ 379.136001][T23366] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8349'. [ 379.643141][T23393] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8362'. [ 379.719436][T23397] tipc: New replicast peer: 255.255.255.255 [ 379.749749][T23397] tipc: Enabled bearer , priority 10 [ 380.129919][T23423] netlink: 'syz.1.8377': attribute type 5 has an invalid length. [ 380.251275][T23425] netlink: 'syz.0.8378': attribute type 21 has an invalid length. [ 380.280879][T23425] netlink: 128 bytes leftover after parsing attributes in process `syz.0.8378'. [ 380.290030][T23425] netlink: 'syz.0.8378': attribute type 4 has an invalid length. [ 380.344146][T23425] netlink: 'syz.0.8378': attribute type 5 has an invalid length. [ 380.353547][T23434] netlink: 'syz.0.8378': attribute type 21 has an invalid length. [ 380.353568][T23434] netlink: 128 bytes leftover after parsing attributes in process `syz.0.8378'. [ 380.392086][T23433] sctp: [Deprecated]: syz.2.8381 (pid 23433) Use of int in max_burst socket option deprecated. [ 380.392086][T23433] Use struct sctp_assoc_value instead [ 380.408286][T23425] netlink: 3 bytes leftover after parsing attributes in process `syz.0.8378'. [ 380.460803][T23434] netlink: 'syz.0.8378': attribute type 4 has an invalid length. [ 380.494443][T23434] netlink: 'syz.0.8378': attribute type 5 has an invalid length. [ 380.530768][T23434] netlink: 3 bytes leftover after parsing attributes in process `syz.0.8378'. [ 380.604143][T23444] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8387'. [ 380.645015][T23444] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8387'. [ 380.750614][T23452] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8390'. [ 380.871051][T14310] tipc: Node number set to 1 [ 381.458094][T23493] sctp: [Deprecated]: syz.1.8410 (pid 23493) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.458094][T23493] Use struct sctp_sack_info instead [ 382.365634][T23559] bridge0: port 3(syz_tun) entered blocking state [ 382.374257][T23559] bridge0: port 3(syz_tun) entered disabled state [ 382.386134][T23559] syz_tun: entered promiscuous mode [ 382.642235][T23571] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8447'. [ 382.654674][T23573] netlink: 7 bytes leftover after parsing attributes in process `syz.1.8446'. [ 382.689026][T23573] erspan0: entered promiscuous mode [ 383.788243][ T58] tipc: Subscription rejected, illegal request [ 384.000014][T23653] netlink: 'syz.2.8484': attribute type 21 has an invalid length. [ 384.135952][T23662] sctp: [Deprecated]: syz.4.8489 (pid 23662) Use of int in maxseg socket option. [ 384.135952][T23662] Use struct sctp_assoc_value instead [ 384.297443][T23670] xt_hashlimit: size too large, truncated to 1048576 [ 384.639646][T23692] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 384.904884][T23706] netlink: 'syz.3.8509': attribute type 83 has an invalid length. [ 384.913742][T23708] __nla_validate_parse: 7 callbacks suppressed [ 384.913759][T23708] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8510'. [ 384.946017][T23708] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8510'. [ 385.211431][T23726] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8519'. [ 385.220357][T23726] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 385.243218][T23726] netlink: 184 bytes leftover after parsing attributes in process `syz.0.8519'. [ 385.468905][T23744] macvtap1: entered allmulticast mode [ 385.511053][T23744] veth0_macvtap: entered allmulticast mode [ 385.712778][T23759] netlink: 'syz.3.8535': attribute type 1 has an invalid length. [ 385.720582][T23759] netlink: 'syz.3.8535': attribute type 2 has an invalid length. [ 385.746843][T23759] netlink: 'syz.3.8535': attribute type 1 has an invalid length. [ 385.857669][T23769] vcan0: tx address claim with dest, not broadcast [ 386.145148][T23790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8548'. [ 386.273855][T23798] veth0: entered promiscuous mode [ 386.280411][T23796] veth0: left promiscuous mode [ 386.532861][T23811] netlink: 'syz.2.8559': attribute type 9 has an invalid length. [ 386.735634][T23826] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8565'. [ 386.864010][T23834] netlink: 'syz.4.8567': attribute type 11 has an invalid length. [ 386.894107][T23836] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8570'. [ 386.910376][T23836] ipvlan2: entered allmulticast mode [ 386.918793][T23839] netlink: 236 bytes leftover after parsing attributes in process `syz.2.8571'. [ 386.928239][T23836] syz_tun: entered allmulticast mode [ 386.934767][T23839] netlink: 236 bytes leftover after parsing attributes in process `syz.2.8571'. [ 388.272288][T23921] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8609'. [ 388.924147][T23971] netlink: 'syz.3.8632': attribute type 4 has an invalid length. [ 389.643010][T24013] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 389.951320][T24036] __nla_validate_parse: 3 callbacks suppressed [ 389.951340][T24036] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8663'. [ 390.125963][T24048] netlink: 'syz.3.8667': attribute type 1 has an invalid length. [ 390.970133][T24103] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8692'. [ 391.298638][T24129] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8706'. [ 392.266889][T24195] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.8738'. [ 394.704342][T24343] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8804'. [ 395.133049][ T6008] block nbd0: Receive control failed (result -32) [ 395.911168][T24412] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.8834'. [ 396.034331][T24420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8840'. [ 396.099571][T24420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8840'. [ 396.407702][T24447] netlink: 'syz.0.8850': attribute type 51 has an invalid length. [ 396.439044][T24449] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8852'. [ 397.803840][T24532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8890'. [ 398.065588][T24548] netlink: 'syz.4.8900': attribute type 1 has an invalid length. [ 398.088298][T24548] netlink: 'syz.4.8900': attribute type 2 has an invalid length. [ 398.121161][T24548] netlink: 'syz.4.8900': attribute type 1 has an invalid length. [ 398.128930][T24548] netlink: 'syz.4.8900': attribute type 3 has an invalid length. [ 398.146083][T24548] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8900'. [ 398.919283][T24606] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8924'. [ 398.962583][T24614] netlink: 52 bytes leftover after parsing attributes in process `syz.1.8928'. [ 399.032356][T24618] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8930'. [ 399.068180][T24618] bond0: entered promiscuous mode [ 399.084087][T24618] bond_slave_0: entered promiscuous mode [ 399.093482][T24618] bond_slave_1: entered promiscuous mode [ 399.121418][T24618] bond0: left promiscuous mode [ 399.126696][T24618] bond_slave_0: left promiscuous mode [ 399.133586][T24618] bond_slave_1: left promiscuous mode [ 399.151167][T24625] netlink: 'syz.2.8934': attribute type 10 has an invalid length. [ 399.200295][T24625] team0: Port device dummy0 added [ 399.423561][T24642] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8942'. [ 399.436766][T24640] tipc: New replicast peer: 255.255.255.255 [ 399.454068][T24640] tipc: Enabled bearer , priority 10 [ 399.790215][T24666] netlink: 'syz.2.8954': attribute type 14 has an invalid length. [ 401.033729][T24755] netlink: 'syz.3.8995': attribute type 2 has an invalid length. [ 401.119896][T24764] __nla_validate_parse: 2 callbacks suppressed [ 401.119917][T24764] netlink: 88 bytes leftover after parsing attributes in process `syz.2.9001'. [ 401.519290][T24792] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9014'. [ 401.922630][ T6008] block nbd1: Receive control failed (result -32) [ 402.045760][T24832] netlink: 248 bytes leftover after parsing attributes in process `syz.4.9032'. [ 402.445481][T24861] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9047'. [ 403.048660][T24904] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9067'. [ 403.160019][T24909] netlink: 'syz.1.9069': attribute type 25 has an invalid length. [ 403.186000][T24909] netlink: 'syz.1.9069': attribute type 28 has an invalid length. [ 403.353532][T24924] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9076'. [ 403.631152][T24941] netlink: 'syz.0.9086': attribute type 4 has an invalid length. [ 403.678643][T24949] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9088'. [ 403.920506][T24966] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9097'. [ 404.145092][T24982] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9103'. [ 404.368875][T24995] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.628892][T25017] netlink: 96 bytes leftover after parsing attributes in process `syz.2.9119'. [ 404.945052][T25038] netlink: 'syz.0.9128': attribute type 3 has an invalid length. [ 406.171055][T25127] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 406.334112][T25141] netlink: 'syz.4.9179': attribute type 10 has an invalid length. [ 406.348641][T25141] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 406.361868][T25141] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 406.638949][T25159] __nla_validate_parse: 6 callbacks suppressed [ 406.638970][T25159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9188'. [ 406.737093][T25165] netem: incorrect gi model size [ 406.825203][T25171] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9193'. [ 406.950090][T25178] h: entered promiscuous mode [ 407.139634][T25193] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9204'. [ 407.204620][T25193] macvtap2: entered promiscuous mode [ 407.210100][T25193] vlan0: entered promiscuous mode [ 407.215760][T25193] macvtap2: entered allmulticast mode [ 407.223920][T25193] vlan0: entered allmulticast mode [ 407.229121][T25193] veth0_vlan: entered allmulticast mode [ 407.403632][T25208] veth0_to_team: entered allmulticast mode [ 407.532174][T25210] nbd2: detected capacity change from 0 to 127 [ 407.544307][ T6008] block nbd2: Receive control failed (result -32) [ 407.568188][T25217] block nbd2: Dead connection, failed to find a fallback [ 407.576256][T25217] block nbd2: shutting down sockets [ 407.582376][T25217] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.593082][T25217] Buffer I/O error on dev nbd2, logical block 0, async page read [ 407.601056][T25217] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.611054][T25217] Buffer I/O error on dev nbd2, logical block 1, async page read [ 407.618958][T25217] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.650113][T25217] Buffer I/O error on dev nbd2, logical block 2, async page read [ 407.658311][T25217] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.668856][T25217] Buffer I/O error on dev nbd2, logical block 3, async page read [ 407.676815][T25217] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.686522][T25217] Buffer I/O error on dev nbd2, logical block 0, async page read [ 407.695770][T25217] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.706446][T25217] Buffer I/O error on dev nbd2, logical block 1, async page read [ 407.714470][T25217] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.724454][T25217] Buffer I/O error on dev nbd2, logical block 2, async page read [ 407.733794][T25217] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.757040][T25217] Buffer I/O error on dev nbd2, logical block 3, async page read [ 407.766242][T25217] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.776532][T25217] Buffer I/O error on dev nbd2, logical block 0, async page read [ 407.784660][T25217] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 407.805600][T25217] Buffer I/O error on dev nbd2, logical block 1, async page read [ 407.817593][T25217] ldm_validate_partition_table(): Disk read failed. [ 407.828697][T25217] Dev nbd2: unable to read RDB block 0 [ 407.838085][T25217] nbd2: unable to read partition table [ 407.866632][T25217] ldm_validate_partition_table(): Disk read failed. [ 407.873906][T25217] Dev nbd2: unable to read RDB block 0 [ 407.880087][T25217] nbd2: unable to read partition table [ 408.298570][T25248] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 408.383060][T25256] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9233'. [ 408.664788][T25279] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9241'. [ 408.697349][T25281] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9245'. [ 408.709046][T25282] veth0: entered promiscuous mode [ 408.723984][T25278] veth0: left promiscuous mode [ 409.053242][T25304] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9255'. [ 409.095591][T25304] netlink: 'syz.4.9255': attribute type 1 has an invalid length. [ 409.112094][T25304] netlink: 'syz.4.9255': attribute type 2 has an invalid length. [ 409.271704][T25316] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.9259'. [ 409.935893][T25367] netem: incorrect ge model size [ 410.313340][T25391] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9295'. [ 410.339184][T25394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9294'. [ 410.989727][T25440] netlink: 'syz.2.9318': attribute type 19 has an invalid length. [ 411.537611][T25476] vlan0: entered allmulticast mode [ 411.555719][T25476] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 411.967613][T25507] TCP: TCP_TX_DELAY enabled [ 412.726518][T25556] block nbd3: Unsupported socket: should be TCP or UNIX. [ 412.822167][T25561] __nla_validate_parse: 4 callbacks suppressed [ 412.822186][T25561] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9373'. [ 413.071591][T25578] netlink: 'syz.4.9381': attribute type 11 has an invalid length. [ 413.077007][T25576] netlink: 'syz.3.9379': attribute type 17 has an invalid length. [ 413.103866][T25576] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9379'. [ 413.123024][T25576] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9379'. [ 413.223154][T25576] gretap0: entered promiscuous mode [ 413.238408][T25576] gretap0: left promiscuous mode [ 413.246028][T25584] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9385'. [ 413.417326][T25596] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9389'. [ 413.442115][T25596] block nbd0: Unsupported socket: should be TCP or UNIX. [ 413.542881][T25598] tap0: tun_chr_ioctl cmd 1074025672 [ 413.568740][T25598] tap0: ignored: set checksum disabled [ 413.712179][T25613] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 413.837277][T25621] macvlan0: entered promiscuous mode [ 413.998824][T25633] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9408'. [ 414.333248][T25655] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9419'. [ 414.454917][T25664] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.9423'. [ 414.761276][T25684] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.9433'. [ 414.863527][T25694] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.9437'. [ 414.874799][T25694] netlink: ct family unspecified [ 414.881649][T25691] syzkaller1: entered promiscuous mode [ 414.901195][T25691] syzkaller1: entered allmulticast mode [ 414.922207][T25691] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 415.384330][T25726] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 415.396427][T25726] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 415.415884][T25726] gretap2: entered promiscuous mode [ 415.428374][T25726] gretap2: entered allmulticast mode [ 415.454089][T25731] netlink: 'syz.0.9455': attribute type 63 has an invalid length. [ 415.472488][T25731] netlink: 'syz.0.9455': attribute type 63 has an invalid length. [ 415.680609][T25745] netlink: 'syz.0.9462': attribute type 1 has an invalid length. [ 415.846078][T25755] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 416.416048][T25790] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.601802][T25790] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 417.065547][T25823] netlink: 'syz.3.9500': attribute type 1 has an invalid length. [ 417.244225][T25834] sctp: [Deprecated]: syz.3.9505 (pid 25834) Use of int in max_burst socket option deprecated. [ 417.244225][T25834] Use struct sctp_assoc_value instead [ 417.639298][T25858] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 417.884112][T25879] __nla_validate_parse: 5 callbacks suppressed [ 417.884132][T25879] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.9525'. [ 418.303344][T25903] netlink: 27 bytes leftover after parsing attributes in process `syz.2.9536'. [ 418.381594][T25905] netlink: 68 bytes leftover after parsing attributes in process `syz.3.9537'. [ 418.594657][T25921] netlink: 'syz.3.9542': attribute type 17 has an invalid length. [ 418.602868][T25921] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9542'. [ 418.612429][T25921] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9542'. [ 418.810283][T25932] syzkaller1: entered promiscuous mode [ 418.838159][T25932] syzkaller1: entered allmulticast mode [ 419.566311][T25981] netlink: 156 bytes leftover after parsing attributes in process `syz.1.9567'. [ 419.927325][T26004] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9575'. [ 419.980581][T26006] veth0: entered promiscuous mode [ 419.998772][T26008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9577'. [ 420.022160][T26005] veth0: left promiscuous mode [ 420.680921][T26035] nbd3: detected capacity change from 0 to 63 [ 420.697417][ T51] block nbd3: Receive control failed (result -32) [ 420.704567][ T6008] block nbd3: Receive control failed (result -32) [ 420.715465][T25900] block nbd3: Dead connection, failed to find a fallback [ 420.723866][T25900] block nbd3: shutting down sockets [ 420.729160][T25900] blk_print_req_error: 138 callbacks suppressed [ 420.729175][T25900] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.745546][T25900] buffer_io_error: 138 callbacks suppressed [ 420.745562][T25900] Buffer I/O error on dev nbd3, logical block 0, async page read [ 420.760044][T25900] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.769803][T25900] Buffer I/O error on dev nbd3, logical block 1, async page read [ 420.777854][T25900] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.787588][T25900] Buffer I/O error on dev nbd3, logical block 2, async page read [ 420.795682][T25900] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.807808][T25900] Buffer I/O error on dev nbd3, logical block 3, async page read [ 420.825329][T25900] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.835249][T25900] Buffer I/O error on dev nbd3, logical block 0, async page read [ 420.843330][T25900] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.854806][T25900] Buffer I/O error on dev nbd3, logical block 1, async page read [ 420.869866][T25900] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.890077][T25900] Buffer I/O error on dev nbd3, logical block 2, async page read [ 420.908300][T25900] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.959965][T25900] Buffer I/O error on dev nbd3, logical block 3, async page read [ 420.971781][T26053] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9596'. [ 420.993497][T25900] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 421.010909][T26053] block nbd4: Unsupported socket: should be TCP or UNIX. [ 421.028629][T25900] Buffer I/O error on dev nbd3, logical block 0, async page read [ 421.070283][T25900] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 421.099000][T25900] Buffer I/O error on dev nbd3, logical block 1, async page read [ 421.141471][T25900] ldm_validate_partition_table(): Disk read failed. [ 421.153226][T26066] xt_hashlimit: size too large, truncated to 1048576 [ 421.171445][T25900] Dev nbd3: unable to read RDB block 0 [ 421.177641][T25900] nbd3: unable to read partition table [ 421.239817][T25900] ldm_validate_partition_table(): Disk read failed. [ 421.273641][T25900] Dev nbd3: unable to read RDB block 0 [ 421.298389][T25900] nbd3: unable to read partition table [ 421.419332][T26080] netlink: 'syz.0.9605': attribute type 4 has an invalid length. [ 421.932917][T26113] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9620'. [ 421.946690][T26113] bond0: ARP target 8.4.0.0 is already present [ 421.953719][T26110] block nbd4: NBD_DISCONNECT [ 421.964428][T26113] bond0: option arp_ip_target: invalid value (1032) [ 422.017980][T26115] netlink: 'syz.1.9621': attribute type 29 has an invalid length. [ 422.029406][T26115] netlink: 'syz.1.9621': attribute type 29 has an invalid length. [ 422.039074][T26115] unsupported nla_type 58 [ 422.434471][T26139] block nbd0: Unsupported socket: should be TCP or UNIX. [ 424.385318][T26256] __nla_validate_parse: 6 callbacks suppressed [ 424.385339][T26256] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9687'. [ 424.544431][T26265] netlink: 88 bytes leftover after parsing attributes in process `syz.1.9692'. [ 425.105258][T26302] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 425.323942][T26313] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.9713'. [ 425.706412][T26340] syzkaller1: entered promiscuous mode [ 426.653434][T26389] sctp: [Deprecated]: syz.2.9738 (pid 26389) Use of struct sctp_assoc_value in delayed_ack socket option. [ 426.653434][T26389] Use struct sctp_sack_info instead [ 426.708586][T26395] netlink: 'syz.1.9741': attribute type 1 has an invalid length. [ 426.727145][T26395] netlink: 136 bytes leftover after parsing attributes in process `syz.1.9741'. [ 426.757898][T26395] netlink: 'syz.1.9741': attribute type 1 has an invalid length. [ 426.777320][T26395] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9741'. [ 427.089239][T26419] syzkaller1: entered promiscuous mode [ 427.102197][T26419] syzkaller1: entered allmulticast mode [ 427.945076][T26459] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 428.728776][T26513] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9795'. [ 428.799267][T26513] gtp0: entered promiscuous mode [ 428.825149][T26513] gtp0: entered allmulticast mode [ 429.356001][T26550] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9813'. [ 429.513912][T26558] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9813'. [ 429.886422][T26548] udevd[26548]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 430.188228][T26603] netlink: 'syz.3.9833': attribute type 39 has an invalid length. [ 430.269689][T26609] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9836'. [ 430.279499][T26609] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9836'. [ 430.384932][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035031000: rx timeout, send abort [ 430.507818][T26622] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9842'. [ 430.540350][T26624] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9843'. [ 430.574900][T26624] netlink: 'syz.0.9843': attribute type 1 has an invalid length. [ 430.601021][T26624] netlink: 'syz.0.9843': attribute type 2 has an invalid length. [ 430.867643][T26645] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 430.888255][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035033400: rx timeout, send abort [ 430.896828][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035031000: abort rx timeout. Force session deactivation [ 431.039100][T26654] syzkaller1: entered promiscuous mode [ 431.045773][T26654] syzkaller1: entered allmulticast mode [ 431.335849][T26663] tipc: Enabling of bearer rejected, already enabled [ 431.396481][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035033400: abort rx timeout. Force session deactivation [ 431.477694][T26671] netlink: 168 bytes leftover after parsing attributes in process `syz.2.9865'. [ 431.831416][T26690] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 432.216656][T26708] netlink: 104 bytes leftover after parsing attributes in process `syz.0.9883'. [ 432.517759][T26720] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9888'. [ 432.671217][T26727] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9893'. [ 433.054753][T26748] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9901'. [ 433.612366][T26795] veth0: entered promiscuous mode [ 433.626965][T26794] veth0: left promiscuous mode [ 433.712830][T26800] syzkaller1: entered promiscuous mode [ 433.728624][T26800] syzkaller1: entered allmulticast mode [ 434.500988][T26854] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 434.841557][T26880] netlink: 'syz.0.9963': attribute type 2 has an invalid length. [ 434.849515][T26880] netlink: 'syz.0.9963': attribute type 2 has an invalid length. [ 435.395018][T26908] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 435.615006][T26926] __nla_validate_parse: 8 callbacks suppressed [ 435.615029][T26926] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9984'. [ 436.064507][T26954] netlink: 'syz.1.9996': attribute type 1 has an invalid length. [ 436.085409][T26954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9996'. [ 436.363240][T26973] xt_hashlimit: size too large, truncated to 1048576 [ 436.625581][T26992] netlink: 212336 bytes leftover after parsing attributes in process `syz.4.10014'. [ 436.845326][T27001] syzkaller1: entered promiscuous mode [ 436.872142][T27001] syzkaller1: entered allmulticast mode [ 436.883572][T27007] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10020'. [ 436.903483][T27003] netlink: 7 bytes leftover after parsing attributes in process `syz.2.10019'. [ 437.270406][T27031] ipvlan1: entered allmulticast mode [ 437.275972][T27031] batadv_slave_1: entered allmulticast mode [ 437.286156][T27031] batman_adv: batadv0: Adding interface: ipvlan1 [ 437.292925][T27031] batman_adv: batadv0: The MTU of interface ipvlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.354887][T27031] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 437.411792][T27031] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 437.432777][T27031] batman_adv: batadv0: Interface activated: ipvlan1 [ 437.771390][T27053] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10041'. [ 438.177325][T27073] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10050'. [ 438.177575][T27071] syzkaller1: entered promiscuous mode [ 438.221879][T27071] syzkaller1: entered allmulticast mode [ 438.676157][T27107] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10065'. [ 439.527145][T27158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10086'. [ 439.562507][T27158] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10086'. [ 439.699228][T27170] netlink: 'syz.4.10091': attribute type 4 has an invalid length. [ 440.025728][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.098023][T27197] geneve2: entered promiscuous mode [ 440.112196][ T58] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 52511 - 0 [ 440.127788][ T58] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 52511 - 0 [ 440.182240][ T58] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 52511 - 0 [ 440.218171][ T58] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 52511 - 0 [ 441.355724][T27281] __nla_validate_parse: 6 callbacks suppressed [ 441.355744][T27281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10146'. [ 441.379808][T27284] syzkaller1: entered promiscuous mode [ 441.385629][T27284] syzkaller1: entered allmulticast mode [ 441.696824][T27296] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 441.763032][T27310] netlink: 64 bytes leftover after parsing attributes in process `syz.2.10156'. [ 442.245910][T27339] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 442.357462][T27347] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10174'. [ 443.271424][T27398] syzkaller1: entered promiscuous mode [ 443.276949][T27398] syzkaller1: entered allmulticast mode [ 443.461259][T27413] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10206'. [ 443.472057][T27413] netlink: 'syz.0.10206': attribute type 7 has an invalid length. [ 443.480449][T27413] netlink: 'syz.0.10206': attribute type 8 has an invalid length. [ 443.489004][T27413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10206'. [ 443.592604][T27422] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10209'. [ 443.853828][T27436] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10217'. [ 444.429463][T27469] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10233'. [ 444.619429][T27483] netdevsim netdevsim4: Direct firmware load for r1 failed with error -2 [ 444.641549][T27483] netdevsim netdevsim4: Falling back to sysfs fallback for: r1 [ 444.746366][T27494] sctp: [Deprecated]: syz.2.10244 (pid 27494) Use of struct sctp_assoc_value in delayed_ack socket option. [ 444.746366][T27494] Use struct sctp_sack_info instead [ 444.824065][T27497] syzkaller1: entered promiscuous mode [ 444.829630][T27497] syzkaller1: entered allmulticast mode [ 445.281746][T27522] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10257'. [ 445.304626][T27522] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10257'. [ 445.370921][ T6008] Bluetooth: hci2: command 0x0c1a tx timeout [ 445.377184][ T51] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 445.820829][T27549] sock: sock_set_timeout: `syz.4.10271' (pid 27549) tries to set negative timeout [ 446.589494][T27605] netlink: 43 bytes leftover after parsing attributes in process `syz.0.10297'. [ 446.756681][T27615] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.10300'. [ 446.872731][T27617] syzkaller1: entered promiscuous mode [ 446.878249][T27617] syzkaller1: entered allmulticast mode [ 446.904891][T27619] syzkaller1: entered promiscuous mode [ 446.905859][T27623] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10306'. [ 446.912963][T27619] syzkaller1: entered allmulticast mode [ 447.175622][T27637] netlink: 'syz.2.10312': attribute type 10 has an invalid length. [ 447.206841][T27637] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.235616][T27637] bridge_slave_1: left allmulticast mode [ 447.245214][T27637] bridge_slave_1: left promiscuous mode [ 447.253032][T27637] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.267698][T27637] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 447.496169][T27655] sctp: [Deprecated]: syz.3.10321 (pid 27655) Use of int in max_burst socket option. [ 447.496169][T27655] Use struct sctp_assoc_value instead [ 447.634895][T27665] netlink: 'syz.4.10326': attribute type 1 has an invalid length. [ 447.642997][T27665] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10326'. [ 447.993609][T27683] netlink: 27 bytes leftover after parsing attributes in process `syz.4.10333'. [ 448.461664][T27715] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10350'. [ 448.597455][T27725] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.10356'. [ 448.648402][T27722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.662092][T27722] 8021q: adding VLAN 0 to HW filter on device team0 [ 448.684257][T27722] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 448.725455][T14328] lo speed is unknown, defaulting to 1000 [ 448.741620][T14328] syz2: Port: 1 Link ACTIVE [ 448.822966][T14328] lo speed is unknown, defaulting to 1000 [ 448.832648][ T36] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 448.848232][ T36] bond0: (slave bond_slave_1): link status definitely down, disabling slave [ 448.858972][ T36] bond0: now running without any active interface! [ 449.090384][T27752] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10367'. [ 449.114917][T27752] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10367'. [ 449.127415][ T30] audit: type=1800 audit(1776075494.482:2): pid=27750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.10364" name="memory.events" dev="tmpfs" ino=10354 res=0 errno=0 [ 449.148967][T27752] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10367'. [ 449.851135][ T6008] Bluetooth: hci4: command 0x0406 tx timeout [ 450.167305][T27823] syzkaller1: entered promiscuous mode [ 450.173301][T27823] syzkaller1: entered allmulticast mode [ 450.703981][T27857] macvtap1: entered promiscuous mode [ 450.709493][T27857] macvtap1: entered allmulticast mode [ 450.715504][T27857] veth1_vlan: entered allmulticast mode [ 450.735405][T27857] macvtap2: entered promiscuous mode [ 450.740939][T27857] macvtap2: entered allmulticast mode [ 451.233041][ C1] vcan0: j1939_tp_rxtimer: 0xffff888032313400: rx timeout, send abort [ 451.241786][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888032313400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 451.372129][ T1115] bond0: (slave bridge_slave_1): interface is now down [ 451.382821][ T1115] bond0: now running without any active interface! [ 451.606360][T27907] __nla_validate_parse: 6 callbacks suppressed [ 451.606381][T27907] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10435'. [ 451.682864][T27913] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10436'. [ 451.895237][T27920] team0 (unregistering): Port device team_slave_0 removed [ 451.936885][T27920] team0 (unregistering): Port device 26±ÿ removed [ 451.990333][T27920] team0 (unregistering): Port device dummy0 removed [ 452.189466][T27939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10447'. [ 452.207307][T27932] pim6reg1: entered promiscuous mode [ 452.215172][T27932] pim6reg1: entered allmulticast mode [ 452.275477][T27939] netlink: 65011 bytes leftover after parsing attributes in process `syz.2.10447'. [ 452.729515][T27972] syzkaller1: entered promiscuous mode [ 452.750852][T27972] syzkaller1: entered allmulticast mode [ 452.908795][T27986] macvlan0: entered promiscuous mode [ 453.096773][T27997] netlink: 'syz.0.10472': attribute type 11 has an invalid length. [ 453.165246][T28001] netlink: 256 bytes leftover after parsing attributes in process `syz.4.10473'. [ 453.175006][T28001] netlink: 256 bytes leftover after parsing attributes in process `syz.4.10473'. [ 453.621101][T28016] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10480'. [ 453.724996][T28022] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10482'. [ 453.823476][T28026] team0 (unregistering): Port device team_slave_0 removed [ 453.862984][T28026] team0 (unregistering): Port device team_slave_1 removed [ 453.887724][T28029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10482'. [ 454.222495][T28051] af_packet: tpacket_rcv: packet too big, clamped from 2 to 4294967272. macoff=96 [ 454.276864][T28057] syzkaller1: entered promiscuous mode [ 454.282711][T28057] syzkaller1: entered allmulticast mode [ 454.536694][T28069] netlink: 212336 bytes leftover after parsing attributes in process `syz.1.10504'. [ 455.164456][T28108] syzkaller1: entered promiscuous mode [ 455.169986][T28108] syzkaller1: entered allmulticast mode [ 455.402519][T28115] syzkaller1: entered promiscuous mode [ 455.408044][T28115] syzkaller1: entered allmulticast mode [ 456.023172][T28149] syzkaller1: entered promiscuous mode [ 456.028700][T28149] syzkaller1: entered allmulticast mode [ 456.754500][T28205] netlink: 'syz.1.10567': attribute type 1 has an invalid length. [ 456.763159][T28205] __nla_validate_parse: 2 callbacks suppressed [ 456.763175][T28205] netlink: 88 bytes leftover after parsing attributes in process `syz.1.10567'. [ 456.782482][T28205] netlink: 1 bytes leftover after parsing attributes in process `syz.1.10567'. [ 456.799979][T28208] netlink: 64 bytes leftover after parsing attributes in process `syz.2.10566'. [ 456.811578][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.814065][T28205] netlink: 'syz.1.10567': attribute type 1 has an invalid length. [ 456.839777][T28205] netlink: 634 bytes leftover after parsing attributes in process `syz.1.10567'. [ 456.970141][T28215] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10570'. [ 457.307690][T28234] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10581'. [ 457.702028][T28261] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.10594'. [ 458.288704][T28296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10607'. [ 458.332664][T28298] bridge_slave_0: invalid flags given to default FDB implementation [ 458.462764][T28303] netlink: 'syz.1.10613': attribute type 9 has an invalid length. [ 458.502935][T28303] netlink: 'syz.1.10613': attribute type 11 has an invalid length. [ 458.511641][T28307] netlink: 'syz.3.10614': attribute type 4 has an invalid length. [ 458.521360][T28303] netlink: 'syz.1.10613': attribute type 12 has an invalid length. [ 458.533091][T28303] netlink: 210020 bytes leftover after parsing attributes in process `syz.1.10613'. [ 458.551888][T28303] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10613'. [ 459.067654][T28334] ref_ctr_offset mismatch. inode: 0xa0 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x6 [ 459.370544][T28358] "syz.2.10640" (28358) uses obsolete ecb(arc4) skcipher [ 459.878840][T28390] pim6reg1: entered promiscuous mode [ 459.884909][T28390] pim6reg1: entered allmulticast mode [ 460.083884][T28400] netlink: 'syz.2.10661': attribute type 22 has an invalid length. [ 460.114355][ T1115] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.114601][T28400] netlink: 'syz.2.10661': attribute type 22 has an invalid length. [ 460.131385][ T1115] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.180792][ T1115] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.190609][ T1115] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.375053][T28415] netlink: 'syz.3.10669': attribute type 1 has an invalid length. [ 461.112700][T28446] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 461.210724][T28452] netlink: 'syz.0.10685': attribute type 7 has an invalid length. [ 461.285553][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.299769][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.319075][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.337212][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.522420][T28468] 8021q: adding VLAN 0 to HW filter on device bond6 [ 461.550020][T28468] bond6: (slave geneve2): making interface the new active one [ 461.572824][T28468] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 461.586223][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.605455][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.636361][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.647111][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 462.026219][T28494] __nla_validate_parse: 5 callbacks suppressed [ 462.026241][T28494] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10700'. [ 462.243713][T28514] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10705'. [ 462.260600][T28514] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10705'. [ 463.534570][T28600] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.548186][T28600] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 463.649724][T28600] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.671117][T28600] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 463.774362][T28600] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.785959][T28600] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 463.806152][T28603] syzkaller1: entered promiscuous mode [ 463.812060][T28603] syzkaller1: entered allmulticast mode [ 463.884019][T28600] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.913350][T28600] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 464.079461][T26362] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 464.109093][T26362] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.143068][T26362] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 464.157371][T26362] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.235689][T28625] bond7: entered allmulticast mode [ 464.264490][ T58] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 464.286687][ T58] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.345695][ T1115] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 464.374417][ T1115] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.423729][T28637] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10749'. [ 464.564101][T28649] veth0_to_team: left allmulticast mode [ 464.771348][T28663] validate_nla: 2 callbacks suppressed [ 464.771369][T28663] netlink: 'syz.0.10761': attribute type 1 has an invalid length. [ 464.836086][T28663] bond4: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 464.846931][T28663] bond4: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 464.860241][T28663] bond4: (slave ip6gre1): making interface the new active one [ 464.871062][T28663] bond4: (slave ip6gre1): Enslaving as an active interface with an up link [ 465.261883][T28697] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.10776'. [ 465.555709][T28716] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10786'. [ 465.647501][T28722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10789'. [ 465.671227][T28722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10789'. [ 465.768365][T28726] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10790'. [ 465.824373][T28730] syzkaller1: entered promiscuous mode [ 465.830057][T28730] syzkaller1: entered allmulticast mode [ 466.031420][T28740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10797'. [ 466.063916][T28740] hsr_slave_0 (unregistering): left promiscuous mode [ 466.106861][ T58] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 466.116072][ T58] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 466.132953][ T58] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 466.142954][ T58] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 466.249930][T28745] syzkaller1: entered promiscuous mode [ 466.265061][T28747] netlink: Unknown conntrack attr (0) [ 466.266840][T28745] syzkaller1: entered allmulticast mode [ 466.302789][T28749] netlink: 'syz.1.10801': attribute type 9 has an invalid length. [ 466.329984][T28749] netlink: 'syz.1.10801': attribute type 11 has an invalid length. [ 466.351531][T28749] netlink: 'syz.1.10801': attribute type 12 has an invalid length. [ 466.434634][T28753] netlink: 'syz.0.10803': attribute type 7 has an invalid length. [ 466.465535][T28753] erspan0: entered promiscuous mode [ 466.488644][T28753] gretap0: entered promiscuous mode [ 466.504909][T28753] gretap0: left promiscuous mode [ 466.522613][T28753] erspan0: left promiscuous mode [ 466.564184][T28762] netlink: 'syz.1.10807': attribute type 15 has an invalid length. [ 467.183309][T28790] __nla_validate_parse: 9 callbacks suppressed [ 467.183332][T28790] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10818'. [ 467.224714][T28791] netlink: 'syz.0.10819': attribute type 12 has an invalid length. [ 467.243504][T28791] netlink: 'syz.0.10819': attribute type 29 has an invalid length. [ 467.260739][T28791] netlink: 148 bytes leftover after parsing attributes in process `syz.0.10819'. [ 467.273911][T28791] netlink: 'syz.0.10819': attribute type 2 has an invalid length. [ 467.303627][T28791] netlink: 11 bytes leftover after parsing attributes in process `syz.0.10819'. [ 467.336963][T28790] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10818'. [ 467.478868][T28807] netlink: 'syz.0.10827': attribute type 1 has an invalid length. [ 467.793525][T28830] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10836'. [ 467.841704][T28828] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 467.865055][T28828] bond3: (slave lo): Enslaving as an active interface with an up link [ 467.873852][T28828] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 467.981117][T28836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10839'. [ 468.112479][T28841] veth0: entered promiscuous mode [ 468.118308][T28841] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10841'. [ 468.129502][T28841] veth0 (unregistering): left promiscuous mode [ 468.309521][T28847] 8021q: adding VLAN 0 to HW filter on device bond8 [ 468.336260][T28847] bond8: (slave geneve3): making interface the new active one [ 468.347529][T28847] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 468.356957][ T1115] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 468.367175][ T1115] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 468.381896][ T1115] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 468.400197][ T1115] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 468.490043][T28858] trusted_key: syz.4.10849 sent an empty control message without MSG_MORE. [ 468.719665][T28874] veth0: entered promiscuous mode [ 468.725788][T28874] veth0: left promiscuous mode [ 469.007460][T28893] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10865'. [ 469.059790][T28893] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10865'. [ 469.059824][T26362] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 2816 - 0 [ 469.104316][T26362] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 2816 - 0 [ 469.114082][T26362] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 2816 - 0 [ 469.151150][T26362] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 2816 - 0 [ 469.948321][T28942] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10887'. [ 470.721145][T28968] validate_nla: 3 callbacks suppressed [ 470.721166][T28968] netlink: 'syz.0.10896': attribute type 1 has an invalid length. [ 471.059594][T28979] bond9: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 471.077903][T28979] bond9: (slave lo): Enslaving as an active interface with an up link [ 471.089465][T28979] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 471.416899][T29002] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 471.513323][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.949340][T29030] netlink: 'syz.3.10924': attribute type 1 has an invalid length. [ 472.211405][T29042] __nla_validate_parse: 9 callbacks suppressed [ 472.211425][T29042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.227827][T29042] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.237342][T29042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.283133][ T1115] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.292152][T29042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.301424][ T1115] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.309648][ T1115] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.331070][T29042] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.340223][T29042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10931'. [ 472.350329][ T1115] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.641272][T26362] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.970538][T29073] syz_tun: left promiscuous mode [ 472.977017][T29072] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.10946'. [ 473.007421][T29073] bridge0: port 3(syz_tun) entered disabled state [ 473.161670][T29073] bond0: (slave batadv0): Releasing backup interface [ 473.346921][T29073] bridge_slave_0: left promiscuous mode [ 473.354577][T29073] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.399429][T29073] bridge_slave_1: left allmulticast mode [ 473.406690][T29073] bridge_slave_1: left promiscuous mode [ 473.417211][T29073] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.438680][T29073] bond0: (slave bond_slave_0): Releasing backup interface [ 473.480625][T29073] bond0: (slave bond_slave_1): Releasing backup interface [ 473.513125][T29073] team0: Port device team_slave_0 removed [ 473.526982][T29073] team0: Port device team_slave_1 removed [ 473.535244][T29073] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 473.544108][T29073] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 473.554829][T29073] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 473.834101][ T1115] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.889159][T29123] netlink: 16215 bytes leftover after parsing attributes in process `syz.0.10963'. [ 474.451834][T29145] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10971'. [ 474.471770][T29145] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10971'. [ 474.491512][T29145] netlink: 'syz.4.10971': attribute type 15 has an invalid length. [ 474.520519][T29147] netlink: 'syz.2.10972': attribute type 9 has an invalid length. [ 474.540724][T29147] netlink: 'syz.2.10972': attribute type 11 has an invalid length. [ 474.568322][T29147] netlink: 'syz.2.10972': attribute type 12 has an invalid length. [ 474.661079][ T1115] netdevsim netdevsim4 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 474.669993][T29145] netlink: 'syz.4.10971': attribute type 15 has an invalid length. [ 474.678181][ T1115] netdevsim netdevsim4 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 474.713019][ T1115] netdevsim netdevsim4 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 474.735407][ T1115] netdevsim netdevsim4 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 474.941663][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.138792][T29167] bond9: option mode: unable to set because the bond device has slaves [ 475.180136][T29167] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 475.689767][T29187] netlink: 'syz.3.10989': attribute type 11 has an invalid length. [ 475.794586][T29191] netlink: 'syz.3.10991': attribute type 11 has an invalid length. [ 475.802874][T29191] netlink: 'syz.3.10991': attribute type 11 has an invalid length. [ 475.950415][T29197] netlink: 'syz.3.10994': attribute type 3 has an invalid length. [ 475.960089][T29197] netlink: 'syz.3.10994': attribute type 3 has an invalid length. [ 476.932123][T29244] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 476.944314][T29244] syzkaller1: Refused to change device type [ 476.950404][T29247] netlink: 'syz.0.11016': attribute type 12 has an invalid length. [ 477.273283][T29265] veth0: entered promiscuous mode [ 477.290146][T29261] veth0: left promiscuous mode [ 477.396638][T29274] "syz.4.11031" (29274) uses obsolete ecb(arc4) skcipher [ 477.412568][T29275] __nla_validate_parse: 15 callbacks suppressed [ 477.412581][T29275] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.429521][T29275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.439235][T29275] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.449346][T29275] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.459581][T29275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.469418][T29275] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11029'. [ 477.481452][ T30] audit: type=1800 audit(1776075522.822:3): pid=29272 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.11028" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=11143 res=0 errno=0 [ 477.696291][T29291] netlink: 'syz.2.11036': attribute type 19 has an invalid length. [ 477.705056][T29291] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11036'. [ 477.718225][T29291] netlink: 'syz.2.11036': attribute type 19 has an invalid length. [ 477.727087][T29291] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11036'. [ 477.783682][T29294] netlink: 'syz.3.11037': attribute type 20 has an invalid length. [ 477.791904][T29294] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11037'. [ 477.810966][T29294] netlink: 'syz.3.11037': attribute type 20 has an invalid length. [ 477.822481][T29294] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11037'. [ 477.901658][T29299] netem: change failed [ 478.231458][T29320] netlink: Unknown conntrack attr (type=2304, max=9) [ 478.523337][ T757] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 478.607749][T29349] netlink: 'syz.1.11061': attribute type 4 has an invalid length. [ 480.108813][T29434] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 480.191792][T29434] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 480.381974][T29434] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 480.528167][T29434] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 480.753411][T26362] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.784619][T26362] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.808911][T26362] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.818202][T29464] validate_nla: 3 callbacks suppressed [ 480.818218][T29464] netlink: 'syz.4.11103': attribute type 4 has an invalid length. [ 480.851956][ T49] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.864616][T29464] netlink: 'syz.4.11103': attribute type 4 has an invalid length. [ 481.732479][ T757] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 481.913736][T29511] netlink: 'syz.4.11122': attribute type 1 has an invalid length. [ 481.996667][T29511] 8021q: adding VLAN 0 to HW filter on device bond4 [ 482.018730][T29516] bond4: (slave geneve3): making interface the new active one [ 482.035551][T29516] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 482.075845][T29519] IPv6: sit2: Disabled Multicast RS [ 482.324154][T29529] netlink: 'syz.2.11128': attribute type 21 has an invalid length. [ 482.341519][T29529] netlink: 'syz.2.11128': attribute type 22 has an invalid length. [ 482.349474][T29529] netlink: 'syz.2.11128': attribute type 23 has an invalid length. [ 482.365516][T29529] netlink: 'syz.2.11128': attribute type 25 has an invalid length. [ 482.375007][T29529] netlink: 'syz.2.11128': attribute type 26 has an invalid length. [ 482.406388][T29531] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.023241][T29572] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 483.043506][T29575] netlink: 'syz.1.11148': attribute type 22 has an invalid length. [ 483.055467][T29575] __nla_validate_parse: 11 callbacks suppressed [ 483.055488][T29575] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11148'. [ 483.075140][T29575] netlink: 'syz.1.11148': attribute type 22 has an invalid length. [ 483.084055][T29575] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11148'. [ 483.293033][T29583] nbd4: detected capacity change from 0 to 63 [ 483.299675][T29587] block nbd4: NBD_DISCONNECT [ 483.309781][T29587] block nbd4: Disconnected due to user request. [ 483.323885][T29587] block nbd4: shutting down sockets [ 483.349024][T29589] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11155'. [ 483.352861][T29591] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.11154'. [ 483.369847][ C1] blk_print_req_error: 138 callbacks suppressed [ 483.369865][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.385713][ C1] buffer_io_error: 138 callbacks suppressed [ 483.385731][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.402905][ C1] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.412461][ C1] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.420274][ C1] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.429815][ C1] Buffer I/O error on dev nbd4, logical block 2, async page read [ 483.437661][ C1] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.447197][ C1] Buffer I/O error on dev nbd4, logical block 3, async page read [ 483.457520][T29503] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.493017][T29503] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.513353][T29503] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.524973][T29503] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.534693][T29503] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.544738][T29503] Buffer I/O error on dev nbd4, logical block 2, async page read [ 483.552730][T29503] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.588232][T29503] Buffer I/O error on dev nbd4, logical block 3, async page read [ 483.614249][T29595] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.11158'. [ 483.624355][T29503] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.644909][T29503] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.669864][T29597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11157'. [ 483.671246][T29503] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.720849][T29503] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.729344][T29503] ldm_validate_partition_table(): Disk read failed. [ 483.762249][T29603] netlink: 33 bytes leftover after parsing attributes in process `syz.2.11160'. [ 483.780224][T29503] Dev nbd4: unable to read RDB block 0 [ 483.791351][T29503] nbd4: unable to read partition table [ 483.814388][T29503] ldm_validate_partition_table(): Disk read failed. [ 483.839100][T29603] netlink: 140 bytes leftover after parsing attributes in process `syz.2.11160'. [ 483.850235][T29503] Dev nbd4: unable to read RDB block 0 [ 483.877170][T29503] nbd4: unable to read partition table [ 483.907998][T29613] tls_set_device_offload_rx: netdev not found [ 484.477189][T29638] netlink: 240 bytes leftover after parsing attributes in process `syz.2.11171'. [ 484.668346][T29650] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 484.678306][T29648] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 484.879808][T29658] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11184'. [ 485.186088][T29671] netlink: Conntrack attr has 3 unknown bytes [ 486.260421][ T51] block nbd4: Receive control failed (result -107) [ 486.281943][T29741] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 486.301089][T29736] nbd4: detected capacity change from 0 to 127 [ 486.309561][T29503] block nbd4: Dead connection, failed to find a fallback [ 486.335302][T29503] block nbd4: shutting down sockets [ 486.355252][T29503] ldm_validate_partition_table(): Disk read failed. [ 486.356172][T29743] bond3: option mode: unable to set because the bond device has slaves [ 486.388426][T29743] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 486.409657][T29503] Dev nbd4: unable to read RDB block 0 [ 486.425166][T29503] nbd4: unable to read partition table [ 486.462222][T29503] ldm_validate_partition_table(): Disk read failed. [ 486.469486][T29503] Dev nbd4: unable to read RDB block 0 [ 486.484861][T29745] validate_nla: 2 callbacks suppressed [ 486.484879][T29745] netlink: 'syz.0.11223': attribute type 12 has an invalid length. [ 486.500169][T29503] nbd4: unable to read partition table [ 486.513209][T29745] netlink: 'syz.0.11223': attribute type 12 has an invalid length. [ 486.665038][T29710] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 486.673613][T29710] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 486.796295][T29762] gretap3: entered promiscuous mode [ 487.162345][T29788] netlink: 'syz.2.11243': attribute type 18 has an invalid length. [ 487.172253][T29788] netlink: 'syz.2.11243': attribute type 18 has an invalid length. [ 487.511576][T29810] netlink: 'syz.3.11253': attribute type 1 has an invalid length. [ 487.550050][T29810] bond10: entered promiscuous mode [ 487.556308][T29810] 8021q: adding VLAN 0 to HW filter on device bond10 [ 487.592205][T29810] bond10: (slave bridge3): making interface the new active one [ 487.600030][T29810] bridge3: entered promiscuous mode [ 487.606620][T29810] bond10: (slave bridge3): Enslaving as an active interface with an up link [ 487.838488][T29827] netlink: 'syz.4.11261': attribute type 7 has an invalid length. [ 487.852846][T29827] netlink: 'syz.4.11261': attribute type 8 has an invalid length. [ 488.130880][T29839] netlink: 'syz.1.11266': attribute type 16 has an invalid length. [ 488.146390][T29839] __nla_validate_parse: 20 callbacks suppressed [ 488.146411][T29839] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11266'. [ 488.539738][T29864] netlink: 'syz.4.11278': attribute type 1 has an invalid length. [ 488.749982][T29872] syzkaller1: entered promiscuous mode [ 488.913493][T29878] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11284'. [ 489.151324][T29888] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11289'. [ 489.793783][T29921] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11299'. [ 489.935272][T29933] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.11303'. [ 490.066385][T29938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11304'. [ 490.101556][T29942] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.11305'. [ 490.115367][T29942] netlink: Conntrack attr has 4 unknown bytes [ 491.160471][T30004] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.11323'. [ 491.406005][T30017] netlink: 'syz.4.11329': attribute type 13 has an invalid length. [ 491.421571][T30017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11329'. [ 491.461065][T30017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11329'. [ 491.938999][T30055] validate_nla: 1 callbacks suppressed [ 491.939021][T30055] netlink: 'syz.4.11344': attribute type 5 has an invalid length. [ 491.964641][T30055] netlink: 'syz.4.11344': attribute type 5 has an invalid length. [ 492.508849][T30086] netlink: 'syz.4.11358': attribute type 51 has an invalid length. [ 493.002588][T30113] syzkaller1: entered promiscuous mode [ 493.008248][T30113] syzkaller1: entered allmulticast mode [ 493.164917][T30119] netlink: 'syz.2.11371': attribute type 8 has an invalid length. [ 493.174052][T30119] __nla_validate_parse: 9 callbacks suppressed [ 493.174070][T30119] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11371'. [ 493.198791][T30119] bond0: entered promiscuous mode [ 493.205764][T30119] bond_slave_0: entered promiscuous mode [ 493.211964][T30119] bond_slave_1: entered promiscuous mode [ 493.217947][T30119] bridge_slave_1: entered promiscuous mode [ 493.225663][T30119] bond0: left promiscuous mode [ 493.230498][T30119] bond_slave_0: left promiscuous mode [ 493.236496][T30119] bond_slave_1: left promiscuous mode [ 493.242127][T30119] bridge_slave_1: left promiscuous mode [ 493.633286][T30134] syzkaller1: entered promiscuous mode [ 493.639025][T30134] syzkaller1: entered allmulticast mode [ 493.841578][T30147] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.11384'. [ 494.123737][T30165] pim6reg1: entered promiscuous mode [ 494.129195][T30165] pim6reg1: entered allmulticast mode [ 494.412246][T30181] syzkaller1: entered promiscuous mode [ 494.430936][T30181] syzkaller1: entered allmulticast mode [ 494.456365][T30184] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11401'. [ 494.517980][T30189] netlink: 140 bytes leftover after parsing attributes in process `syz.4.11402'. [ 494.639032][T30192] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.11405'. [ 495.197350][T30227] netlink: 'syz.3.11421': attribute type 25 has an invalid length. [ 495.206826][T30227] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11421'. [ 495.219578][T30227] netlink: 'syz.3.11421': attribute type 25 has an invalid length. [ 495.240035][T30227] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11421'. [ 495.573685][T30239] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11427'. [ 496.149544][T30116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 496.282666][T30266] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11440'. [ 496.396992][T30272] syzkaller1: entered promiscuous mode [ 496.403997][T30272] syzkaller1: entered allmulticast mode [ 496.901163][T30301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11455'. [ 497.176667][T30307] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 497.183934][T30307] syzkaller1: linktype set to 823 [ 497.202156][T30317] bond3: option mode: unable to set because the bond device has slaves [ 497.221035][T30320] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 497.383886][T30325] netlink: 'syz.0.11462': attribute type 1 has an invalid length. [ 497.746497][T30352] netlink: 'syz.4.11474': attribute type 4 has an invalid length. [ 498.394915][T30397] __nla_validate_parse: 5 callbacks suppressed [ 498.394939][T30397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11494'. [ 498.416489][T30397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11494'. [ 498.425886][T30397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11494'. [ 498.508087][T30403] netlink: 'syz.1.11496': attribute type 1 has an invalid length. [ 498.540438][T30403] 8021q: adding VLAN 0 to HW filter on device bond4 [ 498.833305][T30420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11505'. [ 499.067769][T30433] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.11511'. [ 499.724817][T30467] netlink: 'syz.3.11525': attribute type 7 has an invalid length. [ 500.166436][T30467] netlink: 'syz.3.11525': attribute type 7 has an invalid length. [ 500.266044][T30491] macvlan0: left promiscuous mode [ 500.271417][T30491] xfrm1: left promiscuous mode [ 500.276426][T30491] gretap2: left promiscuous mode [ 500.485076][T30495] xt_hashlimit: size too large, truncated to 1048576 [ 500.629120][T30502] netlink: 'syz.2.11536': attribute type 9 has an invalid length. [ 500.670845][T30502] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11536'. [ 501.017601][T30491] bond10: left promiscuous mode [ 501.022877][T30491] bridge3: left promiscuous mode [ 501.076668][ T757] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 501.098342][ T757] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.126486][ T757] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 501.157000][T30502] netlink: 'syz.2.11536': attribute type 9 has an invalid length. [ 501.164936][ T757] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 501.183447][T30502] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11536'. [ 501.201689][ T757] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.208231][T30505] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.11537'. [ 501.229900][ T757] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 501.270226][ T757] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 501.282348][ T757] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.309990][ T757] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 501.373869][ T757] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 501.410840][ T757] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.431350][ T757] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 501.456299][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.508201][T30513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11543'. [ 501.546958][T30513] chnl_net:caif_netlink_parms(): no params data found [ 501.881365][T30535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11550'. [ 501.911160][T30535] netlink: 'syz.3.11550': attribute type 6 has an invalid length. [ 501.934606][T30535] netlink: 'syz.3.11550': attribute type 6 has an invalid length. [ 503.146991][T30594] "syz.3.11564" (30594) uses obsolete ecb(arc4) skcipher [ 503.574626][T30619] netlink: 'syz.0.11573': attribute type 9 has an invalid length. [ 503.600167][T30619] netlink: 'syz.0.11573': attribute type 11 has an invalid length. [ 503.621240][T30619] netlink: 'syz.0.11573': attribute type 12 has an invalid length. [ 503.639261][T30619] __nla_validate_parse: 6 callbacks suppressed [ 503.639281][T30619] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.11573'. [ 503.662509][T30619] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11573'. [ 503.824972][T30631] netlink: 'syz.4.11579': attribute type 9 has an invalid length. [ 503.837782][T30631] netlink: 'syz.4.11579': attribute type 11 has an invalid length. [ 503.846501][T30631] netlink: 'syz.4.11579': attribute type 12 has an invalid length. [ 503.892589][T30631] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.11579'. [ 504.265998][T30661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11590'. [ 504.902445][T30685] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11598'. [ 505.112499][T30697] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11602'. [ 505.547129][T30717] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 506.435237][T30747] bond3: (slave lo): Releasing backup interface [ 506.443086][T30747] bond3: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 506.462708][T30747] bridge_slave_0: left allmulticast mode [ 506.468726][T30747] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.479859][T30747] bridge_slave_1: left promiscuous mode [ 506.489559][T30747] bridge0: port 2(bridge_slave_1) entered disabled state [ 506.503185][T30747] bond0: (slave bond_slave_0): Releasing backup interface [ 506.522762][T30747] bond0: (slave bond_slave_1): Releasing backup interface [ 506.543246][T30747] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 506.552884][T30747] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 506.582657][T30747] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 506.590080][T30747] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 506.625104][T30747] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 506.678640][T30745] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11623'. [ 508.734256][T30729] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 508.851730][T30774] syzkaller1: entered promiscuous mode [ 508.857266][T30774] syzkaller1: entered allmulticast mode [ 509.104427][T30789] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11638'. [ 509.482089][T30814] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11650'. [ 509.548413][T30821] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.11653'. [ 509.858484][T30839] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11662'. [ 509.868613][T30839] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11662'. [ 509.933059][T30841] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11663'. [ 509.942611][T30841] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11663'. [ 510.227780][T30859] netlink: 'syz.2.11671': attribute type 14 has an invalid length. [ 510.238250][T30859] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11671'. [ 510.248392][T30859] netlink: 'syz.2.11671': attribute type 14 has an invalid length. [ 510.257425][T30859] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11671'. [ 510.431371][T30864] ip6tnl4: entered promiscuous mode [ 510.550351][T30872] atomic_op ffff888032e36198 conn xmit_atomic 0000000000000000 [ 511.181855][T30909] syzkaller1: entered promiscuous mode [ 511.202857][T30909] syzkaller1: entered allmulticast mode [ 511.973028][T30942] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.11710'. [ 512.156154][T30950] netlink: 'syz.0.11715': attribute type 1 has an invalid length. [ 513.088457][T30999] syzkaller1: entered promiscuous mode [ 513.094868][T30999] syzkaller1: entered allmulticast mode [ 513.344573][T31012] netlink: 'syz.1.11740': attribute type 1 has an invalid length. [ 513.398980][T31012] 8021q: adding VLAN 0 to HW filter on device bond5 [ 513.419394][T31018] bond5: (slave gretap2): making interface the new active one [ 513.428403][T31018] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 513.844148][T31037] netlink: 'syz.1.11751': attribute type 1 has an invalid length. [ 513.908058][T31037] bond6: (slave gretap3): making interface the new active one [ 513.916577][T31037] bond6: (slave gretap3): Enslaving as an active interface with an up link [ 514.353710][T31062] netlink: 192 bytes leftover after parsing attributes in process `syz.1.11760'. [ 514.358960][T31060] lo speed is unknown, defaulting to 1000 [ 514.406780][T31062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11760'. [ 514.805161][T31085] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11771'. [ 514.951053][T31093] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11774'. [ 514.961122][T31093] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11774'. [ 515.121660][T31095] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11775'. [ 515.134937][T31099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11777'. [ 515.201793][T31095] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 515.209112][T31095] IPv6: NLM_F_CREATE should be set when creating new route [ 515.243819][T31095] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11775'. [ 515.270354][T31103] netlink: 'syz.3.11779': attribute type 10 has an invalid length. [ 515.279069][T31099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11777'. [ 515.307178][T31103] netlink: 16154 bytes leftover after parsing attributes in process `syz.3.11779'. [ 515.883458][T31134] [ 515.885858][T31134] ====================================================== [ 515.892898][T31134] WARNING: possible circular locking dependency detected [ 515.899973][T31134] syzkaller #0 Not tainted [ 515.904404][T31134] ------------------------------------------------------ [ 515.911432][T31134] syz.2.11789/31134 is trying to acquire lock: [ 515.917595][T31134] ffff88801badda20 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x71/0x180 [ 515.928181][T31134] [ 515.928181][T31134] but task is already holding lock: [ 515.935571][T31134] ffff88801badd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 515.945886][T31134] [ 515.945886][T31134] which lock already depends on the new lock. [ 515.945886][T31134] [ 515.956314][T31134] [ 515.956314][T31134] the existing dependency chain (in reverse order) is: [ 515.965342][T31134] [ 515.965342][T31134] -> #10 (&root->kernfs_rwsem){++++}-{4:4}: [ 515.973446][T31134] down_write+0x96/0x200 [ 515.978232][T31134] kernfs_add_one+0x41/0x5c0 [ 515.983361][T31134] kernfs_create_dir_ns+0xde/0x130 [ 515.989032][T31134] internal_create_group+0x425/0x1180 [ 515.994961][T31134] cpuhp_invoke_callback+0x445/0x860 [ 516.000810][T31134] cpuhp_issue_call+0x430/0x7a0 [ 516.006204][T31134] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 516.012810][T31134] __cpuhp_setup_state+0x3f/0x60 [ 516.018292][T31134] do_one_initcall+0x250/0x8d0 [ 516.023603][T31134] do_initcall_level+0x104/0x190 [ 516.029084][T31134] do_initcalls+0x59/0xa0 [ 516.033949][T31134] kernel_init_freeable+0x2a6/0x3e0 [ 516.039689][T31134] kernel_init+0x1d/0x1d0 [ 516.044562][T31134] ret_from_fork+0x51e/0xb90 [ 516.049728][T31134] ret_from_fork_asm+0x1a/0x30 [ 516.055034][T31134] [ 516.055034][T31134] -> #9 (cpuhp_state_mutex){+.+.}-{4:4}: [ 516.062877][T31134] [ 516.062877][T31134] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 516.070625][T31134] cpus_read_lock+0x42/0x160 [ 516.075762][T31134] static_key_disable+0x12/0x20 [ 516.081165][T31134] __inet_hash_connect+0x2430/0x2440 [ 516.086998][T31134] tcp_v4_connect+0xd5f/0x19b0 [ 516.092308][T31134] __inet_stream_connect+0x25a/0xdd0 [ 516.098139][T31134] inet_stream_connect+0x66/0xa0 [ 516.103626][T31134] __sys_connect+0x312/0x450 [ 516.108782][T31134] __x64_sys_connect+0x7a/0x90 [ 516.114096][T31134] do_syscall_64+0x14d/0xf80 [ 516.119237][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.125662][T31134] [ 516.125662][T31134] -> #7 (sk_lock-AF_INET){+.+.}-{0:0}: [ 516.133338][T31134] lock_sock_nested+0x48/0x100 [ 516.138639][T31134] inet_shutdown+0x6a/0x390 [ 516.143680][T31134] nbd_mark_nsock_dead+0x2e9/0x560 [ 516.149333][T31134] recv_work+0x1c7f/0x1d90 [ 516.154343][T31134] process_scheduled_works+0xb6e/0x18c0 [ 516.160428][T31134] worker_thread+0xa53/0xfc0 [ 516.165560][T31134] kthread+0x388/0x470 [ 516.170163][T31134] ret_from_fork+0x51e/0xb90 [ 516.175319][T31134] ret_from_fork_asm+0x1a/0x30 [ 516.180647][T31134] [ 516.180647][T31134] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 516.188333][T31134] __mutex_lock+0x19f/0x1300 [ 516.193490][T31134] nbd_queue_rq+0x37b/0x1100 [ 516.198614][T31134] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 516.204696][T31134] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 516.211594][T31134] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 516.218109][T31134] blk_mq_run_hw_queue+0x348/0x4f0 [ 516.223754][T31134] blk_mq_dispatch_list+0xd16/0xe10 [ 516.229490][T31134] blk_mq_flush_plug_list+0x48d/0x570 [ 516.235398][T31134] __blk_flush_plug+0x3ed/0x4d0 [ 516.240799][T31134] __submit_bio+0x28d/0x580 [ 516.245841][T31134] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 516.252019][T31134] block_read_full_folio+0x599/0x830 [ 516.257934][T31134] filemap_read_folio+0x137/0x3b0 [ 516.263497][T31134] do_read_cache_folio+0x358/0x590 [ 516.269143][T31134] read_part_sector+0xb6/0x2b0 [ 516.274458][T31134] adfspart_check_ICS+0xa5/0xa40 [ 516.279929][T31134] bdev_disk_changed+0x7ba/0x1550 [ 516.285494][T31134] blkdev_get_whole+0x380/0x510 [ 516.290892][T31134] bdev_open+0x31e/0xd30 [ 516.295684][T31134] blkdev_open+0x470/0x610 [ 516.300646][T31134] do_dentry_open+0x785/0x14e0 [ 516.305981][T31134] vfs_open+0x3b/0x340 [ 516.310594][T31134] path_openat+0x2e08/0x3860 [ 516.315719][T31134] do_file_open+0x23e/0x4a0 [ 516.320766][T31134] do_sys_openat2+0x113/0x200 [ 516.326002][T31134] __x64_sys_openat+0x138/0x170 [ 516.331401][T31134] do_syscall_64+0x14d/0xf80 [ 516.336544][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.342985][T31134] [ 516.342985][T31134] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 516.350213][T31134] __mutex_lock+0x19f/0x1300 [ 516.355349][T31134] nbd_queue_rq+0xc6/0x1100 [ 516.360401][T31134] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 516.366486][T31134] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 516.373359][T31134] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 516.379876][T31134] blk_mq_run_hw_queue+0x348/0x4f0 [ 516.385546][T31134] blk_mq_dispatch_list+0xd16/0xe10 [ 516.391286][T31134] blk_mq_flush_plug_list+0x48d/0x570 [ 516.397196][T31134] __blk_flush_plug+0x3ed/0x4d0 [ 516.402592][T31134] __submit_bio+0x28d/0x580 [ 516.407632][T31134] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 516.413811][T31134] block_read_full_folio+0x599/0x830 [ 516.419642][T31134] filemap_read_folio+0x137/0x3b0 [ 516.425207][T31134] do_read_cache_folio+0x358/0x590 [ 516.430870][T31134] read_part_sector+0xb6/0x2b0 [ 516.436187][T31134] adfspart_check_ICS+0xa5/0xa40 [ 516.441668][T31134] bdev_disk_changed+0x7ba/0x1550 [ 516.447232][T31134] blkdev_get_whole+0x380/0x510 [ 516.452624][T31134] bdev_open+0x31e/0xd30 [ 516.457418][T31134] blkdev_open+0x470/0x610 [ 516.462371][T31134] do_dentry_open+0x785/0x14e0 [ 516.467668][T31134] vfs_open+0x3b/0x340 [ 516.472283][T31134] path_openat+0x2e08/0x3860 [ 516.477409][T31134] do_file_open+0x23e/0x4a0 [ 516.482444][T31134] do_sys_openat2+0x113/0x200 [ 516.487665][T31134] __x64_sys_openat+0x138/0x170 [ 516.493073][T31134] do_syscall_64+0x14d/0xf80 [ 516.498201][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.504628][T31134] [ 516.504628][T31134] -> #4 (set->srcu){.+.+}-{0:0}: [ 516.511772][T31134] __synchronize_srcu+0xca/0x300 [ 516.517246][T31134] elevator_switch+0x1e8/0x7a0 [ 516.522542][T31134] elevator_change+0x2cc/0x450 [ 516.527847][T31134] elevator_set_default+0x36c/0x430 [ 516.533589][T31134] blk_register_queue+0x366/0x430 [ 516.539152][T31134] __add_disk+0x677/0xd50 [ 516.544020][T31134] add_disk_fwnode+0xfb/0x480 [ 516.549253][T31134] nbd_dev_add+0x72c/0xb50 [ 516.554208][T31134] nbd_init+0x168/0x1f0 [ 516.558897][T31134] do_one_initcall+0x250/0x8d0 [ 516.564195][T31134] do_initcall_level+0x104/0x190 [ 516.569669][T31134] do_initcalls+0x59/0xa0 [ 516.574543][T31134] kernel_init_freeable+0x2a6/0x3e0 [ 516.580274][T31134] kernel_init+0x1d/0x1d0 [ 516.585142][T31134] ret_from_fork+0x51e/0xb90 [ 516.590278][T31134] ret_from_fork_asm+0x1a/0x30 [ 516.595587][T31134] [ 516.595587][T31134] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 516.603435][T31134] __mutex_lock+0x19f/0x1300 [ 516.608571][T31134] elevator_change+0x1b3/0x450 [ 516.613872][T31134] elevator_set_none+0xb5/0x140 [ 516.619255][T31134] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 516.625598][T31134] nbd_start_device+0x17f/0xb10 [ 516.631011][T31134] nbd_genl_connect+0x165b/0x1cf0 [ 516.636573][T31134] genl_family_rcv_msg_doit+0x22a/0x330 [ 516.642660][T31134] genl_rcv_msg+0x61c/0x7a0 [ 516.647701][T31134] netlink_rcv_skb+0x232/0x4b0 [ 516.652999][T31134] genl_rcv+0x28/0x40 [ 516.657695][T31134] netlink_unicast+0x80f/0x9b0 [ 516.663044][T31134] netlink_sendmsg+0x813/0xb40 [ 516.668355][T31134] ____sys_sendmsg+0x972/0x9f0 [ 516.673675][T31134] ___sys_sendmsg+0x2a5/0x360 [ 516.678901][T31134] __x64_sys_sendmsg+0x1bd/0x2a0 [ 516.684387][T31134] do_syscall_64+0x14d/0xf80 [ 516.689544][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.695981][T31134] [ 516.695981][T31134] -> #2 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 516.704602][T31134] blk_alloc_queue+0x546/0x680 [ 516.709917][T31134] __blk_mq_alloc_disk+0x197/0x390 [ 516.715578][T31134] nbd_dev_add+0x499/0xb50 [ 516.720547][T31134] nbd_init+0x168/0x1f0 [ 516.725354][T31134] do_one_initcall+0x250/0x8d0 [ 516.730679][T31134] do_initcall_level+0x104/0x190 [ 516.736164][T31134] do_initcalls+0x59/0xa0 [ 516.741045][T31134] kernel_init_freeable+0x2a6/0x3e0 [ 516.746793][T31134] kernel_init+0x1d/0x1d0 [ 516.751657][T31134] ret_from_fork+0x51e/0xb90 [ 516.756796][T31134] ret_from_fork_asm+0x1a/0x30 [ 516.762098][T31134] [ 516.762098][T31134] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 516.769326][T31134] fs_reclaim_acquire+0x71/0x100 [ 516.774809][T31134] kmem_cache_alloc_noprof+0x40/0x650 [ 516.780722][T31134] __kernfs_iattrs+0xdf/0x340 [ 516.785970][T31134] kernfs_iop_setattr+0xea/0x3f0 [ 516.791458][T31134] notify_change+0xc1a/0xf40 [ 516.796623][T31134] do_truncate+0x1c2/0x250 [ 516.801575][T31134] path_openat+0x2f89/0x3860 [ 516.806699][T31134] do_file_open+0x23e/0x4a0 [ 516.811765][T31134] do_sys_openat2+0x113/0x200 [ 516.816988][T31134] __x64_sys_openat+0x138/0x170 [ 516.822373][T31134] do_syscall_64+0x14d/0xf80 [ 516.827508][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.833933][T31134] [ 516.833933][T31134] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 516.842460][T31134] __lock_acquire+0x15a5/0x2cf0 [ 516.847854][T31134] lock_acquire+0xf0/0x2e0 [ 516.852807][T31134] down_write+0x96/0x200 [ 516.857666][T31134] kernfs_unlink_sibling+0x71/0x180 [ 516.863403][T31134] __kernfs_remove+0x3e7/0x660 [ 516.868695][T31134] kernfs_remove_by_name_ns+0xaf/0x130 [ 516.874695][T31134] sysfs_unmerge_group+0xd4/0x140 [ 516.880281][T31134] dpm_sysfs_remove+0x76/0xd0 [ 516.885504][T31134] device_del+0x250/0x8f0 [ 516.890398][T31134] device_unregister+0x21/0xf0 [ 516.895715][T31134] hci_conn_del+0xc36/0x1230 [ 516.900851][T31134] hci_conn_hash_flush+0x191/0x260 [ 516.906523][T31134] hci_dev_close_sync+0x821/0x10e0 [ 516.912175][T31134] hci_dev_close+0x108/0x260 [ 516.917316][T31134] sock_do_ioctl+0x101/0x320 [ 516.922443][T31134] sock_ioctl+0x5c6/0x7f0 [ 516.927315][T31134] __se_sys_ioctl+0xfc/0x170 [ 516.932447][T31134] do_syscall_64+0x14d/0xf80 [ 516.937575][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.944008][T31134] [ 516.944008][T31134] other info that might help us debug this: [ 516.944008][T31134] [ 516.954246][T31134] Chain exists of: [ 516.954246][T31134] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 516.954246][T31134] [ 516.968702][T31134] Possible unsafe locking scenario: [ 516.968702][T31134] [ 516.976163][T31134] CPU0 CPU1 [ 516.981541][T31134] ---- ---- [ 516.986932][T31134] lock(&root->kernfs_rwsem); [ 516.991726][T31134] lock(cpuhp_state_mutex); [ 516.998839][T31134] lock(&root->kernfs_rwsem); [ 517.006124][T31134] lock(&root->kernfs_iattr_rwsem); [ 517.011416][T31134] [ 517.011416][T31134] *** DEADLOCK *** [ 517.011416][T31134] [ 517.019559][T31134] 3 locks held by syz.2.11789/31134: [ 517.024848][T31134] #0: ffff8880285f0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x100/0x260 [ 517.034390][T31134] #1: ffff8880285f00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 517.044071][T31134] #2: ffff88801badd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 517.054833][T31134] [ 517.054833][T31134] stack backtrace: [ 517.060734][T31134] CPU: 1 UID: 0 PID: 31134 Comm: syz.2.11789 Not tainted syzkaller #0 PREEMPT(full) [ 517.060774][T31134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 517.060795][T31134] Call Trace: [ 517.060803][T31134] [ 517.060811][T31134] dump_stack_lvl+0xe8/0x150 [ 517.060842][T31134] print_circular_bug+0x2e1/0x300 [ 517.060877][T31134] check_noncircular+0x12e/0x150 [ 517.060929][T31134] __lock_acquire+0x15a5/0x2cf0 [ 517.060958][T31134] ? __lock_acquire+0x6b5/0x2cf0 [ 517.060988][T31134] lock_acquire+0xf0/0x2e0 [ 517.061008][T31134] ? kernfs_unlink_sibling+0x71/0x180 [ 517.061029][T31134] down_write+0x96/0x200 [ 517.061043][T31134] ? kernfs_unlink_sibling+0x71/0x180 [ 517.061059][T31134] ? __pfx_down_write+0x10/0x10 [ 517.061073][T31134] ? kernfs_root+0x1c/0x230 [ 517.061095][T31134] ? kernfs_root+0x1c/0x230 [ 517.061117][T31134] ? kernfs_root+0x1c/0x230 [ 517.061139][T31134] ? kernfs_root+0x1ea/0x230 [ 517.061163][T31134] kernfs_unlink_sibling+0x71/0x180 [ 517.061181][T31134] __kernfs_remove+0x3e7/0x660 [ 517.061198][T31134] kernfs_remove_by_name_ns+0xaf/0x130 [ 517.061216][T31134] sysfs_unmerge_group+0xd4/0x140 [ 517.061241][T31134] dpm_sysfs_remove+0x76/0xd0 [ 517.061266][T31134] device_del+0x250/0x8f0 [ 517.061286][T31134] ? klist_iter_exit+0xc1/0x100 [ 517.061311][T31134] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 517.061328][T31134] ? __pfx_device_del+0x10/0x10 [ 517.061350][T31134] ? __cancel_work+0x17f/0x230 [ 517.061374][T31134] ? lockdep_hardirqs_on+0x7a/0x110 [ 517.061397][T31134] device_unregister+0x21/0xf0 [ 517.061419][T31134] hci_conn_del+0xc36/0x1230 [ 517.061439][T31134] hci_conn_hash_flush+0x191/0x260 [ 517.061460][T31134] hci_dev_close_sync+0x821/0x10e0 [ 517.061479][T31134] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 517.061495][T31134] ? lockdep_hardirqs_on+0x7a/0x110 [ 517.061516][T31134] ? enable_work+0x1fd/0x230 [ 517.061543][T31134] hci_dev_close+0x108/0x260 [ 517.061560][T31134] sock_do_ioctl+0x101/0x320 [ 517.061575][T31134] ? __pfx_sock_do_ioctl+0x10/0x10 [ 517.061588][T31134] ? do_futex+0x395/0x420 [ 517.061614][T31134] sock_ioctl+0x5c6/0x7f0 [ 517.061638][T31134] ? __pfx_sock_ioctl+0x10/0x10 [ 517.061662][T31134] ? __fget_files+0x2a/0x420 [ 517.061675][T31134] ? __fget_files+0x3a0/0x420 [ 517.061687][T31134] ? __fget_files+0x2a/0x420 [ 517.061702][T31134] ? bpf_lsm_file_ioctl+0x9/0x20 [ 517.061722][T31134] ? __pfx_sock_ioctl+0x10/0x10 [ 517.061746][T31134] __se_sys_ioctl+0xfc/0x170 [ 517.061765][T31134] do_syscall_64+0x14d/0xf80 [ 517.061787][T31134] ? trace_irq_disable+0x3b/0x150 [ 517.061800][T31134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.061816][T31134] ? clear_bhb_loop+0x40/0x90 [ 517.061833][T31134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.061849][T31134] RIP: 0033:0x7f83e9d9c819 [ 517.061864][T31134] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.061878][T31134] RSP: 002b:00007f83eac2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.061900][T31134] RAX: ffffffffffffffda RBX: 00007f83ea015fa0 RCX: 00007f83e9d9c819 [ 517.061912][T31134] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006 [ 517.061938][T31134] RBP: 00007f83e9e32c91 R08: 0000000000000000 R09: 0000000000000000 [ 517.061949][T31134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.061959][T31134] R13: 00007f83ea016038 R14: 00007f83ea015fa0 R15: 00007ffc21e5d928 [ 517.061979][T31134]