last executing test programs: 1m25.866600528s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 1m9.892708351s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 57.755494939s ago: executing program 2 (id=3351): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000001c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000700)="d981", 0x2}], 0x1}}], 0x1, 0x4000c000) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x500000000000000, 0x0, 0xfffffffffffffdfd) 57.195542726s ago: executing program 2 (id=3353): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8}, 0x48) ioctl$sock_netdev_private(0xffffffffffffffff, 0x9, &(0x7f0000000240)="8c698157ec55213e2f39514faca1554a79ecc88da74041764c35e4e0cffac2e1f7dbbd738560caaa18e2c37f91ddb2250488965fb018a963cfa89e837962a651bbfa9c7db3d0ad90e0c0fae8f6273201fd5a9024697e1b1107d6debe458c871775ceeafe747bdf8454022ec1dcac301b05c23a8d") r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x6c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x50, 0x33, @beacon={{{}, {}, @device_b, @device_b}, 0x0, @random, 0x0, @void, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @void, @val={0x3c, 0x4}, @void, @void, @void, @val={0x76, 0x6}, [{0xdd, 0x6, "31851c27f051"}, {0xdd, 0x6, "30d8ac98fded"}]}}]}, 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.controllers\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r8, @ANYBLOB="0000010000000000140012800b0001006d61637365630000040002801c001a801800028014000180080016"], 0x50}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a800000013000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00280a000060001980140004006b2e4f2fdd8733dc1c1639228919eb5e2efc02007b5d2f215d290000140005004af57c15cd92d389e606fce6a0eebda514000400f4d8d35abbd4fab3a3614be8a496bd8f140005008ebcd2c7e1cf0421ab20db4c32c4330605001000040000001400030076657468315f6d616376746170"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@llx, {0x3, 0x0, 0x3, 0xa, 0x0}, {0x5}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, @printk={@p, {0x5, 0x3, 0x6, 0xa, 0x1, 0xfff5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 56.798442078s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 44.537652965s ago: executing program 2 (id=3353): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8}, 0x48) ioctl$sock_netdev_private(0xffffffffffffffff, 0x9, &(0x7f0000000240)="8c698157ec55213e2f39514faca1554a79ecc88da74041764c35e4e0cffac2e1f7dbbd738560caaa18e2c37f91ddb2250488965fb018a963cfa89e837962a651bbfa9c7db3d0ad90e0c0fae8f6273201fd5a9024697e1b1107d6debe458c871775ceeafe747bdf8454022ec1dcac301b05c23a8d") r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x6c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x50, 0x33, @beacon={{{}, {}, @device_b, @device_b}, 0x0, @random, 0x0, @void, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @void, @val={0x3c, 0x4}, @void, @void, @void, @val={0x76, 0x6}, [{0xdd, 0x6, "31851c27f051"}, {0xdd, 0x6, "30d8ac98fded"}]}}]}, 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.controllers\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r8, @ANYBLOB="0000010000000000140012800b0001006d61637365630000040002801c001a801800028014000180080016"], 0x50}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a800000013000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00280a000060001980140004006b2e4f2fdd8733dc1c1639228919eb5e2efc02007b5d2f215d290000140005004af57c15cd92d389e606fce6a0eebda514000400f4d8d35abbd4fab3a3614be8a496bd8f140005008ebcd2c7e1cf0421ab20db4c32c4330605001000040000001400030076657468315f6d616376746170"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@llx, {0x3, 0x0, 0x3, 0xa, 0x0}, {0x5}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, @printk={@p, {0x5, 0x3, 0x6, 0xa, 0x1, 0xfff5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 41.206881386s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 28.332970027s ago: executing program 2 (id=3353): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8}, 0x48) ioctl$sock_netdev_private(0xffffffffffffffff, 0x9, &(0x7f0000000240)="8c698157ec55213e2f39514faca1554a79ecc88da74041764c35e4e0cffac2e1f7dbbd738560caaa18e2c37f91ddb2250488965fb018a963cfa89e837962a651bbfa9c7db3d0ad90e0c0fae8f6273201fd5a9024697e1b1107d6debe458c871775ceeafe747bdf8454022ec1dcac301b05c23a8d") r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x6c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x50, 0x33, @beacon={{{}, {}, @device_b, @device_b}, 0x0, @random, 0x0, @void, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @void, @val={0x3c, 0x4}, @void, @void, @void, @val={0x76, 0x6}, [{0xdd, 0x6, "31851c27f051"}, {0xdd, 0x6, "30d8ac98fded"}]}}]}, 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.controllers\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r8, @ANYBLOB="0000010000000000140012800b0001006d61637365630000040002801c001a801800028014000180080016"], 0x50}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a800000013000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00280a000060001980140004006b2e4f2fdd8733dc1c1639228919eb5e2efc02007b5d2f215d290000140005004af57c15cd92d389e606fce6a0eebda514000400f4d8d35abbd4fab3a3614be8a496bd8f140005008ebcd2c7e1cf0421ab20db4c32c4330605001000040000001400030076657468315f6d616376746170"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@llx, {0x3, 0x0, 0x3, 0xa, 0x0}, {0x5}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, @printk={@p, {0x5, 0x3, 0x6, 0xa, 0x1, 0xfff5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 23.431973744s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 13.462941907s ago: executing program 2 (id=3353): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8}, 0x48) ioctl$sock_netdev_private(0xffffffffffffffff, 0x9, &(0x7f0000000240)="8c698157ec55213e2f39514faca1554a79ecc88da74041764c35e4e0cffac2e1f7dbbd738560caaa18e2c37f91ddb2250488965fb018a963cfa89e837962a651bbfa9c7db3d0ad90e0c0fae8f6273201fd5a9024697e1b1107d6debe458c871775ceeafe747bdf8454022ec1dcac301b05c23a8d") r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x6c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x50, 0x33, @beacon={{{}, {}, @device_b, @device_b}, 0x0, @random, 0x0, @void, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @void, @val={0x3c, 0x4}, @void, @void, @void, @val={0x76, 0x6}, [{0xdd, 0x6, "31851c27f051"}, {0xdd, 0x6, "30d8ac98fded"}]}}]}, 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.controllers\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r8, @ANYBLOB="0000010000000000140012800b0001006d61637365630000040002801c001a801800028014000180080016"], 0x50}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a800000013000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00280a000060001980140004006b2e4f2fdd8733dc1c1639228919eb5e2efc02007b5d2f215d290000140005004af57c15cd92d389e606fce6a0eebda514000400f4d8d35abbd4fab3a3614be8a496bd8f140005008ebcd2c7e1cf0421ab20db4c32c4330605001000040000001400030076657468315f6d616376746170"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@llx, {0x3, 0x0, 0x3, 0xa, 0x0}, {0x5}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, @printk={@p, {0x5, 0x3, 0x6, 0xa, 0x1, 0xfff5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 10.772152248s ago: executing program 1 (id=1601): r0 = socket$inet6(0xa, 0x6, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x28, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@synack={0x1e, 0x10}, @mptcp=@ack={0x1e, 0x4, 0x50}]}}}}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0xffff8000) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xe7, &(0x7f00000002c0), &(0x7f0000000080)=0x4) 3.273513434s ago: executing program 3 (id=3693): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000200)="18", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000580)={&(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000080)=' ', 0x1}], 0x1}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008900000095000000000000001b7315d43b90037161e573d8dee4a8018b5f60b9969eec3b2344dd6f28997400fbcfa234f96c71d1ca3464ca1fe516cc2ca6c2873840a8c724a765c01618b6006e306b740b200545dd3f906e0045a7d49c058d5413e84e3ee9b6ffd13dde0be8110ffca3812534b8373b4d", @ANYBLOB="04815f034ac958ba7d0785e4ebbafa6baf356cf198854b03504b123858e6c8a6eb4ac0e9fe201483de1b350d6342b4cfb2ea53a1f74c24617c5c0fedefd41085870f7c36"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000a40)=ANY=[@ANYBLOB="340000001c00040028bd70000400000000000000", @ANYRES32=0x0, @ANYBLOB="80002508080007000500000008000b00020000000800040080000000a35a6f9b3ff0b7c948f5d4305708613d7af82853894659ffe09edd75d89ddf1a57c25c230f2457c0996c740b7bc6175b7321d6556e9beed64e780250df9a82aeac73c357b4cb2cef1b14af2ebf70"], 0x34}, 0x1, 0x0, 0x0, 0x6000081}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x3aeb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000680)=ANY=[], 0x43) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="380000001800050100000000000000000a000000000000000000000008000400", @ANYRES32, @ANYBLOB="0600150006000000ffff16800800010000000000ffd850bd9d1c1e9e0c56fcfd014242f77032dd7af31a91215ae9e44d31cdd4da6e981b26ef1952f200037c71f63d55c8e3878f6f9c38f0fab5ac21f2bd3d7a172e9df6bc"], 0x38}}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'rr\x00'}, 0x2c) r7 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000900)={'wlan1\x00', 0x0}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x320, 0xa, 0x148, 0x368, 0x60, 0x400, 0x2a8, 0x2a8, 0x400, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00'}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f8) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="98030000", @ANYRES16=r9, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r11, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c0900005603330080b0c000ffffffffffff0802110000010569ea7fa08e8df3d0edd086922799ded6be01d09a95b66d3d"], 0x398}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r10, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000780)={&(0x7f0000000880)=ANY=[@ANYBLOB="34000000130a010200000000000000000100000008000340000056f56a6f3300040900020073c98b271858ced6c3000e0073"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x10) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000200)={0x0, @remote, @broadcast}, &(0x7f00000004c0)=0xc) sendto$packet(r4, &(0x7f0000000340)="bdc1bfd0f82f03000000000000005c14de9cb2eda43089a0392a6fefa804f41cdf672cc31502c73b5ee139a01d2c28665badb4e47bffd7a487523b5ed3a5640f4ad488898969c3d9aa2fa950fd19381b2933d2170a42b8e60d7d9b7bca3fa1f080f86c5224f21dbb3713c30ee4aaa9923439cbf9657e106522f5d7392b572fded69b2938a8e47a860dc93540df993d37cef26d0b94a391682407870a8b6e099816dfbe8f0432e7f7ec", 0xa9, 0x20040005, &(0x7f0000000500)={0x11, 0x2, r12, 0x1, 0x67}, 0x14) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) 2.624230809s ago: executing program 0 (id=3699): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0xfffffffffffffc2b}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r3}, &(0x7f0000000a00), &(0x7f0000000a40)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r3}, &(0x7f0000000880), &(0x7f00000008c0)=r2}, 0x20) r4 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) unshare(0x6020400) ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f00000016c0)={{r5}, 0x0, 0x6}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_DUMPHMAC(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x301}, 0x14}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) socket$netlink(0x10, 0x3, 0x15) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000e4f33a8d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300005150bc908500000071000000850000007d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000500)='jbd2_handle_stats\x00', r9}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) 2.383883799s ago: executing program 0 (id=3702): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) accept(0xffffffffffffffff, 0x0, 0x0) unshare(0x20040600) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0xd, 0x4, 0x4, 0x9, 0x150, r1}, 0x48) bpf$MAP_UPDATE_BATCH(0x19, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r2}, 0x38) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DISASSOCIATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="110000000000000000002800000008000300", @ANYRES32=r6, @ANYBLOB="0a000600505050545050000006003600"], 0x30}}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xf101}) close(r7) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f00000004c0)='kfree\x00', r8}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) accept(0xffffffffffffffff, 0x0, 0x0) (async) unshare(0x20040600) (async) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0xd, 0x4, 0x4, 0x9, 0x150, r1}, 0x48) (async) bpf$MAP_UPDATE_BATCH(0x19, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r2}, 0x38) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000740)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_DISASSOCIATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="110000000000000000002800000008000300", @ANYRES32=r6, @ANYBLOB="0a000600505050545050000006003600"], 0x30}}, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xf101}) (async) close(r7) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f00000004c0)='kfree\x00', r8}, 0x10) (async) 2.22392319s ago: executing program 3 (id=3703): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000800)=@filter={'filter\x00', 0x42, 0x4, 0x308, 0xffffffff, 0xc8, 0xc8, 0x230, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x5, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00'}, 0x74000002, 0xa0, 0xc8, 0x1ba, {0x46010000, 0x2c000000000000}, [@common=@addrtype={{0x30}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x287, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'bridge_slave_0\x00', {}, 'ip6erspan0\x00'}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0xa8}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x368) 2.147071833s ago: executing program 3 (id=3704): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000001c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x0, 0x2, 'syz2\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x85}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r2 = socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(r2, &(0x7f0000000100)={0x0, 0x2c00, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448cb, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) epoll_create1(0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x14, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}}, 0x11) socket$packet(0x11, 0x0, 0x300) openat$cgroup_ro(r0, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_service_time\x00', 0x7a05, 0x1700) socket$nl_generic(0x10, 0x3, 0x10) 2.071197445s ago: executing program 4 (id=3705): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x1800}, 0x48) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x46, &(0x7f00000004c0)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb0831dd6431d36b1cebb305923ea0da00450000380000000000019078ac1e0001ac1414aa030090781200183f2f00000000000000000100007f0000017f00000100186371ae9b1c03feb11442849c95d39a8fb66ba6b82e65240994464447ca8d57fb754f538d5117abe6934c5447658a3af2b5e1ac5b644af28a6b546318ac2544dffaa5090674921a3d9ab6899e8c0ee0a746a658e06e8c6a871816cff27aa931bb4ad621f5cce3ce758d2e8d63252c71ebe1bd6635a873d8a7b9015a3ee003fe288972f494118f50bc0f679f9999b48c67f8093e11360d49cada557dea92855796897ab17d1a19b3d5396163063b1a41bc33333827a8"], 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000001dc0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-serpent-avx\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x12, 0x4, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000000000000711209000000000095000000a57551003f1e6a43972dbe8a99f6000000004715fae0be8d719a7e2f5e9ce771ad37e6dc01f99d6c51fb4e252cd692735d4dcee58788cc2d6ed47d22ac78ed71120758a87908f62a32614cd1fa047b6513de603922b22009a7b1e07bba"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x90) socket$inet6(0xa, 0x4, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000880)={0x0, 0xa4}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000280)="89000000120081ae08060cdc030ec0007f03e3f70000000000e272f750375ed08a56331dbf9ed7a15e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800020004000000bdad446b9bbc7ace5b0dd385dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff00"/137, 0x89}], 0x1}, 0x0) recvmsg$kcm(r5, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x6b}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000}, 0x8) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_SURVEY(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="210300000000000000003200000008000300", @ANYRES32=r6], 0x1c}}, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r7, &(0x7f0000000440)={0x1f, 0x2, @none, 0xfffe, 0x2}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000640)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf20000000000000070000000f0000002d030100000000007300ffb1000000006926000000000000bf67000000000000150002000fff52004507000010000000d60600000ee60000bf0500000000000073700000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8473e2060d60bb39d0af449deaa27ea949e8f9000d885dfea2783835e29eb532ba8546fc020c196738b5f32b095f5d5b196b9e8d897e461c01c697671d1000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) 2.040963007s ago: executing program 0 (id=3706): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) shutdown(r0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x28}}, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$key(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020408080d002000000000000000000002000a000100000600000000000000000500b74538ad000000000a0000000000000aff0200000000000000000000000000015f0001000000000002000000000000000000000002000b000300000003000000000000000000"], 0x68}}, 0x4000800) sendmsg$AUDIT_USER(r2, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@bloom_filter={0x1e, 0x6, 0x3ff, 0x8, 0x404, 0x1, 0x8, '\x00', 0x0, r1, 0x44, 0x2, 0x5, 0x5}, 0x48) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x13, 0x4, 0x5e2, 0xacc}, 0x48) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x8, &(0x7f0000000080)=@framed={{0x18, 0x3, 0x0, 0x0, 0xffff}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd, @exit, @alu={0x4, 0x0, 0x9, 0x3, 0x1, 0x30, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x802}, 0x90) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@dellink={0x7c, 0x11, 0x200, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r5, 0x12, 0x2c00}, [@IFLA_AF_SPEC={0x4c, 0x1a, 0x0, 0x1, [@AF_INET6={0x0, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x0, 0x7, @loopback}, @IFLA_INET6_TOKEN={0x0, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0x0, 0x7, @ipv4={'\x00', '\xff\xff', @multicast1}}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x9}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x8}, @IFLA_INET6_TOKEN={0x0, 0x7, @mcast1}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xea}]}, @AF_BRIDGE={0x4}, @AF_INET6={0x40, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @empty}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0xfffffffffffffe84, 0x7, @remote}]}]}, @IFLA_LINK_NETNSID={0x8, 0x25, 0x3}, @IFLA_PHYS_PORT_ID={0x30, 0x22, "1971cb8125f3cf567a7a41943b50a720a1c82af40044"}]}, 0x7c}}, 0x0) read(0xffffffffffffffff, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$netlink(0x10, 0x3, 0x9) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e0000000800000000001800038014"], 0x44}}, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x0}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x296, &(0x7f0000000c40)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100100086dd69141d1e025806fcfc020000000000000800000000000000fe8000000000000000000000000000bb5e080001ae050000000000000000000000000000000000000001fc000000000000000000000000000001fc000000000000000000000000000001fe8000000000000000000000000000aa5c3b000000000000c2040000020001c154f5ad786e004462c20c51172f12b09226d72a7c0204cd4c72797ecb626e1a8090642691099850f9a341743a695a63f5ad04320542a12ec269838f3e11ba6c163a9742f5fb73b422e75b3d455d108f010eb47653b05c599f011b47ed4f80c3c3ab3a70f39077d8a3781e8e046afe886dc65b2edc06467d030497049408b38fb6daf2c23b2f5d8a4bf8b0098bcd4bbdc64d2bcaf40924942e80f563deaf3606e3ac555e221f36669b6c7de226d0fbeef5fb05d159abfb528bc0bac35629756127b8c910fe8000000000000000000000000000bb079fc103a71a5effae768d7d0bbb596fcdfe82ff40416992f8908957a34711161f0a96a06899e7eea92738f3665d7e3e61659ecfa9f075a8293db1259c0dbea451fb103994c4ab4b94f9660895e0e5de89d7f95fa2be1975fae2c957516730601a397a655c82c6325cb3cab8ac2984435ae16bee03f64808d24261fc5eee18bd84d60f298f2b4b0eca79a2ce4a358dc1a07a6f7a1b59b530ee58cc0adeea77322f050204010401032c5a9d4bb4152c65f30567ff654ef91e09bfdb6ec0dfc6d6a45942c0d0fac4f89c130cfc27a8f36038bcbd0de55c516f287ae2475c7d7c7842ae30a0a376e7d11f8ab0e4971acafe5587407d79d1d762f7e480ff831a2a48932ec4cc000000000000000000000000000000000300004e2100004e240000000400000002000000000000aa996e72be3520f596d06d9a9e2be3ae2d4d67b62a141ece95591b49300887b154b920af5d0d6522f89cb9921838c672c3c6c6869fd227f69313d6d39e6845fcf568a171f7e2caf9719c3764e6719121f453e3244db6beaa72f28662b84b06e00db4e19e12254f78a4245cb4d1bb42ce28dbfee15e207468229dd324cc"], 0x0) 1.891239916s ago: executing program 3 (id=3707): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000cc0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0xcc, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @local}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x38, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x4}]}, @CTA_NAT_V6_MINIP={0x14, 0x4, @empty}]}]}, 0xcc}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000040)=0xb7, 0x4) bind$inet(r2, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r2, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x1e, 0x4, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r4) sendmsg$NFC_CMD_GET_TARGET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r5, 0x1}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r4) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000600000008000100000000000c000d000000000b"], 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000001900)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000001940)={0x24, 0x0, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x42) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f00000002c0)={0x6}, 0x1) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan4\x00'}) 1.783725334s ago: executing program 4 (id=3708): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pipe(0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@bloom_filter={0x1e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x3c, r1, 0x303, 0x0, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="180000190000000002000000000000001840000002000000000000000000000095000000000000009500000000000200"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x14, &(0x7f0000000600), 0x2}, 0x80) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) 1.715348912s ago: executing program 0 (id=3709): syz_open_procfs$namespace(0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000386dd0a00100000004000000060ec970000288900fe800040000000000000f00f000000aaff020000000000000000000000000001"], 0xffe) 1.714859s ago: executing program 2 (id=3353): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8}, 0x48) ioctl$sock_netdev_private(0xffffffffffffffff, 0x9, &(0x7f0000000240)="8c698157ec55213e2f39514faca1554a79ecc88da74041764c35e4e0cffac2e1f7dbbd738560caaa18e2c37f91ddb2250488965fb018a963cfa89e837962a651bbfa9c7db3d0ad90e0c0fae8f6273201fd5a9024697e1b1107d6debe458c871775ceeafe747bdf8454022ec1dcac301b05c23a8d") r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x6c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x50, 0x33, @beacon={{{}, {}, @device_b, @device_b}, 0x0, @random, 0x0, @void, @val, @val={0x3, 0x1}, @void, @void, @val={0x5, 0x3}, @void, @void, @val={0x3c, 0x4}, @void, @void, @void, @val={0x76, 0x6}, [{0xdd, 0x6, "31851c27f051"}, {0xdd, 0x6, "30d8ac98fded"}]}}]}, 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x4000080) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cgroup.controllers\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=r8, @ANYBLOB="0000010000000000140012800b0001006d61637365630000040002801c001a801800028014000180080016"], 0x50}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a800000013000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00280a000060001980140004006b2e4f2fdd8733dc1c1639228919eb5e2efc02007b5d2f215d290000140005004af57c15cd92d389e606fce6a0eebda514000400f4d8d35abbd4fab3a3614be8a496bd8f140005008ebcd2c7e1cf0421ab20db4c32c4330605001000040000001400030076657468315f6d616376746170"], 0xa8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@llx, {0x3, 0x0, 0x3, 0xa, 0x0}, {0x5}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x8}}, @printk={@p, {0x5, 0x3, 0x6, 0xa, 0x1, 0xfff5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 884.474822ms ago: executing program 0 (id=3710): syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) 883.561373ms ago: executing program 3 (id=3711): epoll_create(0xffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x25, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) ioctl$PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000000)=0x3) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_INDEX={0x8}]}}}]}, 0x4c}}, 0x0) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f00000000c0), 0x4) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000003"], 0x1c) setsockopt$inet_mreqn(r4, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) recvfrom$inet(r1, &(0x7f0000000080)=""/82, 0x52, 0x40000022, &(0x7f0000000100)={0x2, 0x4e23, @loopback}, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)={0x80, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_SEQ_ADJ_REPLY={0x1c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}, @CTA_SEQADJ_OFFSET_AFTER={0x8}]}]}, 0x80}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet_int(r6, 0x0, 0x13, &(0x7f0000000000)=0xfffffbfa, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}], 0x1c) r7 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r7, &(0x7f0000000100)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r7, 0x6, 0x1e, &(0x7f0000000040)=0x1, 0x4) connect$inet(r7, &(0x7f0000000000)={0x2, 0x0, @local}, 0x72) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0) r9 = accept(r8, 0x0, 0x0) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f0000000040)=""/31, 0x1f}], 0x48}, 0x0) listen(r6, 0xff8c) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, 0x3, 0x1, 0x401, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) 882.764955ms ago: executing program 4 (id=3712): sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x6a) r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a802e8c6394f90424fc60100005000b000900053582c137153e37000c0280fc0b1d02f80b", 0x33fe0}], 0x1}, 0x0) (fail_nth: 9) 355.312028ms ago: executing program 4 (id=3713): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x8, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 344.537324ms ago: executing program 0 (id=3714): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000200)="18", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) sendmsg$inet6(r0, &(0x7f0000000580)={&(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000080)=' ', 0x1}], 0x1}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008900000095000000000000001b7315d43b90037161e573d8dee4a8018b5f60b9969eec3b2344dd6f28997400fbcfa234f96c71d1ca3464ca1fe516cc2ca6c2873840a8c724a765c01618b6006e306b740b200545dd3f906e0045a7d49c058d5413e84e3ee9b6ffd13dde0be8110ffca3812534b8373b4d", @ANYBLOB="04815f034ac958ba7d0785e4ebbafa6baf356cf198854b03504b123858e6c8a6eb4ac0e9fe201483de1b350d6342b4cfb2ea53a1f74c24617c5c0fedefd41085870f7c36"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000a40)=ANY=[@ANYBLOB="340000001c00040028bd70000400000000000000", @ANYRES32=0x0, @ANYBLOB="80002508080007000500000008000b00020000000800040080000000a35a6f9b3ff0b7c948f5d4305708613d7af82853894659ffe09edd75d89ddf1a57c25c230f2457c0996c740b7bc6175b7321d6556e9beed64e780250df9a82aeac73c357b4cb2cef1b14af2ebf70"], 0x34}, 0x1, 0x0, 0x0, 0x6000081}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x3aeb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000680)=ANY=[], 0x43) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="380000001800050100000000000000000a000000000000000000000008000400", @ANYRES32=r6, @ANYBLOB="0600150006000000ffff16800800010000000000ffd850bd9d1c1e9e0c56fcfd014242f77032dd7af31a91215ae9e44d31cdd4da6e981b26ef1952f200037c71f63d55c8e3878f6f9c38f0fab5ac21f2bd3d7a172e9df6bc"], 0x38}}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'rr\x00'}, 0x2c) r8 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000900)={'wlan1\x00', 0x0}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x320, 0xa, 0x148, 0x368, 0x60, 0x400, 0x2a8, 0x2a8, 0x400, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00'}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f8) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="98030000", @ANYRES16=r10, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r12, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c0900005603330080b0c000ffffffffffff0802110000010569ea7fa08e8df3d0edd086922799ded6be01d09a95b66d3d"], 0x398}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r11, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000780)={&(0x7f0000000880)=ANY=[@ANYBLOB="34000000130a010200000000000000000100000008000340000056f56a6f3300040900020073c98b271858ced6c3000e0073"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x10) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000200)={0x0, @remote, @broadcast}, &(0x7f00000004c0)=0xc) sendto$packet(r4, &(0x7f0000000340)="bdc1bfd0f82f03000000000000005c14de9cb2eda43089a0392a6fefa804f41cdf672cc31502c73b5ee139a01d2c28665badb4e47bffd7a487523b5ed3a5640f4ad488898969c3d9aa2fa950fd19381b2933d2170a42b8e60d7d9b7bca3fa1f080f86c5224f21dbb3713c30ee4aaa9923439cbf9657e106522f5d7392b572fded69b2938a8e47a860dc93540df993d37cef26d0b94a391682407870a8b6e099816dfbe8f0432e7f7ec", 0xa9, 0x20040005, &(0x7f0000000500)={0x11, 0x2, r13, 0x1, 0x67}, 0x14) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) 130.039523ms ago: executing program 4 (id=3715): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000800)=@filter={'filter\x00', 0x42, 0x4, 0x340, 0xffffffff, 0xc8, 0xc8, 0x230, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x5, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x287, 0x140, 0x168, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'wg0\x00', {}, 'ipvlan1\x00'}}, @common=@unspec=@physdev={{0x68}, {'bridge_slave_0\x00', {}, 'ip6erspan0\x00'}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0xa8}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x3a0) 67.328353ms ago: executing program 3 (id=3716): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000000000004003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001"], 0x448}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'gretap0\x00', &(0x7f0000000400)={'gretap0\x00', 0x0, 0x20, 0x80, 0x6, 0x8, {{0x16, 0x4, 0x1, 0x3, 0x58, 0x66, 0x0, 0x1, 0x29, 0x0, @private=0xa010101, @local, {[@timestamp_addr={0x44, 0x44, 0x72, 0x1, 0x9, [{@local, 0x4}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x8b96}, {@broadcast, 0x6}, {@local, 0xfd1e}, {@dev={0xac, 0x14, 0x14, 0x12}, 0x2}, {@multicast2}, {@broadcast, 0x6}, {@remote, 0x852}]}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xd2ef8b37a4f0bcb5, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r4, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000000)={r4, &(0x7f00000002c0), &(0x7f00000002c0)=""/157}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r4, &(0x7f0000000000), &(0x7f00000002c0)=""/255}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'batadv_slave_0\x00'}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f00002f6000/0x4000)=nil, 0x4000, 0x100000a, 0x28011, r5, 0x46861000) preadv(r5, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0xffffff95, 0x0, 0xffffffffffffffff, 0xd}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r6, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e, 0x8, 0x0, 0x0}}, 0x10) r8 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)={r7}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x0, 0xe, 0x0, &(0x7f0000001680)="63eced8e46dc3fad77b7b3f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x2, 0x0, [], 0x0, 0x0, 0x0}, 0xa1) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r9, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r9, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) 0s ago: executing program 4 (id=3717): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000001c0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x0, 0x2, 'syz2\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x85}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(r3, &(0x7f0000000100)={0x0, 0x2c00, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x47, &(0x7f00000002c0)=ANY=[@ANYRES8=r2], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448cb, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) epoll_create1(0x0) sendmsg$TIPC_NL_NAME_TABLE_GET(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x14, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}}, 0x11) socket$packet(0x11, 0x0, 0x300) openat$cgroup_ro(r0, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_service_time\x00', 0x7a05, 0x1700) socket$nl_generic(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): registering): (slave bond_slave_0): Releasing backup interface [ 416.673885][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 416.685978][ T63] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 416.697134][ T63] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 416.712906][ T63] bond0 (unregistering): (slave macvlan4): Releasing backup interface [ 416.725523][ T63] bond0 (unregistering): Released all slaves [ 416.767765][T17308] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.775127][T17308] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.791185][T17308] bridge_slave_0: entered allmulticast mode [ 416.801032][T17308] bridge_slave_0: entered promiscuous mode [ 416.810844][T17308] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.818072][T17308] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.825667][T17308] bridge_slave_1: entered allmulticast mode [ 416.833449][T17308] bridge_slave_1: entered promiscuous mode [ 416.867479][T17308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 416.879697][T17308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 416.914542][T17308] team0: Port device team_slave_0 added [ 416.928522][T17308] team0: Port device team_slave_1 added [ 416.966371][T17308] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 416.975596][T17308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 417.003331][T17308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 417.040868][T17308] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 417.047858][T17308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 417.094280][T17308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 417.148484][T17323] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3357'. [ 417.304317][T17323] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3357'. [ 417.325074][T17328] validate_nla: 3 callbacks suppressed [ 417.325096][T17328] netlink: 'syz.4.3359': attribute type 1 has an invalid length. [ 417.456300][T17326] netlink: 'syz.4.3359': attribute type 13 has an invalid length. [ 417.481346][ T5241] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 417.492530][ T5241] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 417.506025][ T5241] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 417.525879][ T25] net_ratelimit: 1 callbacks suppressed [ 417.525900][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.541724][ T63] dummy0: left promiscuous mode [ 417.564986][ T5241] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 417.574959][ T5241] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 417.582497][ T5241] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 417.591863][ T63] hsr_slave_0: left promiscuous mode [ 417.615297][ T63] hsr_slave_1: left promiscuous mode [ 417.641869][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 417.645133][T17336] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 417.661811][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 417.681090][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 417.698436][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 417.754357][ T63] vlan1: left promiscuous mode [ 417.760653][T17343] netlink: 'syz.0.3362': attribute type 1 has an invalid length. [ 417.765011][ T63] veth1_vlan: left promiscuous mode [ 417.778156][ T63] veth0_vlan: left promiscuous mode [ 417.781946][T17343] netlink: 'syz.0.3362': attribute type 13 has an invalid length. [ 417.841469][ T5240] Bluetooth: hci0: command tx timeout [ 417.916955][ T63] team0 (unregistering): Port device macvlan6 removed [ 417.943155][ T63] team0 (unregistering): Port device macvlan5 removed [ 417.976234][ T63] team0 (unregistering): Port device macvlan3 removed [ 417.996757][ T63] team0 (unregistering): Port device macvlan2 removed [ 417.999480][ T2478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.013030][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.044842][ T63] pim6reg (unregistering): left allmulticast mode [ 418.355086][ T63] team0 (unregistering): Port device team_slave_1 removed [ 418.401563][ T63] team0 (unregistering): Port device team_slave_0 removed [ 418.563660][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.646369][T17283] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.655087][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.738452][T17308] hsr_slave_0: entered promiscuous mode [ 418.746794][T17308] hsr_slave_1: entered promiscuous mode [ 418.758536][T17308] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 418.776946][T17308] Cannot create hsr debugfs directory [ 419.203238][T17362] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 419.210725][T17362] IPv6: NLM_F_CREATE should be set when creating new route [ 419.218041][T17362] IPv6: NLM_F_CREATE should be set when creating new route [ 419.232746][T17359] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3371'. [ 419.321197][ C0] eth0: bad gso: type: 1, size: 1408 [ 419.336636][T17366] macvlan2: entered allmulticast mode [ 419.345769][T17366] mac80211_hwsim hwsim33 wlan0: entered promiscuous mode [ 419.362579][T17366] mac80211_hwsim hwsim33 wlan0: entered allmulticast mode [ 419.383521][T17366] bond0: (slave macvlan2): Enslaving as an active interface with an up link [ 419.459114][ T63] IPVS: stop unused estimator thread 0... [ 419.552542][T17375] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 419.609213][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.634472][T17373] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3375'. [ 419.680137][ T5240] Bluetooth: hci1: command tx timeout [ 419.752325][T17329] chnl_net:caif_netlink_parms(): no params data found [ 419.862053][T17387] netlink: 'syz.0.3378': attribute type 1 has an invalid length. [ 419.885987][T17387] netlink: 'syz.0.3378': attribute type 13 has an invalid length. [ 419.919682][ T5240] Bluetooth: hci0: command tx timeout [ 419.923357][ T63] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 419.966501][T17392] netlink: 'syz.4.3380': attribute type 1 has an invalid length. [ 419.995196][T17391] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3381'. [ 420.005202][T17391] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3381'. [ 420.067830][T17392] netlink: 'syz.4.3380': attribute type 13 has an invalid length. [ 420.111983][ T63] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.150964][T17395] FAULT_INJECTION: forcing a failure. [ 420.150964][T17395] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 420.205227][T17395] CPU: 1 UID: 0 PID: 17395 Comm: syz.3.3383 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 420.215669][T17395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 420.225731][T17395] Call Trace: [ 420.229009][T17395] [ 420.231934][T17395] dump_stack_lvl+0x241/0x360 [ 420.236614][T17395] ? __pfx_dump_stack_lvl+0x10/0x10 [ 420.241810][T17395] ? __pfx__printk+0x10/0x10 [ 420.246395][T17395] ? __pfx_lock_release+0x10/0x10 [ 420.251422][T17395] should_fail_ex+0x3b0/0x4e0 [ 420.256103][T17395] _copy_from_user+0x2f/0xe0 [ 420.260696][T17395] copy_msghdr_from_user+0xae/0x680 [ 420.265894][T17395] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 420.271705][T17395] __sys_sendmsg+0x23d/0x3a0 [ 420.276297][T17395] ? __pfx___sys_sendmsg+0x10/0x10 [ 420.281404][T17395] ? vfs_write+0x7c4/0xc90 [ 420.285850][T17395] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 420.292180][T17395] ? do_syscall_64+0x100/0x230 [ 420.297030][T17395] ? do_syscall_64+0xb6/0x230 [ 420.301705][T17395] do_syscall_64+0xf3/0x230 [ 420.306206][T17395] ? clear_bhb_loop+0x35/0x90 [ 420.310881][T17395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.316859][T17395] RIP: 0033:0x7ff8d75773b9 [ 420.321278][T17395] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.340881][T17395] RSP: 002b:00007ff8d8349048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 420.349293][T17395] RAX: ffffffffffffffda RBX: 00007ff8d7705f80 RCX: 00007ff8d75773b9 [ 420.357257][T17395] RDX: 0000000000000000 RSI: 00000000200006c0 RDI: 0000000000000003 [ 420.365220][T17395] RBP: 00007ff8d83490a0 R08: 0000000000000000 R09: 0000000000000000 [ 420.373185][T17395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 420.381146][T17395] R13: 000000000000004d R14: 00007ff8d7705f80 R15: 00007ffdf8a09958 [ 420.389139][T17395] [ 420.464369][ T63] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.546443][T17400] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3384'. [ 420.557539][T17405] hsr_slave_0: left promiscuous mode [ 420.574260][T17405] hsr_slave_1: left promiscuous mode [ 420.680588][ T63] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.722569][T17329] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.746258][T17329] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.754718][T17329] bridge_slave_0: entered allmulticast mode [ 420.762635][T17329] bridge_slave_0: entered promiscuous mode [ 420.770318][T17308] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 420.781173][T17308] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 420.827065][T17329] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.852752][T17329] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.866877][T17329] bridge_slave_1: entered allmulticast mode [ 420.890534][T17329] bridge_slave_1: entered promiscuous mode [ 420.937653][T17308] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 420.967602][T17308] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 420.992368][T17418] netlink: 'syz.0.3387': attribute type 10 has an invalid length. [ 421.000753][T17418] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3387'. [ 421.039754][T17329] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.052396][T17329] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.170584][T17329] team0: Port device team_slave_0 added [ 421.231115][T17329] team0: Port device team_slave_1 added [ 421.314265][ T63] bridge_slave_1: left allmulticast mode [ 421.321845][ T63] bridge_slave_1: left promiscuous mode [ 421.327691][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 421.340750][ T63] bridge_slave_0: left allmulticast mode [ 421.353823][ T63] bridge_slave_0: left promiscuous mode [ 421.362135][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 421.477239][T17436] netlink: 'syz.0.3393': attribute type 1 has an invalid length. [ 421.759036][ T5240] Bluetooth: hci1: command tx timeout [ 421.765078][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 421.778058][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 421.789385][ T63] bond0 (unregistering): Released all slaves [ 421.811679][T17329] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.818719][T17329] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 421.849278][T17329] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 421.927010][T17329] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 421.934228][T17329] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 421.971952][T17329] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 422.000129][ T5240] Bluetooth: hci0: command tx timeout [ 422.219542][T17329] hsr_slave_0: entered promiscuous mode [ 422.237031][T17329] hsr_slave_1: entered promiscuous mode [ 422.248414][T17329] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 422.261607][T17329] Cannot create hsr debugfs directory [ 422.429112][T17443] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3396'. [ 422.501675][ T63] hsr_slave_0: left promiscuous mode [ 422.519986][ T63] hsr_slave_1: left promiscuous mode [ 422.532306][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 422.549060][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 422.570935][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 422.578527][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 422.633362][ T63] veth1_macvtap: left promiscuous mode [ 422.642761][ T63] veth0_macvtap: left promiscuous mode [ 422.648529][ T63] veth1_vlan: left promiscuous mode [ 422.654948][ T63] veth0_vlan: left promiscuous mode [ 422.677067][T17463] validate_nla: 1 callbacks suppressed [ 422.677085][T17463] netlink: 'syz.4.3401': attribute type 1 has an invalid length. [ 422.719435][ T5281] net_ratelimit: 5 callbacks suppressed [ 422.719455][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.776540][T17465] netlink: 'syz.4.3401': attribute type 13 has an invalid length. [ 423.245700][ T63] team0 (unregistering): Port device team_slave_1 removed [ 423.288397][ T63] team0 (unregistering): Port device team_slave_0 removed [ 423.760350][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.836127][T17308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 423.839112][ T5240] Bluetooth: hci1: command tx timeout [ 424.016943][T17480] netlink: 'syz.4.3408': attribute type 1 has an invalid length. [ 424.067971][T17308] 8021q: adding VLAN 0 to HW filter on device team0 [ 424.080150][ T5240] Bluetooth: hci0: command tx timeout [ 424.116872][T17482] netlink: 'syz.4.3408': attribute type 13 has an invalid length. [ 424.136977][T17484] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 424.153163][ T5281] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.160354][ T5281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 424.175789][ T5281] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.183118][ T5281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.242064][T17486] FAULT_INJECTION: forcing a failure. [ 424.242064][T17486] name failslab, interval 1, probability 0, space 0, times 0 [ 424.261010][T17486] CPU: 0 UID: 0 PID: 17486 Comm: syz.0.3410 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 424.271551][T17486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 424.281630][T17486] Call Trace: [ 424.285016][T17486] [ 424.286113][T17308] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 424.287953][T17486] dump_stack_lvl+0x241/0x360 [ 424.287987][T17486] ? __pfx_dump_stack_lvl+0x10/0x10 [ 424.298440][T17308] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 424.302928][T17486] ? __pfx__printk+0x10/0x10 [ 424.302964][T17486] ? ref_tracker_alloc+0x332/0x490 [ 424.302995][T17486] should_fail_ex+0x3b0/0x4e0 [ 424.332874][T17486] ? skb_clone+0x20c/0x390 [ 424.337333][T17486] should_failslab+0xac/0x100 [ 424.342049][T17486] ? skb_clone+0x20c/0x390 [ 424.346497][T17486] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 424.351990][T17486] skb_clone+0x20c/0x390 [ 424.356275][T17486] __netlink_deliver_tap+0x3cc/0x7c0 [ 424.361610][T17486] ? netlink_deliver_tap+0x2e/0x1b0 [ 424.366845][T17486] netlink_deliver_tap+0x19d/0x1b0 [ 424.371990][T17486] netlink_sendskb+0x68/0x140 [ 424.376819][T17486] netlink_unicast+0x39d/0x990 [ 424.381602][T17486] ? __asan_memcpy+0x40/0x70 [ 424.386230][T17486] ? __pfx_netlink_unicast+0x10/0x10 [ 424.391543][T17486] netlink_rcv_skb+0x262/0x430 [ 424.396350][T17486] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 424.401841][T17486] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 424.407163][T17486] ? apparmor_capable+0x138/0x1b0 [ 424.412219][T17486] ? bpf_lsm_capable+0x9/0x10 [ 424.416920][T17486] ? security_capable+0x90/0xb0 [ 424.421810][T17486] nfnetlink_rcv+0x297/0x2a90 [ 424.426530][T17486] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 424.432543][T17486] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 424.438903][T17486] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 424.444825][T17486] ? lockdep_hardirqs_on+0x99/0x150 [ 424.450051][T17486] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 424.455191][T17486] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 424.461107][T17486] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 424.463620][T17308] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 424.467446][T17486] ? rcu_preempt_deferred_qs_irqrestore+0x87b/0xc70 [ 424.480807][T17486] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 424.487769][T17486] ? rcu_is_watching+0x15/0xb0 [ 424.492564][T17486] ? rcu_read_unlock_special+0x470/0x550 [ 424.498222][T17486] ? skb_clone+0x240/0x390 [ 424.502669][T17486] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 424.508676][T17486] ? __netlink_deliver_tap+0x77e/0x7c0 [ 424.514173][T17486] ? __rcu_read_unlock+0xa1/0x110 [ 424.515911][T17308] veth0_vlan: entered promiscuous mode [ 424.519203][T17486] netlink_unicast+0x7f0/0x990 [ 424.519236][T17486] ? __pfx_netlink_unicast+0x10/0x10 [ 424.519253][T17486] ? __virt_addr_valid+0x183/0x530 [ 424.519276][T17486] ? __check_object_size+0x49c/0x900 [ 424.519295][T17486] ? bpf_lsm_netlink_send+0x9/0x10 [ 424.519321][T17486] netlink_sendmsg+0x8e4/0xcb0 [ 424.555143][T17486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 424.560455][T17486] ? __import_iovec+0x536/0x820 [ 424.565334][T17486] ? aa_sock_msg_perm+0x91/0x160 [ 424.570301][T17486] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 424.575615][T17486] ? security_socket_sendmsg+0x87/0xb0 [ 424.581094][T17486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 424.586404][T17486] __sock_sendmsg+0x221/0x270 [ 424.588388][T17308] veth1_vlan: entered promiscuous mode [ 424.591086][T17486] ____sys_sendmsg+0x525/0x7d0 [ 424.591127][T17486] ? __pfx_____sys_sendmsg+0x10/0x10 [ 424.606641][T17486] __sys_sendmsg+0x2b0/0x3a0 [ 424.611266][T17486] ? __pfx___sys_sendmsg+0x10/0x10 [ 424.616401][T17486] ? vfs_write+0x7c4/0xc90 [ 424.620897][T17486] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 424.627256][T17486] ? do_syscall_64+0x100/0x230 [ 424.632050][T17486] ? do_syscall_64+0xb6/0x230 [ 424.634964][T17308] veth0_macvtap: entered promiscuous mode [ 424.636735][T17486] do_syscall_64+0xf3/0x230 [ 424.636763][T17486] ? clear_bhb_loop+0x35/0x90 [ 424.647400][T17308] veth1_macvtap: entered promiscuous mode [ 424.651597][T17486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.651627][T17486] RIP: 0033:0x7f2942b773b9 [ 424.651646][T17486] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 424.682306][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 424.687297][T17486] RSP: 002b:00007f29439fc048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 424.687325][T17486] RAX: ffffffffffffffda RBX: 00007f2942d05f80 RCX: 00007f2942b773b9 [ 424.687340][T17486] RDX: 0000000000000000 RSI: 0000000020000740 RDI: 0000000000000003 [ 424.699809][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 424.706102][T17486] RBP: 00007f29439fc0a0 R08: 0000000000000000 R09: 0000000000000000 [ 424.706120][T17486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.706132][T17486] R13: 000000000000004d R14: 00007f2942d05f80 R15: 00007fffd38a8388 [ 424.714212][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 424.722046][T17486] [ 424.772814][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 424.790073][T17283] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.798341][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.807187][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.824541][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 424.835510][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 424.845445][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 424.855919][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 424.875693][T17308] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 424.930979][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 424.950359][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 424.969651][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 425.004111][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 425.022637][T17308] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 425.039665][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.046147][T17308] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 425.061917][T17308] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 425.082223][T17308] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.101822][T17308] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.126986][T17308] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.147013][T17308] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.184484][T17500] netlink: 'syz.0.3415': attribute type 10 has an invalid length. [ 425.196624][T17500] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3415'. [ 425.229046][T17500] team0: entered promiscuous mode [ 425.234129][T17500] team_slave_0: entered promiscuous mode [ 425.260511][T17500] team_slave_1: entered promiscuous mode [ 425.364272][T17329] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 425.396434][T17329] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 425.440363][T17329] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 425.488252][T17329] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 425.528071][T17284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.545044][T17284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.621121][ T2478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.645662][ T2478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.704573][T17518] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3422'. [ 425.802124][T17329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 425.835299][T17329] 8021q: adding VLAN 0 to HW filter on device team0 [ 425.850782][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.851825][ T5396] bridge0: port 1(bridge_slave_0) entered blocking state [ 425.866595][ T5396] bridge0: port 1(bridge_slave_0) entered forwarding state [ 425.882922][ T5281] bridge0: port 2(bridge_slave_1) entered blocking state [ 425.890192][ T5281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 425.919805][ T5240] Bluetooth: hci1: command tx timeout [ 425.940555][T17505] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 426.041948][T17329] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 426.237986][T17329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 426.350538][T17329] veth0_vlan: entered promiscuous mode [ 426.366389][T17537] netlink: 'syz.0.3426': attribute type 1 has an invalid length. [ 426.367475][T17329] veth1_vlan: entered promiscuous mode [ 426.391517][T17537] netlink: 'syz.0.3426': attribute type 13 has an invalid length. [ 426.426832][T17329] veth0_macvtap: entered promiscuous mode [ 426.441032][T17329] veth1_macvtap: entered promiscuous mode [ 426.458321][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 426.469706][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.480842][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 426.494103][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.505061][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 426.516358][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.533801][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 426.544919][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.559275][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 426.578864][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.611443][T17329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 426.638749][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 426.665523][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.675965][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 426.694089][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.719240][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 426.749039][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.779353][T17329] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 426.796968][T17329] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 426.816710][T17548] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 426.830233][T17329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 426.874625][T17329] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.885756][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.908478][T17329] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.923494][T17329] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.940205][T17329] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.999712][T17554] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3433'. [ 427.117103][T17560] ebtables: ebtables: counters copy to user failed while replacing table [ 427.221916][T17283] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.237509][T17283] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.277109][T17564] netlink: 'syz.0.3437': attribute type 1 has an invalid length. [ 427.284557][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.309119][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.315685][T17564] netlink: 'syz.0.3437': attribute type 13 has an invalid length. [ 427.527790][T17573] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3441'. [ 427.577153][T17573] vlan3: entered promiscuous mode [ 427.599656][T17573] vlan3: entered allmulticast mode [ 427.696108][T17283] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.779203][T17579] wg2: entered promiscuous mode [ 427.784759][T17579] wg2: entered allmulticast mode [ 427.933527][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.983761][T17590] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3446'. [ 428.097229][T17596] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3447'. [ 428.166115][T17596] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3447'. [ 428.274597][ T5241] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 428.308432][ T5241] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 428.330006][ T5241] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 428.343349][ T5241] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 428.352261][ T5241] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 428.360109][ T5241] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 428.580330][T17602] xt_CT: You must specify a L4 protocol and not use inversions on it [ 428.976029][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.307485][T17621] netlink: 332 bytes leftover after parsing attributes in process `syz.3.3457'. [ 429.322427][T17621] netlink: 652 bytes leftover after parsing attributes in process `syz.3.3457'. [ 429.786786][T17283] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.963795][T17597] chnl_net:caif_netlink_parms(): no params data found [ 430.032443][T17625] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3458'. [ 430.068517][T17625] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3458'. [ 430.111196][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.170156][T15807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.178317][ T5396] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.186491][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.271484][T17283] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.365503][T17597] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.380648][T17597] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.387918][T17597] bridge_slave_0: entered allmulticast mode [ 430.399940][ T5241] Bluetooth: hci0: command tx timeout [ 430.406610][T17597] bridge_slave_0: entered promiscuous mode [ 430.453701][T17283] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.477551][T17597] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.488377][T17597] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.509190][T17597] bridge_slave_1: entered allmulticast mode [ 430.516549][T17597] bridge_slave_1: entered promiscuous mode [ 430.578701][T17597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.600322][T17652] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3463'. [ 430.657838][T17597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 430.740331][T17597] team0: Port device team_slave_0 added [ 430.764218][T17597] team0: Port device team_slave_1 added [ 430.880862][T17597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 430.899986][T17597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 430.962729][T17597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 431.035470][T17597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 431.049167][T17597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 431.085585][T17597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 431.121944][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.160369][T17283] bridge_slave_1: left allmulticast mode [ 431.166151][T17283] bridge_slave_1: left promiscuous mode [ 431.178226][T17283] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.187561][T17283] bridge_slave_0: left allmulticast mode [ 431.193795][T17283] bridge_slave_0: left promiscuous mode [ 431.201675][T17283] bridge0: port 1(bridge_slave_0) entered disabled state [ 431.588178][T17283] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.601515][T17283] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 431.616189][T17283] bond0 (unregistering): Released all slaves [ 431.644790][T17597] hsr_slave_0: entered promiscuous mode [ 431.651367][T17597] hsr_slave_1: entered promiscuous mode [ 431.658100][T17597] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 431.676497][T17597] Cannot create hsr debugfs directory [ 431.946987][T17283] hsr_slave_0: left promiscuous mode [ 431.953962][T17283] hsr_slave_1: left promiscuous mode [ 431.964817][T17283] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 431.973006][T17283] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 431.981765][T17283] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 431.990371][T17283] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 432.011338][T17283] veth1_macvtap: left promiscuous mode [ 432.016869][T17283] veth0_macvtap: left promiscuous mode [ 432.022593][T17283] veth1_vlan: left promiscuous mode [ 432.027886][T17283] veth0_vlan: left promiscuous mode [ 432.080050][T17284] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.088410][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.178308][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.484882][ T5241] Bluetooth: hci0: command tx timeout [ 432.504745][T17283] team0 (unregistering): Port device team_slave_1 removed [ 432.545050][T17283] team0 (unregistering): Port device team_slave_0 removed [ 433.056964][T17687] openvswitch: netlink: Missing key (keys=240, expected=10000000) [ 433.191636][ T5240] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 433.203249][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.213021][ T5240] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 433.221744][ T5240] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 433.222073][T15807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.238148][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.248144][ T5240] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 433.255426][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.266201][ T5240] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 433.274259][ T5240] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 433.686114][T17703] __nla_validate_parse: 3 callbacks suppressed [ 433.686136][T17703] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3480'. [ 433.959677][T17716] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3482'. [ 433.977677][T17715] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3481'. [ 434.009552][T17715] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3481'. [ 434.030961][T17718] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3483'. [ 434.096218][T17722] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3484'. [ 434.107374][T17690] chnl_net:caif_netlink_parms(): no params data found [ 434.152112][T17597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 434.183423][T17597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 434.194427][T17726] xt_recent: Unsupported userspace flags (00000042) [ 434.196027][T17597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 434.272571][T17597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 434.319153][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.367334][T17734] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3486'. [ 434.473899][T17283] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.498580][T17690] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.521405][T17690] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.529638][T17690] bridge_slave_0: entered allmulticast mode [ 434.536995][T17690] bridge_slave_0: entered promiscuous mode [ 434.560822][ T5241] Bluetooth: hci0: command tx timeout [ 434.600158][T17283] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.626761][T17690] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.658803][T17690] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.666338][T17690] bridge_slave_1: entered allmulticast mode [ 434.683063][T17690] bridge_slave_1: entered promiscuous mode [ 434.736445][T17744] dvmrp0: entered allmulticast mode [ 434.767948][T17283] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.837306][T17690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 434.859558][T17690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 434.917219][T17283] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.045011][T17690] team0: Port device team_slave_0 added [ 435.067909][T17755] netlink: 'syz.4.3493': attribute type 16 has an invalid length. [ 435.078555][T17755] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3493'. [ 435.092198][T17755] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.102901][T17690] team0: Port device team_slave_1 added [ 435.185748][T17690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 435.203378][T17690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 435.233821][T17690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 435.279661][T17690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 435.287186][ T2478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.295676][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.305048][T17690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 435.333192][T17690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 435.359178][ T5241] Bluetooth: hci1: command tx timeout [ 435.371541][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.388030][T17760] wg2: entered promiscuous mode [ 435.394815][T17760] wg2: entered allmulticast mode [ 435.647694][T17283] bridge_slave_1: left allmulticast mode [ 435.686661][T17283] bridge_slave_1: left promiscuous mode [ 435.699911][T17283] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.760454][T17283] bridge_slave_0: left allmulticast mode [ 435.766352][T17283] bridge_slave_0: left promiscuous mode [ 435.809593][T17283] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.020105][T17777] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3500'. [ 436.067349][T17778] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3500'. [ 436.412241][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.478592][T17283] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 436.500893][T17283] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 436.515568][T17283] bond0 (unregistering): Released all slaves [ 436.539571][T17690] hsr_slave_0: entered promiscuous mode [ 436.546070][T17690] hsr_slave_1: entered promiscuous mode [ 436.552512][T17690] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 436.573004][T17690] Cannot create hsr debugfs directory [ 436.626351][T17776] IPv6: NLM_F_REPLACE set, but no existing node found! [ 436.639187][ T5241] Bluetooth: hci0: command tx timeout [ 436.656838][T17597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 436.837934][T17791] netlink: 'syz.3.3505': attribute type 10 has an invalid length. [ 436.895729][T17791] bond0: (slave netdevsim0): Releasing backup interface [ 436.923972][T17791] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 436.945351][T17791] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 436.954425][T17791] team0: Port device netdevsim0 added [ 436.995557][T17796] netlink: 'syz.3.3505': attribute type 10 has an invalid length. [ 437.004335][T17796] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 437.013045][T17796] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 437.067297][T17796] team0: Port device netdevsim0 removed [ 437.087576][T17796] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 437.297493][T17815] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 437.348254][T17597] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.378470][T17283] hsr_slave_0: left promiscuous mode [ 437.384813][T17283] hsr_slave_1: left promiscuous mode [ 437.392189][T17283] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 437.399974][T17283] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 437.413858][T17283] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 437.421589][T17283] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 437.439599][ T5241] Bluetooth: hci1: command tx timeout [ 437.444297][T17283] veth1_macvtap: left promiscuous mode [ 437.452417][T17823] netlink: 'syz.0.3516': attribute type 1 has an invalid length. [ 437.462112][T17283] veth0_macvtap: left promiscuous mode [ 437.468040][T17283] veth1_vlan: left promiscuous mode [ 437.481489][T17283] veth0_vlan: left promiscuous mode [ 437.987788][T17283] team0 (unregistering): Port device team_slave_1 removed [ 438.033827][T17283] team0 (unregistering): Port device team_slave_0 removed [ 438.489355][ T2478] net_ratelimit: 4 callbacks suppressed [ 438.489375][ T2478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.503107][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.511235][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.526376][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.549598][T17824] IPv6: NLM_F_REPLACE set, but no existing node found! [ 438.588523][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.595736][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 438.696767][ T5226] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.704012][ T5226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 438.845239][T17833] __nla_validate_parse: 6 callbacks suppressed [ 438.845260][T17833] netlink: 160 bytes leftover after parsing attributes in process `syz.4.3519'. [ 438.896068][T17830] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 438.897325][T17836] geneve3: entered promiscuous mode [ 438.917723][T17836] geneve3: entered allmulticast mode [ 439.146790][ C0] eth0: bad gso: type: 1, size: 1408 [ 439.328626][T17857] netlink: 'syz.0.3526': attribute type 5 has an invalid length. [ 439.370882][T17857] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3526'. [ 439.519513][ T5241] Bluetooth: hci1: command tx timeout [ 439.629974][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.690697][T17597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 439.714518][T17690] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 439.773574][T17690] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 439.825250][T17690] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 439.873137][T17690] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 440.031997][T17597] veth0_vlan: entered promiscuous mode [ 440.099446][T17597] veth1_vlan: entered promiscuous mode [ 440.236447][T17597] veth0_macvtap: entered promiscuous mode [ 440.332776][T17597] veth1_macvtap: entered promiscuous mode [ 440.384257][T17690] 8021q: adding VLAN 0 to HW filter on device bond0 [ 440.411294][ T1269] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.417637][ T1269] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.481339][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 440.498920][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.514225][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 440.525453][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.539064][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 440.551860][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.563093][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 440.584897][ T5240] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 440.593027][T17872] netlink: 'syz.3.3530': attribute type 1 has an invalid length. [ 440.594497][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.613531][ T5240] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 440.624948][ T5240] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 440.644931][ T5240] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 440.658614][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.664789][T17597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 440.682514][ T5240] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 440.690095][ T5240] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 440.725347][T17876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3528'. [ 440.734851][T17875] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3528'. [ 440.752503][T17690] 8021q: adding VLAN 0 to HW filter on device team0 [ 440.776488][T17875] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3528'. [ 440.798737][T17786] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.805880][T17786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 440.821083][T17786] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.828218][T17786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 440.896168][T17287] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 440.907271][T17287] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.928730][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.940406][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.950741][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.962039][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.972044][T17597] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 440.982953][T17597] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 440.994483][T17597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 441.038621][T17597] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.049412][T15807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.057744][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.067455][T17597] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.076289][T17597] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.085760][T17597] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 441.115427][T17287] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 441.126479][T17287] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.278504][T17287] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 441.298178][T17287] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.511816][T17287] bond0: (slave netdevsim0): Releasing backup interface [ 441.547065][T17287] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 441.560916][T17287] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.599425][ T5241] Bluetooth: hci1: command tx timeout [ 441.600562][T17690] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 441.622727][T17690] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 441.836440][T17907] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3540'. [ 441.907314][T15807] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 441.931789][T15807] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 441.935974][T17871] chnl_net:caif_netlink_parms(): no params data found [ 442.133015][T17914] netlink: 'syz.4.3541': attribute type 10 has an invalid length. [ 442.142243][T17914] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3541'. [ 442.153877][T17914] bridge0: port 3(team0) entered blocking state [ 442.165925][T17914] bridge0: port 3(team0) entered disabled state [ 442.428106][T17287] dvmrp0 (unregistering): left allmulticast mode [ 442.698022][T17287] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.719534][T17287] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.719747][ T5241] Bluetooth: hci3: command tx timeout [ 442.738216][T17287] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 442.758439][T17287] bond0 (unregistering): (slave macvlan2): Releasing backup interface [ 442.768362][T17287] mac80211_hwsim hwsim33 wlan0: left allmulticast mode [ 442.775659][T17287] mac80211_hwsim hwsim33 wlan0: left promiscuous mode [ 442.790626][T17287] bond0 (unregistering): Released all slaves [ 442.849957][T17871] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.857540][T17871] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.867196][T17871] bridge_slave_0: entered allmulticast mode [ 442.875199][T17871] bridge_slave_0: entered promiscuous mode [ 442.888162][T17917] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 442.897280][T17871] bridge0: port 2(bridge_slave_1) entered blocking state [ 442.915680][T17871] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.929406][T17871] bridge_slave_1: entered allmulticast mode [ 442.950763][T17871] bridge_slave_1: entered promiscuous mode [ 442.979796][T17283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 442.996554][T17287] tipc: Disabling bearer [ 442.998886][T17283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.023295][T17287] tipc: Left network mode [ 443.036120][T17925] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 443.090628][T17690] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 443.144993][T17871] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.202659][T17871] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.215705][T17931] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3547'. [ 443.363039][T17940] FAULT_INJECTION: forcing a failure. [ 443.363039][T17940] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 443.387494][T17940] CPU: 1 UID: 0 PID: 17940 Comm: syz.3.3549 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 443.397955][T17940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 443.408030][T17940] Call Trace: [ 443.411315][T17940] [ 443.414247][T17940] dump_stack_lvl+0x241/0x360 [ 443.418935][T17940] ? __pfx_dump_stack_lvl+0x10/0x10 [ 443.424132][T17940] ? __pfx__printk+0x10/0x10 [ 443.428735][T17940] ? snprintf+0xda/0x120 [ 443.432995][T17940] should_fail_ex+0x3b0/0x4e0 [ 443.437680][T17940] _copy_to_user+0x2f/0xb0 [ 443.442105][T17940] simple_read_from_buffer+0xca/0x150 [ 443.447484][T17940] proc_fail_nth_read+0x1e9/0x250 [ 443.452515][T17940] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 443.458079][T17940] ? rw_verify_area+0x520/0x6b0 [ 443.462931][T17940] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 443.468480][T17940] vfs_read+0x204/0xbc0 [ 443.472640][T17940] ? __pfx_lock_release+0x10/0x10 [ 443.477673][T17940] ? __pfx_vfs_read+0x10/0x10 [ 443.482440][T17940] ? __fget_files+0x29/0x470 [ 443.487051][T17940] ? __fget_files+0x3f6/0x470 [ 443.492005][T17940] ksys_read+0x1a0/0x2c0 [ 443.496340][T17940] ? __pfx_ksys_read+0x10/0x10 [ 443.501106][T17940] ? do_syscall_64+0x100/0x230 [ 443.505876][T17940] ? do_syscall_64+0xb6/0x230 [ 443.510556][T17940] do_syscall_64+0xf3/0x230 [ 443.515061][T17940] ? clear_bhb_loop+0x35/0x90 [ 443.519771][T17940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.525796][T17940] RIP: 0033:0x7ff8d7575dfc [ 443.530299][T17940] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 69 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 bf 8d 02 00 48 [ 443.550003][T17940] RSP: 002b:00007ff8d8349040 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 443.558526][T17940] RAX: ffffffffffffffda RBX: 00007ff8d7705f80 RCX: 00007ff8d7575dfc [ 443.566587][T17940] RDX: 000000000000000f RSI: 00007ff8d83490b0 RDI: 0000000000000004 [ 443.574563][T17940] RBP: 00007ff8d83490a0 R08: 0000000000000000 R09: 0000000000000000 [ 443.582539][T17940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.590858][T17940] R13: 000000000000004d R14: 00007ff8d7705f80 R15: 00007ffdf8a09958 [ 443.598850][T17940] [ 443.605792][ T63] net_ratelimit: 3 callbacks suppressed [ 443.605805][ T63] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.619863][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.650429][T17937] netlink: 'syz.4.3548': attribute type 21 has an invalid length. [ 443.658358][T17937] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3548'. [ 443.722728][T17871] team0: Port device team_slave_0 added [ 443.737124][T17871] team0: Port device team_slave_1 added [ 443.759757][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.769652][T17945] netlink: 'syz.3.3550': attribute type 1 has an invalid length. [ 443.874726][T17287] hsr_slave_0: left promiscuous mode [ 443.884658][T17287] hsr_slave_1: left promiscuous mode [ 443.892690][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 443.900830][T17287] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 443.910555][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 443.918133][T17287] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 443.950526][T17287] veth0_macvtap: left promiscuous mode [ 443.956288][T17287] veth1_vlan: left promiscuous mode [ 444.117320][T17951] netlink: 'syz.4.3552': attribute type 1 has an invalid length. [ 444.243002][ T63] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.253483][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.264041][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.339452][ T5240] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 444.349490][ T5240] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 444.358552][ T5240] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 444.381721][ T5240] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 444.391088][ T5240] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 444.399840][ T5240] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 444.667504][T17287] team_slave_1 (unregistering): left promiscuous mode [ 444.677973][T17287] team0 (unregistering): Port device team_slave_1 removed [ 444.728196][T17287] team_slave_0 (unregistering): left promiscuous mode [ 444.739529][T17287] team0 (unregistering): Port device team_slave_0 removed [ 444.799307][ T5240] Bluetooth: hci3: command tx timeout [ 445.243119][T17871] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 445.254561][T17871] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 445.285647][T17871] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 445.290188][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.316796][T17871] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 445.324440][T17871] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 445.357425][T17871] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 445.456374][T17690] veth0_vlan: entered promiscuous mode [ 445.600703][T17871] hsr_slave_0: entered promiscuous mode [ 445.619725][T17871] hsr_slave_1: entered promiscuous mode [ 445.631016][T17966] openvswitch: netlink: Missing key (keys=44, expected=200000) [ 445.651218][T17871] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 445.679896][T17871] Cannot create hsr debugfs directory [ 445.732760][T17690] veth1_vlan: entered promiscuous mode [ 445.994655][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3558'. [ 446.076186][T17690] veth0_macvtap: entered promiscuous mode [ 446.113725][T17690] veth1_macvtap: entered promiscuous mode [ 446.261053][T17287] IPVS: stop unused estimator thread 0... [ 446.283781][T17986] openvswitch: netlink: Key 32 has unexpected len 4 expected 2 [ 446.329726][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.410482][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 446.421252][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.432847][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 446.443452][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.453425][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 446.464233][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.474546][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 446.485652][ T5240] Bluetooth: hci0: command tx timeout [ 446.487605][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.506170][T17690] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 446.523411][T17995] netlink: 'syz.4.3563': attribute type 1 has an invalid length. [ 446.580420][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 446.593386][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.604459][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 446.607185][T17997] sctp: [Deprecated]: syz.3.3564 (pid 17997) Use of int in maxseg socket option. [ 446.607185][T17997] Use struct sctp_assoc_value instead [ 446.615187][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.615215][T17690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 446.615234][T17690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 446.616718][T17690] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 446.698629][T17690] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.710520][T17690] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.721889][T17690] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.731294][T17690] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.872635][T17287] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.884197][ T5240] Bluetooth: hci3: command tx timeout [ 446.932388][T17953] chnl_net:caif_netlink_parms(): no params data found [ 446.996068][T17287] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.112164][T17287] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.298577][T17287] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.328724][T17953] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.355010][T17953] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.363853][T17953] bridge_slave_0: entered allmulticast mode [ 447.372113][T17953] bridge_slave_0: entered promiscuous mode [ 447.391697][T17953] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.401731][T17953] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.409403][T17953] bridge_slave_1: entered allmulticast mode [ 447.416840][T17953] bridge_slave_1: entered promiscuous mode [ 447.529932][T18019] IPv6: Can't replace route, no match found [ 447.544161][T17953] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.561567][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.595193][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.640796][T17953] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 447.696188][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.718012][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.748737][T18027] sctp: [Deprecated]: syz.4.3574 (pid 18027) Use of int in maxseg socket option. [ 447.748737][T18027] Use struct sctp_assoc_value instead [ 447.867452][T17953] team0: Port device team_slave_0 added [ 447.878585][T18029] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3575'. [ 447.940633][T17287] bridge_slave_1: left allmulticast mode [ 447.946339][T17287] bridge_slave_1: left promiscuous mode [ 447.962744][T17287] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.974377][T17287] bridge_slave_0: left allmulticast mode [ 447.982806][T17287] bridge_slave_0: left promiscuous mode [ 447.988507][T17287] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.326721][T17287] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 448.338142][T17287] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 448.350886][T17287] bond0 (unregistering): Released all slaves [ 448.368507][T17953] team0: Port device team_slave_1 added [ 448.418230][T18031] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3576'. [ 448.507861][T17953] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 448.525179][T17953] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 448.559035][ T5240] Bluetooth: hci0: command tx timeout [ 448.564632][T17953] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.577829][T17953] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 448.585139][T17953] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 448.613543][T17953] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.689055][T17871] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 448.708196][T17871] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 448.824793][T17871] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 448.844494][T17871] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 448.905164][T17953] hsr_slave_0: entered promiscuous mode [ 448.911986][T17953] hsr_slave_1: entered promiscuous mode [ 448.918096][T17953] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 448.929225][T17953] Cannot create hsr debugfs directory [ 448.959210][ T5240] Bluetooth: hci3: command tx timeout [ 449.072863][T17287] hsr_slave_0: left promiscuous mode [ 449.082394][T17287] hsr_slave_1: left promiscuous mode [ 449.088452][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.096786][T17287] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 449.105463][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.113127][T17287] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 449.134570][T17287] veth1_macvtap: left promiscuous mode [ 449.140594][T17287] veth0_macvtap: left promiscuous mode [ 449.146265][T17287] veth1_vlan: left promiscuous mode [ 449.151698][T17287] veth0_vlan: left promiscuous mode [ 449.364347][T18024] net_ratelimit: 6 callbacks suppressed [ 449.364369][T18024] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.378316][T17283] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.386734][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.445219][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.634076][T17287] team0 (unregistering): Port device team_slave_1 removed [ 449.672863][T17287] team0 (unregistering): Port device team_slave_0 removed [ 450.003458][T15807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.012369][T18024] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.023068][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.334914][T17871] 8021q: adding VLAN 0 to HW filter on device bond0 [ 450.364519][T17871] 8021q: adding VLAN 0 to HW filter on device team0 [ 450.384992][ T5310] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.392238][ T5310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 450.431110][ T5275] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.438307][ T5275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 450.573610][T17871] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 450.596293][T18037] openvswitch: netlink: nsh attr 1 has unexpected len 0 expected 8 [ 450.631152][T18038] bond0: (slave macvlan6): Error -98 calling set_mac_address [ 450.641167][ T5240] Bluetooth: hci0: command tx timeout [ 450.740036][T18040] tipc: Enabling of bearer rejected, failed to enable media [ 450.868685][T17287] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.921981][T17953] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 450.944719][T18049] netlink: 'syz.3.3581': attribute type 1 has an invalid length. [ 450.999699][T18051] netlink: 'syz.4.3582': attribute type 1 has an invalid length. [ 451.040756][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.062079][ T5241] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 451.072688][ T5241] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 451.078700][T17287] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.091235][ T5241] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 451.103203][ T5241] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 451.111985][T17953] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 451.121170][ T5241] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 451.132104][ T5241] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 451.134150][T17953] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 451.175403][T17953] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 451.231387][T17287] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.335416][T17287] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.368731][T18055] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3583'. [ 451.383979][T18055] bond_slave_0: entered promiscuous mode [ 451.389744][T18055] bond_slave_1: entered promiscuous mode [ 451.395628][T18055] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 451.405128][T18055] macvtap2: entered promiscuous mode [ 451.412116][T18055] bond0: entered promiscuous mode [ 451.418064][T18055] macvlan2: entered promiscuous mode [ 451.425989][T18055] macvtap2: entered allmulticast mode [ 451.431575][T18055] bond0: entered allmulticast mode [ 451.438296][T18055] bond_slave_0: entered allmulticast mode [ 451.444673][T18055] bond_slave_1: entered allmulticast mode [ 451.450872][T18055] macvlan2: entered allmulticast mode [ 451.456606][T18055] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 451.466989][T18055] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 451.484496][T17871] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.503846][T18056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3583'. [ 451.514561][T18056] bond0: left allmulticast mode [ 451.521612][T18056] bond_slave_0: left allmulticast mode [ 451.527317][T18056] bond_slave_1: left allmulticast mode [ 451.533517][T18056] macvlan2: left allmulticast mode [ 451.538707][T18056] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 451.547576][T18056] bond0: left promiscuous mode [ 451.553340][T18056] macvlan2: left promiscuous mode [ 451.562742][T18056] bond_slave_0: left promiscuous mode [ 451.568192][T18056] bond_slave_1: left promiscuous mode [ 451.573846][T18056] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 451.581882][T18056] macvtap2: left promiscuous mode [ 451.587032][T18056] macvtap2: left allmulticast mode [ 451.832540][T18062] sctp: [Deprecated]: syz.3.3585 (pid 18062) Use of int in maxseg socket option. [ 451.832540][T18062] Use struct sctp_assoc_value instead [ 451.859146][T17287] bridge_slave_1: left allmulticast mode [ 451.866577][T17283] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.868573][T17287] bridge_slave_1: left promiscuous mode [ 451.881100][T17287] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.895521][T17287] bridge_slave_0: left allmulticast mode [ 451.906930][T17287] bridge_slave_0: left promiscuous mode [ 451.913145][T17287] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.303473][T17287] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 452.315782][T17287] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 452.336676][T17287] bond0 (unregistering): Released all slaves [ 452.360288][T18065] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3586'. [ 452.373079][T18065] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 452.394497][T18065] 0ªX¹¦Dö»: entered allmulticast mode [ 452.547948][T18073] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3589'. [ 452.588404][T17871] veth0_vlan: entered promiscuous mode [ 452.653633][T18076] bond0: (slave macvlan8): Error -98 calling set_mac_address [ 452.686447][T18079] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3591'. [ 452.719603][ T5240] Bluetooth: hci0: command tx timeout [ 452.826229][T17871] veth1_vlan: entered promiscuous mode [ 452.844541][T17953] 8021q: adding VLAN 0 to HW filter on device bond0 [ 452.862073][T18085] netlink: 'syz.3.3592': attribute type 1 has an invalid length. [ 452.877575][T18052] chnl_net:caif_netlink_parms(): no params data found [ 452.994794][T17287] hsr_slave_0: left promiscuous mode [ 453.004331][T17287] hsr_slave_1: left promiscuous mode [ 453.012286][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 453.021369][T17287] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 453.029915][T17287] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 453.037370][T17287] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 453.068751][T17287] veth1_macvtap: left promiscuous mode [ 453.074612][T17287] veth0_macvtap: left promiscuous mode [ 453.081155][T17287] veth1_vlan: left promiscuous mode [ 453.086500][T17287] veth0_vlan: left promiscuous mode [ 453.200959][ T5240] Bluetooth: hci1: command tx timeout [ 453.671270][T17287] team0 (unregistering): Port device team_slave_1 removed [ 453.738508][T17287] team0 (unregistering): Port device team_slave_0 removed [ 454.012888][T18096] netlink: 'syz.4.3596': attribute type 1 has an invalid length. [ 454.292637][T17953] 8021q: adding VLAN 0 to HW filter on device team0 [ 454.331974][ T5281] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.339177][ T5281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 454.390046][ T5281] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.397260][ T5281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 454.498461][T18052] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.509656][T18052] bridge0: port 1(bridge_slave_0) entered disabled state [ 454.517095][T18052] bridge_slave_0: entered allmulticast mode [ 454.527434][T18052] bridge_slave_0: entered promiscuous mode [ 454.560923][T18052] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.579146][T18052] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.586624][T18052] bridge_slave_1: entered allmulticast mode [ 454.597768][T18052] bridge_slave_1: entered promiscuous mode [ 454.622601][T17871] veth0_macvtap: entered promiscuous mode [ 454.632200][T18105] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3598'. [ 454.681786][T18052] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.707393][T18052] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 454.771832][T17871] veth1_macvtap: entered promiscuous mode [ 454.791548][T18109] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3600'. [ 454.813499][T18052] team0: Port device team_slave_0 added [ 454.826870][T18052] team0: Port device team_slave_1 added [ 454.922398][T18052] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 454.941059][T18052] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 454.977606][T18052] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 454.992212][T18052] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 454.999867][T18052] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 455.026141][T18052] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 455.059243][T17871] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 455.088950][T17871] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 455.102934][T17871] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 455.121434][ T2478] net_ratelimit: 5 callbacks suppressed [ 455.121456][ T2478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.126474][T17871] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 455.127221][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.150863][T17871] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 455.190308][T17871] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 455.207410][T17871] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 455.210266][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.228205][T17871] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 455.247499][T17871] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 455.262976][T17871] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 455.273615][T17871] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 455.284336][ T5240] Bluetooth: hci1: command tx timeout [ 455.295770][T17871] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 455.326343][T17871] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.336088][T17871] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.347048][T17871] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.356693][T17871] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 455.484415][T18052] hsr_slave_0: entered promiscuous mode [ 455.501836][T18052] hsr_slave_1: entered promiscuous mode [ 455.523327][T18052] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 455.533230][T18052] Cannot create hsr debugfs directory [ 455.542691][T18127] netlink: 'syz.4.3606': attribute type 1 has an invalid length. [ 455.640335][T17953] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 455.835543][T17284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.859079][T17284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.994732][ T2478] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 456.007780][ T2478] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 456.008224][T17953] veth0_vlan: entered promiscuous mode [ 456.085678][T17953] veth1_vlan: entered promiscuous mode [ 456.191321][T17953] veth0_macvtap: entered promiscuous mode [ 456.211279][T17953] veth1_macvtap: entered promiscuous mode [ 456.242209][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 456.267369][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.293579][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.306829][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.320460][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.334586][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.346502][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.356827][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 456.371604][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.384017][T17953] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 456.413943][T18135] bond0: (slave macvlan2): Enslaving as an active interface with an up link [ 456.430884][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.451826][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.466878][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.486759][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.501561][T17953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 456.518683][T17953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 456.540191][T17953] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 456.571591][T17953] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.586491][T17953] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.597051][T17953] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.610900][T17953] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 456.756598][T18052] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 456.785228][T18052] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 456.843593][T18052] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 456.864303][ C0] eth0: bad gso: type: 1, size: 1408 [ 456.865487][T18052] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 457.007255][T17287] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.030107][T17287] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.041687][T17287] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.050276][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.100652][T18155] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3616'. [ 457.112461][T17283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.127026][T17283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 457.233753][T18052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 457.281379][ T5275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.360148][ T5240] Bluetooth: hci1: command tx timeout [ 457.376373][T18052] 8021q: adding VLAN 0 to HW filter on device team0 [ 457.417668][ T5281] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.424890][ T5281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 457.461025][ T5281] bridge0: port 2(bridge_slave_1) entered blocking state [ 457.468188][ T5281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 457.500407][T18167] netlink: 'syz.0.3622': attribute type 1 has an invalid length. [ 457.794326][T18052] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 457.845240][T18183] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3625'. [ 457.870707][T18181] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3624'. [ 457.885779][T18181] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3624'. [ 457.917873][T18052] veth0_vlan: entered promiscuous mode [ 457.951372][T18052] veth1_vlan: entered promiscuous mode [ 458.039741][T18052] veth0_macvtap: entered promiscuous mode [ 458.053998][T18052] veth1_macvtap: entered promiscuous mode [ 458.094335][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.112424][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.124264][T18190] sctp: [Deprecated]: syz.4.3627 (pid 18190) Use of struct sctp_assoc_value in delayed_ack socket option. [ 458.124264][T18190] Use struct sctp_sack_info instead [ 458.124705][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.158710][T18190] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 458.163627][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.185361][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.209003][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.228921][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.248891][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.269015][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 458.288939][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.304187][T18052] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 458.321972][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.348475][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.360370][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.372207][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.386730][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.397930][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.410959][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.421229][T18052] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 458.433077][T18052] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 458.444769][T18052] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 458.468432][T18052] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.489920][T18052] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.498674][T18052] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.515671][T18052] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.727407][ T63] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.764896][T17283] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.781698][T17283] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.837093][T15807] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.867680][T15807] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.114802][ T63] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.204624][ T63] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.285285][ T63] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.374124][T18207] FAULT_INJECTION: forcing a failure. [ 459.374124][T18207] name failslab, interval 1, probability 0, space 0, times 0 [ 459.401990][T18207] CPU: 1 UID: 0 PID: 18207 Comm: syz.3.3633 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 459.405740][T18210] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3634'. [ 459.412519][T18207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 459.412540][T18207] Call Trace: [ 459.412548][T18207] [ 459.412558][T18207] dump_stack_lvl+0x241/0x360 [ 459.412588][T18207] ? __pfx_dump_stack_lvl+0x10/0x10 [ 459.412610][T18207] ? __pfx__printk+0x10/0x10 [ 459.412638][T18207] ? ref_tracker_alloc+0x332/0x490 [ 459.412670][T18207] should_fail_ex+0x3b0/0x4e0 [ 459.412699][T18207] ? skb_clone+0x20c/0x390 [ 459.412724][T18207] should_failslab+0xac/0x100 [ 459.412751][T18207] ? skb_clone+0x20c/0x390 [ 459.412772][T18207] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 459.412798][T18207] skb_clone+0x20c/0x390 [ 459.412827][T18207] __netlink_deliver_tap+0x3cc/0x7c0 [ 459.412863][T18207] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.412884][T18207] netlink_deliver_tap+0x19d/0x1b0 [ 459.412908][T18207] netlink_sendskb+0x68/0x140 [ 459.412931][T18207] netlink_unicast+0x39d/0x990 [ 459.412948][T18207] ? __asan_memcpy+0x40/0x70 [ 459.412979][T18207] ? __pfx_netlink_unicast+0x10/0x10 [ 459.413011][T18207] netlink_rcv_skb+0x262/0x430 [ 459.413035][T18207] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 459.413062][T18207] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 459.413099][T18207] ? apparmor_capable+0x138/0x1b0 [ 459.413123][T18207] ? bpf_lsm_capable+0x9/0x10 [ 459.431276][T18210] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3634'. [ 459.432073][T18207] ? security_capable+0x90/0xb0 [ 459.559408][T18207] nfnetlink_rcv+0x297/0x2a90 [ 459.564117][T18207] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 459.569868][T18207] ? __dev_queue_xmit+0x2da/0x3e90 [ 459.575008][T18207] ? __dev_queue_xmit+0x1763/0x3e90 [ 459.580234][T18207] ? kasan_save_track+0x51/0x80 [ 459.585137][T18207] ? do_syscall_64+0xf3/0x230 [ 459.589838][T18207] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 459.594971][T18207] ? __dev_queue_xmit+0x2da/0x3e90 [ 459.600112][T18207] ? __pfx___dev_queue_xmit+0x10/0x10 [ 459.605528][T18207] ? ref_tracker_free+0x643/0x7e0 [ 459.610585][T18207] ? __asan_memcpy+0x40/0x70 [ 459.615288][T18207] ? __pfx_ref_tracker_free+0x10/0x10 [ 459.620708][T18207] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.625939][T18207] ? skb_clone+0x240/0x390 [ 459.630376][T18207] ? __pfx_lock_release+0x10/0x10 [ 459.635420][T18207] ? __netlink_deliver_tap+0x77e/0x7c0 [ 459.640908][T18207] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.646133][T18207] netlink_unicast+0x7f0/0x990 [ 459.650929][T18207] ? __pfx_netlink_unicast+0x10/0x10 [ 459.656312][T18207] ? __virt_addr_valid+0x183/0x530 [ 459.661445][T18207] ? __check_object_size+0x49c/0x900 [ 459.666749][T18207] ? bpf_lsm_netlink_send+0x9/0x10 [ 459.671883][T18207] netlink_sendmsg+0x8e4/0xcb0 [ 459.676680][T18207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.681992][T18207] ? __import_iovec+0x536/0x820 [ 459.686866][T18207] ? aa_sock_msg_perm+0x91/0x160 [ 459.691832][T18207] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 459.697143][T18207] ? security_socket_sendmsg+0x87/0xb0 [ 459.702632][T18207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.708023][T18207] __sock_sendmsg+0x221/0x270 [ 459.712727][T18207] ____sys_sendmsg+0x525/0x7d0 [ 459.717527][T18207] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.722856][T18207] __sys_sendmsg+0x2b0/0x3a0 [ 459.727477][T18207] ? __pfx___sys_sendmsg+0x10/0x10 [ 459.732614][T18207] ? vfs_write+0x7c4/0xc90 [ 459.737212][T18207] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 459.743568][T18207] ? do_syscall_64+0x100/0x230 [ 459.748360][T18207] ? do_syscall_64+0xb6/0x230 [ 459.753063][T18207] do_syscall_64+0xf3/0x230 [ 459.756346][ T5241] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 459.757567][T18207] ? clear_bhb_loop+0x35/0x90 [ 459.757599][T18207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.757621][T18207] RIP: 0033:0x7ff8d75773b9 [ 459.757638][T18207] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 459.757654][T18207] RSP: 002b:00007ff8d8349048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 459.757675][T18207] RAX: ffffffffffffffda RBX: 00007ff8d7705f80 RCX: 00007ff8d75773b9 [ 459.757688][T18207] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 [ 459.757699][T18207] RBP: 00007ff8d83490a0 R08: 0000000000000000 R09: 0000000000000000 [ 459.757712][T18207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 459.757725][T18207] R13: 000000000000004d R14: 00007ff8d7705f80 R15: 00007ffdf8a09958 [ 459.757756][T18207] [ 459.864133][ T5241] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 459.878024][ T5241] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 459.892691][ T5241] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 459.903913][ T5241] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 459.911794][ T5241] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 459.960738][T18216] tun0: tun_chr_ioctl cmd 1074025677 [ 459.966378][T18216] tun0: linktype set to 821 [ 460.202532][T18223] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3639'. [ 460.218199][T18223] vxcan1: MTU too low for tipc bearer [ 460.226283][T18223] tipc: Enabling of bearer rejected, failed to enable media [ 460.240853][ T63] bridge_slave_1: left allmulticast mode [ 460.246591][ T63] bridge_slave_1: left promiscuous mode [ 460.252643][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.268053][ T63] bridge_slave_0: left allmulticast mode [ 460.275105][ T63] bridge_slave_0: left promiscuous mode [ 460.282617][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.295664][T18228] netlink: 'syz.4.3640': attribute type 1 has an invalid length. [ 460.400880][ T58] net_ratelimit: 1 callbacks suppressed [ 460.400901][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.705285][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 460.717025][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 460.732547][ T63] bond0 (unregistering): Released all slaves [ 460.763986][T18232] netlink: 'syz.0.3642': attribute type 10 has an invalid length. [ 460.772757][T18232] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3642'. [ 460.783127][T18232] team0: entered promiscuous mode [ 460.788282][T18232] team_slave_0: entered promiscuous mode [ 460.795020][T18232] team_slave_1: entered promiscuous mode [ 460.802716][T18232] bridge0: port 3(team0) entered blocking state [ 460.809416][T18232] bridge0: port 3(team0) entered disabled state [ 460.815925][T18232] team0: entered allmulticast mode [ 460.821831][T18232] team_slave_0: entered allmulticast mode [ 460.827614][T18232] team_slave_1: entered allmulticast mode [ 460.838143][T18232] bridge0: port 3(team0) entered blocking state [ 460.844533][T18232] bridge0: port 3(team0) entered forwarding state [ 460.884058][T17286] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.892657][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.148536][ T63] hsr_slave_0: left promiscuous mode [ 461.156829][ T63] hsr_slave_1: left promiscuous mode [ 461.169238][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 461.178285][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 461.190549][T18234] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 461.211379][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 461.225793][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 461.266843][ T63] veth1_macvtap: left promiscuous mode [ 461.299224][ T63] veth0_macvtap: left promiscuous mode [ 461.305154][ T63] veth1_vlan: left promiscuous mode [ 461.317900][ T63] veth0_vlan: left promiscuous mode [ 461.452966][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.945788][ T63] team0 (unregistering): Port device team_slave_1 removed [ 461.996992][ T63] team0 (unregistering): Port device team_slave_0 removed [ 462.429007][T18211] chnl_net:caif_netlink_parms(): no params data found [ 462.489236][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.575993][T18211] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.585942][T18211] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.593317][T18211] bridge_slave_0: entered allmulticast mode [ 462.601327][T18211] bridge_slave_0: entered promiscuous mode [ 462.609412][T18211] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.616660][T18211] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.631081][T18211] bridge_slave_1: entered allmulticast mode [ 462.637860][T18211] bridge_slave_1: entered promiscuous mode [ 462.695193][T18211] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 462.708492][T18211] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.749466][T18211] team0: Port device team_slave_0 added [ 462.760278][T18211] team0: Port device team_slave_1 added [ 462.790866][T18211] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.797846][T18211] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 462.824740][T18211] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 462.837766][T15807] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.840140][T18211] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 462.846183][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.852823][T18211] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 462.892813][T18211] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.941659][T18211] hsr_slave_0: entered promiscuous mode [ 462.948154][T18211] hsr_slave_1: entered promiscuous mode [ 462.954444][T18211] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 462.964110][T18211] Cannot create hsr debugfs directory [ 463.000541][ T63] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.335891][T18265] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3649'. [ 463.530030][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.567211][T18272] FAULT_INJECTION: forcing a failure. [ 463.567211][T18272] name failslab, interval 1, probability 0, space 0, times 0 [ 463.580375][T18272] CPU: 1 UID: 0 PID: 18272 Comm: syz.4.3652 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 463.590818][T18272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 463.600904][T18272] Call Trace: [ 463.604204][T18272] [ 463.607155][T18272] dump_stack_lvl+0x241/0x360 [ 463.611875][T18272] ? __pfx_dump_stack_lvl+0x10/0x10 [ 463.617107][T18272] ? __pfx__printk+0x10/0x10 [ 463.621735][T18272] ? __pfx_lock_acquire+0x10/0x10 [ 463.626887][T18272] should_fail_ex+0x3b0/0x4e0 [ 463.631715][T18272] ? __inet_hash_connect+0xa2e/0x2170 [ 463.637118][T18272] should_failslab+0xac/0x100 [ 463.641832][T18272] ? __inet_hash_connect+0xa2e/0x2170 [ 463.647235][T18272] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 463.652657][T18272] __inet_hash_connect+0xa2e/0x2170 [ 463.657889][T18272] ? __pfx___inet_check_established+0x10/0x10 [ 463.664031][T18272] ? __pfx___inet_hash_connect+0x10/0x10 [ 463.669721][T18272] ? rcu_is_watching+0x15/0xb0 [ 463.674528][T18272] ? inet_hash_connect+0xac/0x140 [ 463.679591][T18272] dccp_v4_connect+0xa21/0x1380 [ 463.684482][T18272] __inet_stream_connect+0x262/0xf30 [ 463.689793][T18272] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 463.696252][T18272] ? __local_bh_enable_ip+0x168/0x200 [ 463.701749][T18272] ? lockdep_hardirqs_on+0x99/0x150 [ 463.706986][T18272] ? __pfx___inet_stream_connect+0x10/0x10 [ 463.712924][T18272] ? __local_bh_enable_ip+0x168/0x200 [ 463.718337][T18272] ? inet_stream_connect+0x50/0xa0 [ 463.723476][T18272] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 463.729321][T18272] inet_stream_connect+0x65/0xa0 [ 463.734290][T18272] __sys_connect+0x2df/0x310 [ 463.738911][T18272] ? __pfx___sys_connect+0x10/0x10 [ 463.744072][T18272] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 463.750467][T18272] ? do_syscall_64+0x100/0x230 [ 463.755261][T18272] __x64_sys_connect+0x7a/0x90 [ 463.760059][T18272] do_syscall_64+0xf3/0x230 [ 463.764622][T18272] ? clear_bhb_loop+0x35/0x90 [ 463.765728][ T5240] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 463.769315][T18272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.769393][T18272] RIP: 0033:0x7f9c02d773b9 [ 463.769413][T18272] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 463.769429][T18272] RSP: 002b:00007f9c027ff048 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 463.769450][T18272] RAX: ffffffffffffffda RBX: 00007f9c02f05f80 RCX: 00007f9c02d773b9 [ 463.769464][T18272] RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000009 [ 463.769476][T18272] RBP: 00007f9c027ff0a0 R08: 0000000000000000 R09: 0000000000000000 [ 463.769489][T18272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 463.769502][T18272] R13: 000000000000004d R14: 00007f9c02f05f80 R15: 00007ffeda9d1a78 [ 463.769533][T18272] [ 463.780769][ T5240] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 463.843700][T18281] netlink: 'syz.3.3654': attribute type 1 has an invalid length. [ 463.854577][ T5240] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 463.867532][T18280] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3655'. [ 463.869195][ T5240] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 463.882596][T18280] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 463.893209][ T5240] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 463.937772][ T5240] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 464.019489][ T63] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.074588][T18283] netlink: 'syz.4.3656': attribute type 10 has an invalid length. [ 464.125851][T18283] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3656'. [ 464.137653][T18283] bridge0: port 3(team0) entered blocking state [ 464.150778][T18283] bridge0: port 3(team0) entered disabled state [ 464.183865][ T63] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.196855][T18211] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 464.212163][T18211] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 464.289941][ T63] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.320413][T18211] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 464.355245][T18211] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 464.517008][T18306] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3662'. [ 464.549890][T18306] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3662'. [ 464.559992][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.575980][T18310] netlink: 'syz.0.3665': attribute type 10 has an invalid length. [ 464.584677][T18310] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3665'. [ 464.633185][T18306] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3662'. [ 464.655786][ T63] bridge_slave_1: left allmulticast mode [ 464.662462][ T63] bridge_slave_1: left promiscuous mode [ 464.668164][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.682225][ T63] bridge_slave_0: left allmulticast mode [ 464.688002][ T63] bridge_slave_0: left promiscuous mode [ 464.695428][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.824021][T18284] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 464.993060][T18315] SET target dimension over the limit! [ 465.115954][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 465.129353][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 465.142320][ T63] bond0 (unregistering): Released all slaves [ 465.304403][T18276] chnl_net:caif_netlink_parms(): no params data found [ 465.408395][T18310] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 465.437100][T18325] openvswitch: netlink: Missing key (keys=44, expected=200000) [ 465.533297][T18330] netlink: 'syz.4.3670': attribute type 1 has an invalid length. [ 465.533894][T18329] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3673'. [ 465.599438][ T5281] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.772291][T18211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.798364][T18276] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.815189][T18276] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.824156][T18276] bridge_slave_0: entered allmulticast mode [ 465.844413][T18276] bridge_slave_0: entered promiscuous mode [ 465.851475][T18340] Bluetooth: MGMT ver 1.23 [ 465.865835][T18342] netlink: 'syz.3.3676': attribute type 10 has an invalid length. [ 465.878392][T18342] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3676'. [ 465.898460][T18342] bridge0: port 3(team0) entered blocking state [ 465.904969][T18342] bridge0: port 3(team0) entered forwarding state [ 465.920975][T18342] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.947406][T18276] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.957856][T18276] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.966622][T18276] bridge_slave_1: entered allmulticast mode [ 465.975177][T18276] bridge_slave_1: entered promiscuous mode [ 465.993704][ T63] hsr_slave_0: left promiscuous mode [ 466.000501][ T5241] Bluetooth: hci1: command tx timeout [ 466.010636][ T63] hsr_slave_1: left promiscuous mode [ 466.017028][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 466.025342][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.033474][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 466.041243][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 466.066505][ T63] veth1_macvtap: left promiscuous mode [ 466.072293][ T63] veth0_macvtap: left promiscuous mode [ 466.077902][ T63] veth1_vlan: left promiscuous mode [ 466.090527][ T63] veth0_vlan: left promiscuous mode [ 466.555059][ T63] team0 (unregistering): Port device team_slave_1 removed [ 466.584902][T18346] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 466.620459][ T63] team0 (unregistering): Port device team_slave_0 removed [ 466.639996][T17286] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.648337][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.657055][T17786] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.952084][T18357] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3678'. [ 467.193105][T18276] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 467.210110][T18276] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 467.298698][T18276] team0: Port device team_slave_0 added [ 467.318359][T18276] team0: Port device team_slave_1 added [ 467.340412][T18211] 8021q: adding VLAN 0 to HW filter on device team0 [ 467.471629][T18276] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 467.507939][T18276] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 467.517796][T18369] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 467.535482][T18276] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 467.566530][ T5281] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.573729][ T5281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 467.637227][T18276] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 467.657243][T18276] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 467.684264][T18276] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 467.689411][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.717804][T18024] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.725033][T18024] bridge0: port 2(bridge_slave_1) entered forwarding state [ 467.827574][T18371] netlink: 'syz.3.3683': attribute type 10 has an invalid length. [ 467.925589][T18276] hsr_slave_0: entered promiscuous mode [ 467.933510][T18276] hsr_slave_1: entered promiscuous mode [ 467.949207][T18276] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 467.956865][T18276] Cannot create hsr debugfs directory [ 468.025481][T18382] netlink: 'syz.4.3687': attribute type 10 has an invalid length. [ 468.035241][T18382] bridge0: port 3(team0) entered blocking state [ 468.042327][T18382] bridge0: port 3(team0) entered disabled state [ 468.087226][ T5240] Bluetooth: hci1: command tx timeout [ 468.166805][T18388] ebtables: ebtables: counters copy to user failed while replacing table [ 468.176892][ C0] eth0: bad gso: type: 1, size: 1408 [ 468.283433][T18391] netlink: 'syz.0.3690': attribute type 1 has an invalid length. [ 468.364091][T18211] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 468.427191][T18211] veth0_vlan: entered promiscuous mode [ 468.454965][T18211] veth1_vlan: entered promiscuous mode [ 468.485669][T18211] veth0_macvtap: entered promiscuous mode [ 468.496736][T18211] veth1_macvtap: entered promiscuous mode [ 468.541071][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 468.550119][T18371] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 468.551813][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.567827][T17283] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.577434][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 468.590544][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.601076][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 468.611832][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.627181][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 468.638398][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.650848][T18211] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 468.670818][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 468.690519][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.701446][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 468.712057][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.726043][T18211] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 468.739761][T18211] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 468.758115][T18211] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 468.767798][T18382] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 468.834750][T18211] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.856207][T18211] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.876743][T18211] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.898976][T18211] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.992032][T18276] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 469.016774][T18409] __nla_validate_parse: 5 callbacks suppressed [ 469.016794][T18409] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3693'. [ 469.063225][T18276] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 469.075990][T18409] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3693'. [ 469.089205][T18276] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 469.104310][T18276] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 469.135950][T18409] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3693'. [ 469.165352][T18413] IPv6: Can't replace route, no match found [ 469.297487][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 469.309188][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 469.354505][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 469.377508][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 469.476750][T18276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 469.601994][T18276] 8021q: adding VLAN 0 to HW filter on device team0 [ 469.630357][ T5310] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.637757][ T5310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.655464][ T5310] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.662705][ T5310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 469.668311][T18429] FAULT_INJECTION: forcing a failure. [ 469.668311][T18429] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.695217][T18429] CPU: 1 UID: 0 PID: 18429 Comm: syz.4.3701 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 469.705833][T18429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 469.715918][T18429] Call Trace: [ 469.719218][T18429] [ 469.722170][T18429] dump_stack_lvl+0x241/0x360 [ 469.726879][T18429] ? __pfx_dump_stack_lvl+0x10/0x10 [ 469.732110][T18429] ? __pfx__printk+0x10/0x10 [ 469.736729][T18429] ? __pfx_lock_release+0x10/0x10 [ 469.741795][T18429] should_fail_ex+0x3b0/0x4e0 [ 469.746504][T18429] _copy_from_user+0x2f/0xe0 [ 469.751125][T18429] copy_msghdr_from_user+0xae/0x680 [ 469.756356][T18429] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 469.762209][T18429] __sys_sendmsg+0x23d/0x3a0 [ 469.766836][T18429] ? __pfx___sys_sendmsg+0x10/0x10 [ 469.771979][T18429] ? vfs_write+0x7c4/0xc90 [ 469.776516][T18429] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 469.782880][T18429] ? do_syscall_64+0x100/0x230 [ 469.787687][T18429] ? do_syscall_64+0xb6/0x230 [ 469.792387][T18429] do_syscall_64+0xf3/0x230 [ 469.796886][T18429] ? clear_bhb_loop+0x35/0x90 [ 469.801570][T18429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.807459][T18429] RIP: 0033:0x7f9c02d773b9 [ 469.811879][T18429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 469.831582][T18429] RSP: 002b:00007f9c027ff048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 469.840026][T18429] RAX: ffffffffffffffda RBX: 00007f9c02f05f80 RCX: 00007f9c02d773b9 [ 469.848031][T18429] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 469.856033][T18429] RBP: 00007f9c027ff0a0 R08: 0000000000000000 R09: 0000000000000000 [ 469.864122][T18429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.872124][T18429] R13: 000000000000004d R14: 00007f9c02f05f80 R15: 00007ffeda9d1a78 [ 469.880147][T18429] [ 470.063990][T18440] netlink: 'syz.3.3704': attribute type 10 has an invalid length. [ 470.093853][T18440] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3704'. [ 470.169210][ T5240] Bluetooth: hci1: command tx timeout [ 470.258774][T18276] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 470.321415][T18458] netlink: 'syz.3.3707': attribute type 1 has an invalid length. [ 470.408315][ T63] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.600997][T18276] veth0_vlan: entered promiscuous mode [ 470.690279][T18276] veth1_vlan: entered promiscuous mode [ 470.717626][T18276] veth0_macvtap: entered promiscuous mode [ 470.735523][T18276] veth1_macvtap: entered promiscuous mode [ 470.753872][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 470.764473][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.778872][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 470.795738][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.806280][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 470.816988][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.826950][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 470.837429][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.847297][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 470.858128][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.870545][T18276] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 470.886300][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 470.897180][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.907586][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 470.921142][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.931035][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 470.941569][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.951408][T18276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 470.962545][ T5226] net_ratelimit: 4 callbacks suppressed [ 470.962561][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.967046][T18276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 470.989638][T18276] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 471.003093][T18276] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.012755][T18276] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.021765][T18276] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.031458][T18276] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 471.106060][T17286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.114297][T17286] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.148591][T17283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 471.157052][T17283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 471.252677][T18474] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.3712'. [ 471.277699][T18474] openvswitch: netlink: Flow key attribute not present in set flow. [ 471.291141][T18474] FAULT_INJECTION: forcing a failure. [ 471.291141][T18474] name failslab, interval 1, probability 0, space 0, times 0 [ 471.304894][T18474] CPU: 1 UID: 0 PID: 18474 Comm: syz.4.3712 Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 471.315340][T18474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 471.325411][T18474] Call Trace: [ 471.328699][T18474] [ 471.331630][T18474] dump_stack_lvl+0x241/0x360 [ 471.336310][T18474] ? __pfx_dump_stack_lvl+0x10/0x10 [ 471.341595][T18474] ? __pfx__printk+0x10/0x10 [ 471.346272][T18474] ? ref_tracker_alloc+0x332/0x490 [ 471.351397][T18474] should_fail_ex+0x3b0/0x4e0 [ 471.356072][T18474] ? skb_clone+0x20c/0x390 [ 471.360517][T18474] should_failslab+0xac/0x100 [ 471.365285][T18474] ? skb_clone+0x20c/0x390 [ 471.369704][T18474] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 471.375163][T18474] skb_clone+0x20c/0x390 [ 471.379407][T18474] __netlink_deliver_tap+0x3cc/0x7c0 [ 471.384713][T18474] ? netlink_deliver_tap+0x2e/0x1b0 [ 471.389914][T18474] netlink_deliver_tap+0x19d/0x1b0 [ 471.395025][T18474] netlink_sendskb+0x68/0x140 [ 471.399706][T18474] netlink_unicast+0x39d/0x990 [ 471.404459][T18474] ? __asan_memcpy+0x40/0x70 [ 471.409064][T18474] ? __pfx_netlink_unicast+0x10/0x10 [ 471.414346][T18474] netlink_rcv_skb+0x262/0x430 [ 471.419104][T18474] ? __pfx_genl_rcv_msg+0x10/0x10 [ 471.424126][T18474] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 471.429416][T18474] ? __netlink_deliver_tap+0x77e/0x7c0 [ 471.434883][T18474] genl_rcv+0x28/0x40 [ 471.438870][T18474] netlink_unicast+0x7f0/0x990 [ 471.443640][T18474] ? __pfx_netlink_unicast+0x10/0x10 [ 471.448919][T18474] ? __virt_addr_valid+0x183/0x530 [ 471.454023][T18474] ? __check_object_size+0x49c/0x900 [ 471.459297][T18474] ? bpf_lsm_netlink_send+0x9/0x10 [ 471.464494][T18474] netlink_sendmsg+0x8e4/0xcb0 [ 471.469262][T18474] ? __pfx_netlink_sendmsg+0x10/0x10 [ 471.474547][T18474] ? __import_iovec+0x536/0x820 [ 471.479394][T18474] ? aa_sock_msg_perm+0x91/0x160 [ 471.484337][T18474] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 471.489624][T18474] ? security_socket_sendmsg+0x87/0xb0 [ 471.495086][T18474] ? __pfx_netlink_sendmsg+0x10/0x10 [ 471.500363][T18474] __sock_sendmsg+0x221/0x270 [ 471.505129][T18474] ____sys_sendmsg+0x525/0x7d0 [ 471.509986][T18474] ? __pfx_____sys_sendmsg+0x10/0x10 [ 471.515279][T18474] __sys_sendmsg+0x2b0/0x3a0 [ 471.519967][T18474] ? __pfx___sys_sendmsg+0x10/0x10 [ 471.525169][T18474] ? vfs_write+0x7c4/0xc90 [ 471.529619][T18474] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 471.535946][T18474] ? do_syscall_64+0x100/0x230 [ 471.540719][T18474] ? do_syscall_64+0xb6/0x230 [ 471.545391][T18474] do_syscall_64+0xf3/0x230 [ 471.549897][T18474] ? clear_bhb_loop+0x35/0x90 [ 471.554574][T18474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.560463][T18474] RIP: 0033:0x7f9c02d773b9 [ 471.564879][T18474] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 471.584481][T18474] RSP: 002b:00007f9c027ff048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 471.592890][T18474] RAX: ffffffffffffffda RBX: 00007f9c02f05f80 RCX: 00007f9c02d773b9 [ 471.600868][T18474] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 471.609011][T18474] RBP: 00007f9c027ff0a0 R08: 0000000000000000 R09: 0000000000000000 [ 471.616977][T18474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.624940][T18474] R13: 000000000000004d R14: 00007f9c02f05f80 R15: 00007ffeda9d1a78 [ 471.632922][T18474] [ 471.762073][ T2478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.770532][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.953250][ T63] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.999694][ T5226] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.025614][T18488] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3714'. [ 472.036356][T18491] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3714'. [ 472.045880][ T5226] IPVS: starting estimator thread 0... [ 472.106831][T18488] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3714'. [ 472.139062][ T5241] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 472.149164][T18494] IPVS: using max 21 ests per chain, 50400 per kthread [ 472.149422][ T5241] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 472.187281][ T5241] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 472.190977][T18499] netlink: 'syz.4.3717': attribute type 10 has an invalid length. [ 472.202776][T18499] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3717'. [ 472.215091][ T5241] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 472.219420][T18499] bridge0: port 3(team0) entered blocking state [ 472.234123][ T5241] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 472.247004][T18499] bridge0: port 3(team0) entered disabled state [ 472.255771][ T5241] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 472.273283][T18495] ------------[ cut here ]------------ [ 472.278882][T18495] WARNING: CPU: 1 PID: 18495 at kernel/workqueue.c:2259 __queue_work+0xcd3/0xf50 [ 472.288126][T18495] Modules linked in: [ 472.292044][T18495] CPU: 1 UID: 0 PID: 18495 Comm: syz-executor Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 472.302652][T18495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 472.312821][T18495] RIP: 0010:__queue_work+0xcd3/0xf50 [ 472.318138][T18495] Code: ff e8 c1 9f 36 00 90 0f 0b 90 e9 1e fd ff ff e8 b3 9f 36 00 eb 13 e8 ac 9f 36 00 eb 0c e8 a5 9f 36 00 eb 05 e8 9e 9f 36 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc [ 472.337856][T18495] RSP: 0018:ffffc9000525f888 EFLAGS: 00010093 [ 472.343935][T18495] RAX: ffffffff815ce3b4 RBX: ffff88802ff01e00 RCX: ffff88802ff01e00 [ 472.351900][T18495] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.359871][T18495] RBP: 0000000000000000 R08: ffffffff815cd814 R09: 0000000000000000 [ 472.367839][T18495] R10: ffffc9000525f960 R11: fffff52000a4bf2d R12: ffff888079332000 [ 472.375895][T18495] R13: ffff8880793321c0 R14: dffffc0000000000 R15: 0000000000000008 [ 472.383868][T18495] FS: 0000555594408500(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 [ 472.392799][T18495] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.399378][T18495] CR2: 00000000201f6000 CR3: 0000000029cfe000 CR4: 00000000003506f0 [ 472.407345][T18495] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 472.415314][T18495] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 472.423282][T18495] Call Trace: [ 472.426562][T18495] [ 472.429490][T18495] ? __warn+0x163/0x4e0 [ 472.433647][T18495] ? __queue_work+0xcd3/0xf50 [ 472.438322][T18495] ? report_bug+0x2b3/0x500 [ 472.442820][T18495] ? __queue_work+0xcd3/0xf50 [ 472.447585][T18495] ? handle_bug+0x3e/0x70 [ 472.451913][T18495] ? exc_invalid_op+0x1a/0x50 [ 472.456587][T18495] ? asm_exc_invalid_op+0x1a/0x20 [ 472.461648][T18495] ? __queue_work+0x124/0xf50 [ 472.466320][T18495] ? __queue_work+0xcc4/0xf50 [ 472.470993][T18495] ? __queue_work+0xcd3/0xf50 [ 472.475669][T18495] ? __queue_work+0xcc4/0xf50 [ 472.480354][T18495] queue_work_on+0x1c2/0x380 [ 472.484946][T18495] ? __pfx_queue_work_on+0x10/0x10 [ 472.490061][T18495] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 472.495949][T18495] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 472.502272][T18495] ? skb_queue_tail+0x36/0x120 [ 472.507033][T18495] hci_recv_frame+0x598/0x6f0 [ 472.511739][T18495] vhci_write+0x35c/0x490 [ 472.516072][T18495] do_iter_readv_writev+0x60a/0x890 [ 472.521282][T18495] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 472.527009][T18495] ? bpf_lsm_file_permission+0x9/0x10 [ 472.532387][T18495] ? security_file_permission+0x7f/0xa0 [ 472.537939][T18495] ? rw_verify_area+0x1d2/0x6b0 [ 472.542800][T18495] vfs_writev+0x37c/0xbb0 [ 472.547235][T18495] ? __pfx_lock_acquire+0x10/0x10 [ 472.552260][T18495] ? __pfx_vfs_writev+0x10/0x10 [ 472.557115][T18495] ? __fget_files+0x29/0x470 [ 472.561716][T18495] do_writev+0x1b1/0x350 [ 472.565958][T18495] ? __pfx_do_writev+0x10/0x10 [ 472.570813][T18495] ? do_syscall_64+0x100/0x230 [ 472.575700][T18495] ? do_syscall_64+0xb6/0x230 [ 472.580377][T18495] do_syscall_64+0xf3/0x230 [ 472.584884][T18495] ? clear_bhb_loop+0x35/0x90 [ 472.589561][T18495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.595460][T18495] RIP: 0033:0x7fd2cfb7704d [ 472.599890][T18495] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 1a 7b 02 00 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 6e 7b 02 00 48 [ 472.619501][T18495] RSP: 002b:00007ffe47dc0c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 472.627921][T18495] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd2cfb7704d [ 472.635892][T18495] RDX: 0000000000000003 RSI: 00007ffe47dc0cd0 RDI: 00000000000000ca [ 472.643952][T18495] RBP: 00005555944084a8 R08: 0000000000000000 R09: 0000000000000000 [ 472.651921][T18495] R10: 0000000000000008 R11: 0000000000000293 R12: 0000000000000000 [ 472.659893][T18495] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009 [ 472.667881][T18495] [ 472.670927][T18495] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 472.678194][T18495] CPU: 1 UID: 0 PID: 18495 Comm: syz-executor Not tainted 6.10.0-syzkaller-12613-g84383b5ef4cd #0 [ 472.688769][T18495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 472.698824][T18495] Call Trace: [ 472.702100][T18495] [ 472.705466][T18495] dump_stack_lvl+0x241/0x360 [ 472.710141][T18495] ? __pfx_dump_stack_lvl+0x10/0x10 [ 472.715340][T18495] ? __pfx__printk+0x10/0x10 [ 472.719974][T18495] ? vscnprintf+0x5d/0x90 [ 472.724327][T18495] panic+0x349/0x860 [ 472.728249][T18495] ? __warn+0x172/0x4e0 [ 472.732404][T18495] ? __pfx_panic+0x10/0x10 [ 472.736854][T18495] __warn+0x346/0x4e0 [ 472.740849][T18495] ? __queue_work+0xcd3/0xf50 [ 472.745535][T18495] report_bug+0x2b3/0x500 [ 472.749866][T18495] ? __queue_work+0xcd3/0xf50 [ 472.754565][T18495] handle_bug+0x3e/0x70 [ 472.758726][T18495] exc_invalid_op+0x1a/0x50 [ 472.763230][T18495] asm_exc_invalid_op+0x1a/0x20 [ 472.768079][T18495] RIP: 0010:__queue_work+0xcd3/0xf50 [ 472.773365][T18495] Code: ff e8 c1 9f 36 00 90 0f 0b 90 e9 1e fd ff ff e8 b3 9f 36 00 eb 13 e8 ac 9f 36 00 eb 0c e8 a5 9f 36 00 eb 05 e8 9e 9f 36 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc [ 472.792964][T18495] RSP: 0018:ffffc9000525f888 EFLAGS: 00010093 [ 472.799031][T18495] RAX: ffffffff815ce3b4 RBX: ffff88802ff01e00 RCX: ffff88802ff01e00 [ 472.807002][T18495] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.814973][T18495] RBP: 0000000000000000 R08: ffffffff815cd814 R09: 0000000000000000 [ 472.822946][T18495] R10: ffffc9000525f960 R11: fffff52000a4bf2d R12: ffff888079332000 [ 472.830916][T18495] R13: ffff8880793321c0 R14: dffffc0000000000 R15: 0000000000000008 [ 472.838890][T18495] ? __queue_work+0x124/0xf50 [ 472.843567][T18495] ? __queue_work+0xcc4/0xf50 [ 472.848266][T18495] ? __queue_work+0xcc4/0xf50 [ 472.852974][T18495] queue_work_on+0x1c2/0x380 [ 472.857581][T18495] ? __pfx_queue_work_on+0x10/0x10 [ 472.862792][T18495] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 472.868856][T18495] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 472.875264][T18495] ? skb_queue_tail+0x36/0x120 [ 472.880034][T18495] hci_recv_frame+0x598/0x6f0 [ 472.884717][T18495] vhci_write+0x35c/0x490 [ 472.889064][T18495] do_iter_readv_writev+0x60a/0x890 [ 472.894268][T18495] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 472.899987][T18495] ? bpf_lsm_file_permission+0x9/0x10 [ 472.905443][T18495] ? security_file_permission+0x7f/0xa0 [ 472.911075][T18495] ? rw_verify_area+0x1d2/0x6b0 [ 472.915959][T18495] vfs_writev+0x37c/0xbb0 [ 472.920321][T18495] ? __pfx_lock_acquire+0x10/0x10 [ 472.925364][T18495] ? __pfx_vfs_writev+0x10/0x10 [ 472.930224][T18495] ? __fget_files+0x29/0x470 [ 472.934833][T18495] do_writev+0x1b1/0x350 [ 472.939086][T18495] ? __pfx_do_writev+0x10/0x10 [ 472.943939][T18495] ? do_syscall_64+0x100/0x230 [ 472.948699][T18495] ? do_syscall_64+0xb6/0x230 [ 472.953370][T18495] do_syscall_64+0xf3/0x230 [ 472.957876][T18495] ? clear_bhb_loop+0x35/0x90 [ 472.962552][T18495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.968448][T18495] RIP: 0033:0x7fd2cfb7704d [ 472.972866][T18495] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 1a 7b 02 00 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 6e 7b 02 00 48 [ 472.992559][T18495] RSP: 002b:00007ffe47dc0c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 473.000973][T18495] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fd2cfb7704d [ 473.008942][T18495] RDX: 0000000000000003 RSI: 00007ffe47dc0cd0 RDI: 00000000000000ca [ 473.016904][T18495] RBP: 00005555944084a8 R08: 0000000000000000 R09: 0000000000000000 [ 473.024870][T18495] R10: 0000000000000008 R11: 0000000000000293 R12: 0000000000000000 [ 473.032940][T18495] R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000009 [ 473.040924][T18495] [ 473.044162][T18495] Kernel Offset: disabled [ 473.048479][T18495] Rebooting in 86400 seconds..