last executing test programs: 2.375050113s ago: executing program 4 (id=9602): r0 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c0000002e00090027bd7000000000000403e70004001d0004001e00a4857b38b4db1171ef2d30f306df368f476a95448c4c7e573c364649ce00f9da8958c6dbac1fd63ce14c35a149c0b4b01af2bbf94fd732ee25b7b192f68a2fac35c8ae7b0c07d3df4f36a95f57d79b6a710841a4bc188272176f2fd67c4e85c458e6388b9377de29a55f0923"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 2.213915993s ago: executing program 0 (id=9605): connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r0 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x20023) r1 = socket$kcm(0x2a, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r3) socket$netlink(0x10, 0x3, 0x4) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, 0x0, 0x0, 0x50040, &(0x7f00000001c0)={0x11, 0x8906, r5, 0x1, 0xd8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f00000000c0)) r7 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r7, &(0x7f0000000100)=[{{&(0x7f0000000080)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000400)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="c685e3edc50741e5", 0x8}], 0x1}}], 0x2, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r9, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0xfffffffffffffcae, 0x0}, 0x8004) recvmsg$unix(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x50, r10, 0xffffe000) close(r10) sendmsg$kcm(r1, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) 2.09131537s ago: executing program 4 (id=9607): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES64=r0, @ANYBLOB="c04ba9e36d", @ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRES16, @ANYRESOCT=r0, @ANYRES8=0x0, @ANYRES8=r0], 0x44}, 0x1, 0x0, 0x0, 0xc093e35dc439fada}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r2, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3], 0x6f4}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000010000000f000000080034000400000008000300", @ANYRES32=r6, @ANYBLOB="05003300d6"], 0x2c}}, 0x80) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r5, 0x200, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c}, 0x20000000) 1.835983871s ago: executing program 4 (id=9611): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=@newtaction={0x68, 0x30, 0x871a15abc695fb3f, 0x70bd27, 0x1, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0xffff, 0x10000000, 0x7, 0xfff}, 0x200}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0x68}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCADDRT(r3, 0x890b, &(0x7f0000000540)={@null, 0x0, 'nr0\x00'}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r2}, 0x4) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x70, 0x7fffffe, 0x90, [0x0, 0x0, 0x0, 0x0, 0x200000001300, 0x200000001330], 0x0, 0x0, 0x0}, 0x108) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a0000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r5, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x84, @remote, 0x15, 0x3, 'wrr\x00', 0x1, 0x4, 0x72}, 0x2c) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(r8, &(0x7f00000007c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000780)={&(0x7f0000000800)={0x14c, r9, 0x300, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xf}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x0, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x0, 0x8, 0x20}]}, @IPVS_CMD_ATTR_DEST={0x3c}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x101}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'lo\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0x14c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=@newtaction={0x14, 0x30, 0x800, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x9}, &(0x7f0000000380)={0x9, 0x2, 0x7fff, 0x22c, 0x5, 0x1000000, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7, 0xd, 0x81, 0xa1, 0x3, 0x7, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, &(0x7f00000004c0)={&(0x7f0000000240)={[0xc6]}, 0xfffffffffffffd50}) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="680000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000003800128009000100766c616e000000002800028006000100040000001c0003800c00010400000000010000000c000100f7ffffff0300000008000500", @ANYRES32=r14, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x68}, 0x1, 0x0, 0x0, 0x600}, 0x0) 1.750972343s ago: executing program 0 (id=9613): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) accept4$inet6(r0, 0x0, 0x0, 0x80000) shutdown(r0, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ppoll(&(0x7f0000000080)=[{r0, 0x9085}], 0x1, 0x0, &(0x7f00000001c0)={[0x8000000000000000]}, 0x8) 1.598555316s ago: executing program 3 (id=9616): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) r1 = socket$netlink(0x10, 0x3, 0x2) sendmsg$netlink(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)={0xc4, 0x23, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@generic="57b45596ed0e0b9c9332f62a67bb71312cbd95d1d8bbe55757310d90cda7db421a5078502f1eaa238e7f71b7c9b0115131aeeab10a02a56a77e8ee33c83728a463af00b77b06aace52d70dbf9a916adbb9083cc957c97fbdfc47be6b87dea87cab199948f143d8543b5e400b95d73fd38c87cf84b5fd59ca77988b16ccca5fd3708ba27cae5f72ef282c800fa71399dc150eb6689419efdcb2416054eb99a5e81f188a", @typed={0x4, 0xda}, @typed={0xc, 0x11, 0x0, 0x0, @u64=0x5}]}, 0xc4}], 0x1, &(0x7f0000000180)=[@rights={{0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}}, @rights={{0x28, 0x1, 0x1, [r0, 0xffffffffffffffff, r0, r0, r0, r0]}}], 0x50, 0x4040000}, 0x20008001) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFTA_SET_ID={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x6}]}, @NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xc, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xcc}}, 0x4000000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000050000000180100002fee702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x8000) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) r11 = socket(0x1, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'erspan0\x00'}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x24044800) r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x1, 0x803, 0x0) getsockname$packet(r14, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010000304000300"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100766c616e000000001800028006000100fe0f00000c0002000e0000000800000008000500", @ANYRES32=r15, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r15, @ANYBLOB="9bfb246e3a527aae995133c03b703ee78a5d31d7c72ac67ade86744659d2e272f68eda6c04c471653667165aeb570580696148711a"], 0x58}}, 0x8000) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xd, 0x0, 0x20040001, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}}) 1.547125333s ago: executing program 0 (id=9617): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x2, 0x3, 0x1, 0x0, 0x40}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x2, 0x13, 0x0, 0x70bd2d, 0x25dfdbff, [@sadb_lifetime={0x4, 0x3, 0x46710a30, 0x9, 0x2, 0x5}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0xfffffffb}}, @sadb_sa={0x2, 0x1, 0x0, 0x4, 0x0, 0x5, 0xc}, @sadb_address={0x5, 0x5, 0x33, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}}, @sadb_key={0x1, 0x8}]}, 0x98}, 0x1, 0x7}, 0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb) r4 = accept4(r1, 0x0, &(0x7f00000001c0), 0x0) accept$ax25(r4, &(0x7f0000000440)={{0x3, @netrom}, [@null, @remote, @null, @netrom, @default, @remote, @null, @rose]}, &(0x7f00000002c0)=0x48) accept4(r1, 0x0, 0x0, 0x80000) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYRES8=r3, @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc00080005000900000014000400cefd4747291f635f2d4ff176c8768649d2d858b2939a54a5fbecd0b2db0653c13c9b36816b99732ac47d8b569ee3b0"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.53219099s ago: executing program 4 (id=9618): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000000040)=[{{&(0x7f00000003c0)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000000)="7f", 0x1}], 0x1}}], 0x1, 0x0) listen(r1, 0xfff) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f00000000c0)={0x5c}, 0x8) accept(r1, 0xfffffffffffffffd, &(0x7f0000000680)) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x7, &(0x7f0000001c40)=0x2000ff, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$can_raw(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r3}, 0x10, &(0x7f00000005c0)={&(0x7f00000000c0)=@can={{}, 0x80, 0x3, 0x4, 0x2}, 0x210}}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000180)={0x0, 'bridge0\x00', {0x4}, 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000004b40)={&(0x7f00000029c0)=@delchain={0x24, 0x65, 0x100, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x3}, {0x5, 0x9}, {0xe, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000c0}, 0xc054) r6 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071107d00000000001d300200000000004704000001ed030407030000060000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 1.30719371s ago: executing program 1 (id=9620): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x418, 0x210, 0x210, 0x138, 0x0, 0x210, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x3f00, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'gretap0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60}}, {{@ip={@broadcast, @empty, 0x0, 0x3f000000, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) 1.123441348s ago: executing program 0 (id=9622): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r1}, 0x20) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) sendfile(r0, r5, 0x0, 0xffffffff004) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x20000000) 943.05847ms ago: executing program 1 (id=9623): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e21, @multicast1}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="5c01000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000050000000001000004d46c0000007f000005000000000000000000000000004000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffe10000270000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240009000f00000000000000810000000006000009000000000000000001"], 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001200)=ANY=[@ANYBLOB="380100001a000100feffffff00010000e0000002000000000000000000000000ac1414aa0000000000000010000000000001071c4e2300070a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc01000000000000000000000000000100000000000000000800000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000000100010000000000fefffffffffffffffefffffffc030000000000008000000005350000020001002000000000000000480003006465666c617465"], 0x138}}, 0x844) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) 942.274684ms ago: executing program 0 (id=9624): socket(0x28, 0x5, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x28, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002201c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x41000000, 0x8811}, 0x0) 874.868008ms ago: executing program 2 (id=9625): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000013010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c00048010000180080001006c6f6700040002802800018008000100666962001c00028008000140000000110800034000000005080002"], 0xec}}, 0x0) 815.300989ms ago: executing program 3 (id=9626): syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="59cf00000000010f00000800000004000180060001"], 0x28}, 0x1, 0x0, 0x0, 0x400c081}, 0x42000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = epoll_create(0x9) writev(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r3) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYRES64=r0, @ANYRES16=r5, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r3], 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x0) 679.186824ms ago: executing program 1 (id=9627): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) accept4$inet6(r0, 0x0, 0x0, 0x80000) shutdown(r0, 0x0) clock_gettime(0x0, &(0x7f0000000140)) ppoll(&(0x7f0000000080)=[{r0, 0x9085}], 0x1, 0x0, &(0x7f00000001c0)={[0x8000000000000000]}, 0x8) 678.956889ms ago: executing program 0 (id=9628): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$F2FS_IOC_DECOMPRESS_FILE(r0, 0xf517, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) recvmmsg(r1, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000002640)=[{0x0}, {&(0x7f0000001440)=""/100, 0x64}], 0x2}, 0xfffe}], 0x1, 0x2, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) epoll_create1(0x0) socket$kcm(0x2, 0x200000000000001, 0x106) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket(0x21, 0x2, 0x10000000000002) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x400000, 0x0, 0xffffffffffffff1b, 0x7b}, 0x0, &(0x7f0000000280)={0x3fc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 653.350371ms ago: executing program 2 (id=9629): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@bridge_newvlan={0x24, 0x76, 0x709, 0x2, 0x0, {0x7, 0x2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0xd, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5, 0x3, 0x4}}]}, 0x24}, 0x1, 0x5502000000000000}, 0x4000) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000000)={@remote, @multicast1, 0x4, "d30f388c52647612d91de4353d68b0fa00", 0x0, 0x0, 0x4000000, 0x8}, 0x3c) setsockopt$MRT_ADD_MFC(r1, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0x0, 0x4, 0xfffffffe}, 0x3c) setsockopt$MRT_ADD_MFC(r1, 0x0, 0xcc, &(0x7f0000000200)={@empty, @private, 0x0, "606b177019716ea6ff1f4d7ed79c31e2e0f1da00000000230000002000", 0x1, 0x0, 0x3}, 0x3c) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), 0xffffffffffffffff) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newsa={0x104, 0x10, 0x281, 0x0, 0x0, {{@in=@remote, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}, {@in=@private, 0x4d2, 0x3c}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in=@multicast1}]}, 0x104}}, 0x0) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x2, 0x10, 0x4, 0x64, 0x2, 0x5, 0x4b, 0xa7, @loopback, @dev={0xac, 0x14, 0x14, 0x35}}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe000031f, 0x0, "ff00000058b274e6d845167fefe428970548fc3c7b00000000000000fcff00", 0xb2, 0xb, 0x6, 0x6}, 0x3c) setsockopt$MRT_FLUSH(r1, 0x0, 0xd4, &(0x7f00000003c0)=0xa, 0x4) socket$inet(0x2, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x20000000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c000000100001080000800000000000000000009c74f7ed3f03531b3f9214ea89e527ebde12674904736cf719899f3aca46960343d9d5f5a8703ec4372eeae331fa4c8606af99e6a33abf1e3f6e27a0cbe99e81fd50d0ff5e6fd39032", @ANYRES32=0x0, @ANYBLOB="332000000000000004002b8008001b0000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) bind$llc(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x803, 0x6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r7, &(0x7f0000000140)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) 625.475449ms ago: executing program 3 (id=9630): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int={0xd, 0x0, 0x0, 0x1, 0x0, 0xe, 0x0, 0x2f, 0x1}]}}, 0x0, 0x2a, 0x0, 0x8, 0xcc2}, 0x28) socket$inet6_icmp(0xa, 0x2, 0x3a) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x34, r1, 0x1, 0x70bd2d, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5, 0xb, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000000e000000400000000300000041000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000040), 0x1003, r2}, 0x38) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000200)='cgroup.clone_children\x00', 0x2, 0x0) r5 = openat$cgroup_ro(r3, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x38) 502.574891ms ago: executing program 1 (id=9631): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000040)={0x2, 'ipvlan1\x00', {0x10000}, 0x5}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000140)=""/93, &(0x7f0000000100)=0x5d) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) syz_extract_tcp_res(&(0x7f0000000080), 0x0, 0x100) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x18}, @val={0x3, 0x4, 0x3, 0x4, 0xc5, 0x10}, @ipv4=@generic={{0x37, 0x4, 0x3, 0x7, 0xe1, 0x68, 0x0, 0x6, 0x32, 0x0, @dev={0xac, 0x14, 0x14, 0x22}, @loopback, {[@cipso={0x86, 0x3d, 0xffffffffffffffff, [{0x1, 0xb, "75a028f6071723f0f6"}, {0x6, 0xd, "295664ac90317d09c09795"}, {0x4, 0x10, "2c34af04a0863aee9d5de3c4b3cb"}, {0x5, 0x8, "461a67939429"}, {0x5, 0x7, "68a9c66987"}]}, @ssrr={0x89, 0x13, 0xee, [@empty, @private=0xa010101, @rand_addr=0x64010101, @loopback]}, @end, @timestamp_addr={0x44, 0x14, 0x4b, 0x1, 0x1, [{@local, 0x1ff}, {@rand_addr=0x64010102, 0x1c}]}, @rr={0x7, 0x13, 0xbc, [@rand_addr=0x64010101, @private=0xa010100, @loopback, @broadcast]}, @timestamp_prespec={0x44, 0x14, 0x92, 0x3, 0xf, [{@multicast2}, {@multicast2, 0x2}]}, @ssrr={0x89, 0x1f, 0xb8, [@private=0xa010100, @loopback, @rand_addr=0x64010100, @multicast2, @remote, @loopback, @rand_addr=0x64010100]}, @end, @ssrr={0x89, 0x1b, 0xe3, [@broadcast, @local, @multicast2, @broadcast, @multicast1, @empty]}]}}, "24d7a9222a"}}, 0xef) 488.117174ms ago: executing program 2 (id=9632): getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000000)={0x0, 0xb692}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080)={r0, 0x6}, 0x8) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000000c0)={0xffffffffffffffff, 0x4, 0x7fffffff, 0x10}) sendmsg$IPSET_CMD_GET_BYINDEX(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, 0xf, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0xffffffffffffffff}]}, 0x34}, 0x1, 0x0, 0x0, 0x8048840}, 0x44) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xd8, 0x1403, 0x20, 0x70bd26, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_hsr\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'pim6reg0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'gretap0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'gretap0\x00'}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x40}, 0x4000) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000500)={r1, &(0x7f00000003c0)="463248d96c9d74d5ef86a6c4e885b219e2813620cf2e6a837436efb3a2dac7972816823149405076c92ff3ae8f427d6f00743cb107ef7c79626180ac54a7cbdf755200aa153e7871c889a515dd75183b5dccfed0c430f78d98dd5d1d21aade", &(0x7f0000000440)=""/190}, 0x20) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x1ff}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x72}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x8}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x8}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xff}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x24000014) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000680), &(0x7f00000006c0)=0x4) sendmsg$IPCTNL_MSG_CT_GET_DYING(r1, &(0x7f00000007c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x14, 0x6, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x3}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x41) recvfrom$unix(r1, &(0x7f0000000800)=""/123, 0x7b, 0x2, &(0x7f0000000880)=@abs={0x1, 0x0, 0x4e22}, 0x6e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000900), 0x101040, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f0000000940)={0x2, 0x23, "bb4ab36c2734c04f37e4f589512e3f149e03f8c4af478ea3859372721b44d2e3cf38de"}) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r4, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x18, 0x140f, 0x2, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x4000080) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000a80), 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000ac0)={r0, 0x28}, 0x8) getsockopt$bt_hci(r2, 0x0, 0x1, &(0x7f0000000b00)=""/4096, &(0x7f0000001b00)=0x1000) r5 = bpf$TOKEN_CREATE(0x24, &(0x7f0000001b40)={0x0, r4}, 0x8) ppoll(&(0x7f0000001b80)=[{r1, 0x5000}, {r1, 0x80}, {r3, 0x2228}, {r3, 0x20}, {r3, 0x268}, {r5, 0xc304}, {r1, 0x1000}, {r4, 0x4000}, {r3, 0x5c0}], 0x9, &(0x7f0000001c00), &(0x7f0000001c40)={[0x1]}, 0x8) shutdown(r2, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_CHANNEL_POLICY(r6, 0x112, 0xa, &(0x7f0000001c80)=0x10001, &(0x7f0000001cc0)=0x4) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000001d00)) sendmsg$tipc(r1, &(0x7f0000002100)={&(0x7f0000001d40)=@nameseq={0x1e, 0x1, 0x1, {0x40}}, 0x10, &(0x7f0000002000)=[{&(0x7f0000001d80)="bcd33e0cb7064536024d83b3d8aecc0c938eae06d1a632207608025c8762faff70c652544285660bf8fa09a4bfb3588fbb335868db005d12a2584bcea43cfad40d8f4b7b5237139006d78c052c2938dcc5c627e8feba5099efcdbcadf0b25984625334c7af3e8848a96685f117fd8b8af2bf344083c188bca3aeed3b6c9544a5c0cec64577abb0bbf2e0f15d490e", 0x8e}, {&(0x7f0000001e40)="7084cdbe37e4ee2c1a12d2545266f9a17cb911215c30bb59607ab77b32d711520aaa5b11fa2bb984d2f449e8cd19b1f78cfa13dee4f6ff142a60e5c4c982e86c4b69cbd623c90095f0ce3a25d9e6eca0d58bbce7b1701acd0c40b42acaba9f3ee95707e394bbd42541bd79e8c8b9a7823d9c604d4072126ab9bf07798365933c259d783943162676a126fb42b0257ee0abcf91e2be6c87c58f013b96840f9aa18616b902c48645a4c300feb689ceda731b608c69cc84f579d970a31cdbdaed034e129e19190f5ae8e8c4", 0xca}, {&(0x7f0000001f40)="51d901ffb846031d45163005d9cfe1b55cc8ab805aba2fdb86ea0a", 0x1b}, {&(0x7f0000001f80)="2b84ba9470cf4d8b738a55e4c3367082bc434453c9c2b4b469d13caf67bced87510678fe540eec7cf1228556f879e8569fdcfec03fe42a6c0bfa349f6aa8ff7e663209a338d59019a7c6", 0x4a}], 0x4, &(0x7f0000002040)="32ff1efc6918b5f02899475b3574f754f12e05530841d3c8274067edf3d70ba07346ba8aeeb4145833628c08a604017cda8b768a1355dfb71dc028644a062a378ac5831c6e6febe6514abad64bf7745d5acd3fae8389c947ab885c444fb6c771b261de368b4cc30deffb6d8a195d83a7d5fbbd57c971de2fb2d49ed3d7291153f094caa24d0ca7eff8d1d6e6436d6c7916817d586996c1415bc9a45e", 0x9c, 0x40080}, 0x4004000) getsockname$packet(r1, &(0x7f0000002180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000021c0)=0x14) getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000002200)={@ipv4={""/10, ""/2, @multicast2}, 0x0}, &(0x7f0000002240)=0x14) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f00000023c0)={&(0x7f0000002140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000002380)={&(0x7f00000022c0)={0xb8, 0x0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xd}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x9}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xe}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8000}, 0x10) 444.323167ms ago: executing program 4 (id=9633): syz_init_net_socket$netrom(0x6, 0x5, 0x0) r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x4, @loopback, 0x4}], 0x1c) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x528, 0x0, 0x18c, 0x203, 0x348, 0x19030000, 0x458, 0x2e0, 0x2e0, 0x458, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x16, 0x0, 0x3, 0x4, 'snmp\x00', 'syz0\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x588) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000080)={r2, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6}, 0x10) accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000000), &(0x7f00000000c0)=0x60, 0xd75d34e5b2237a9d) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000003c0)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r4, 0x27, 0x36, 0x0, &(0x7f0000000540)="f8ad48cc8bd37058c8007f5b86dd1555f459d05745070054084e74b0ccfea9ed5a6f6dc3343571000235a379021d0cf88f83704ebf95", 0x0, 0x200, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68a75f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c0005800800014000000008080002"], 0x1ec}}, 0x0) sendmsg$IPSET_CMD_PROTOCOL(r3, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="240000000107010200000000000000000900000605000100070000000500010007000000"], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) close(0x3) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000140)=[@in6={0xa, 0x4e23, 0xb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3ff}, @in6={0xa, 0x4e24, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}, @in6={0xa, 0x4e24, 0xd4, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4b2}, @in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e22, 0x8, @dev={0xfe, 0x80, '\x00', 0x23}, 0x7f}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e23, 0x7, @mcast1, 0x9}], 0xac) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x3c, r6, 0x1, 0x4, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TX_RATES={0x20, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x1c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x808, 0x7, 0x5, 0x8, 0x8, 0x1, 0x8, 0x5]}}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000801}, 0x10) sendto$inet6(r0, &(0x7f0000000040)="00d8", 0x20000, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback, 0xc5f}, 0x1c) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x40a) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r8) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000004c0)={'syz_tun\x00'}) 371.027633ms ago: executing program 3 (id=9634): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) write(r0, &(0x7f0000000040)="1d1e8344", 0x4) 369.463044ms ago: executing program 2 (id=9635): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) preadv(r0, &(0x7f0000000180)=[{0x0}, {&(0x7f0000000040)=""/248, 0xf8}], 0x2, 0xe9, 0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000000000007111af00000000008510000002000000850000000a00000095000000000000009500a5050000a05c3a3f19a578c06c500000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 315.30472ms ago: executing program 4 (id=9636): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) (async) r1 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_rxfh_indir={0x39}}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_PLIMIT={0x8, 0x1, 0xff}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x2, 0x9}]}}]}, 0x40}}, 0x4800) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r6 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0xc8, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r7, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8001]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x6, 0x100, 0x5d, 0x0, 0x7ff, 0x200}}, {0x4}}]}]}, 0xc8}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @rand_addr=0x64010102}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r9}, 0x0) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x9007}, 0x4) (async) r11 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r11, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x9007}, 0x4) (async) r12 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r12, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e24, @remote}}, 0x0, 0x0, 0xf, 0x0, "58a046a250585c533c07b7166451ce131e091c0c68d48a42886e9e4435558c205b63a46581dae788abf7352bdc521c1e65baced05f561a777c7f4cfe8ac4dbe8f60925b179dabf1630495875b997b434"}, 0xd8) (async) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r14, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r13, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r14, {0x0, 0x3}, {0x5, 0xb}, {0xfff3, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x40000) (async) r15 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(r15, 0x107, 0x16, &(0x7f0000000240)={0x5, &(0x7f0000000200)=[{0x8b, 0x1, 0x8, 0x2}, {0xead, 0x41, 0x1, 0x6}, {0xffff, 0x8, 0x0, 0x2}, {0x6, 0xf, 0x3, 0x2}, {0x9, 0x80, 0x5, 0x97}]}, 0x10) close(0x4) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000048000000160a01000000000000000000010000010900010073797a30000000000900020073797a30000000001c0003800800014000000000080002400000000000000140000000004c020000180a0101000b000000000000010000000900010073797a3000000000e800038008000140000000000800014000000000cc0003801400010069703665727370616e3000000000000014000100776732000000000000000000000000001400010076657468305f6d61637674617000000014000100626f6e645f736c6176655f310000000045000100626f6e645f736c6176655f300000000014000100636169663000000000000000000000001400010070696d726567300000000000000000001400010070696d726567310000000000000000001400010069705f76746930000000000000000000140001007465616d5f736c6176655f30000000ffff000140000000200900020073797a30"], 0x2dc}}, 0x4008000) 288.687459ms ago: executing program 1 (id=9637): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2, 0x6}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0xa, 0xfffe, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x3]}}]}}]}, 0x8c}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000002000000000200000000008406010000000000000300000d"], &(0x7f0000000f40)=""/4079, 0x4a, 0xfef, 0x8, 0x4}, 0x28) 227.440995ms ago: executing program 2 (id=9638): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e21, @multicast1}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="5c01000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000050000000001000004d46c0000007f000005000000000000000000000000004000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffe10000270000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240009000f00000000000000810000000006000009000000000000000001"], 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001200)=ANY=[@ANYBLOB="380100001a000100feffffff00010000e0000002000000000000000000000000ac1414aaffffffffffffff80000000000001071c4e2300070a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc01000000000000000000000000000100000000000000000800000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000000100010000000000fefffffffffffffffefffffffc030000000000008000000005350000020001002000000000000000480003006465666c617465"], 0x138}}, 0x844) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) 206.912022ms ago: executing program 3 (id=9639): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 146.840299ms ago: executing program 2 (id=9640): r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$int_out(r0, 0x0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x1}, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x2c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x1b, &(0x7f0000001800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000000000008500000017000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b40)={r2, r4, 0x25, 0x0, @val=@tcx={@void, @value=r2}}, 0x1c) syz_emit_ethernet(0x6a, &(0x7f0000000040)=ANY=[], 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x104, 0x4, 0x3f0, 0x0, 0xe8, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@empty, @remote, 0x0, 0xffffff00, 0x3, 0x6, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}, {[0xff, 0x0, 0x0, 0xff, 0xff]}}, 0x9, 0x2, 0x81, 0xfffc, 0xbd, 0x5, 'veth0_vlan\x00', 'caif0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0x401}}}, {{@arp={@remote, @multicast2, 0x0, 0xffffff00, 0xf, 0x1, {@mac=@multicast, {[0x7f, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xff]}}, 0x1, 0x6, 0x53, 0x1ff, 0x0, 0x7, 'team_slave_0\x00', 'wg2\x00', {}, {0xff}, 0x0, 0x1}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@random="58538100", @multicast2, @multicast1, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @unspec=@NFQUEUE2={0x0, 'NFQUEUE\x00', 0x2, {0x7, 0x5, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x198d888f69bc8790) r5 = socket(0x10, 0x80002, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000500)={r5}) listen(r0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES32=r6, @ANYRES16=r0], 0x48}}, 0x0) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r7, 0x84, 0x7f, &(0x7f0000000140)="0200000009800089", 0x8) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f0000000040)={0x7, 0x7, 0x4}, &(0x7f0000000080)=0x28) 90.295231ms ago: executing program 3 (id=9641): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.current\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, 0xfffffffffffffffe) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xd, 0x0, 0x20040001, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}}) 0s ago: executing program 1 (id=9642): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000380)=@in4={0x21, 0x204b, 0x2, 0x10, {0x2, 0x4e21, @empty}}, 0x24) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000005e44f954c6b311a854a7ce673b46342911d1f0619eb513229688763fe15f0d4aa096c02e25cced2fcbf03a1058b204cd4e661b715479c92805e4805e1a6a5d8a1eef6226761d487dae961904dfa2", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000002c0), 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async, rerun: 32) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000280)=0x10, 0x4) (async, rerun: 32) readv(r2, &(0x7f0000000200)=[{&(0x7f0000001b80)=""/4096, 0x1000}], 0x1) (async) sendmsg$can_bcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES64=0x0], 0x80}}, 0x0) (async) r3 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000080)={0x8}, 0x10) (async, rerun: 64) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async, rerun: 64) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000206030000000000000000000d0000000c000300686173683a69700005000400000000000900020073797a31000000000c000780080008400000005d05000500020000000500010006"], 0x50}}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) (async, rerun: 32) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) recvmsg(r6, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) (async) r7 = socket$unix(0x1, 0x2, 0x0) (async, rerun: 64) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4d2f02, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000002c0)=@tcp6=r8}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x54, 0x2c, 0xd27, 0x30bd29, 0x40000002, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x24, 0x2, [@TCA_BASIC_EMATCHES={0x20, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x7}, {0x7, 0xffffffffffffff5c}}}]}]}]}}]}, 0x54}}, 0x0) write(r3, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000180), 0x1003, r1}, 0x38) kernel console output (not intermixed with test programs): [T32025] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8210'. [ 728.001706][T32025] bridge_slave_1: left allmulticast mode [ 728.012625][T32025] bridge_slave_1: left promiscuous mode [ 728.024330][T32025] bridge0: port 2(bridge_slave_1) entered disabled state [ 728.032154][T32027] netlink: 'syz.0.8209': attribute type 3 has an invalid length. [ 728.042999][T32025] bridge_slave_0: left allmulticast mode [ 728.051967][T32025] bridge_slave_0: left promiscuous mode [ 728.058707][T32025] bridge0: port 1(bridge_slave_0) entered disabled state [ 728.627130][T32059] netlink: 'syz.3.8220': attribute type 2 has an invalid length. [ 728.676054][T32064] xt_bpf: check failed: parse error [ 728.701437][T32059] !: entered promiscuous mode [ 728.895051][T32078] bond3: option resend_igmp: invalid value (2878) [ 728.902187][T32078] bond3: option resend_igmp: allowed values 0 - 255 [ 728.912693][T32078] bond3 (unregistering): Released all slaves [ 729.451806][T32099] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 730.029949][T32117] xt_recent: Unsupported userspace flags (000000b1) [ 730.178716][T32124] netlink: 'syz.4.8244': attribute type 1 has an invalid length. [ 730.367484][T32127] IPVS: set_ctl: invalid protocol: 50 255.255.255.255:20001 [ 730.609401][T32135] syzkaller0: entered promiscuous mode [ 730.626277][T32135] syzkaller0: entered allmulticast mode [ 732.901564][T32166] vlan2: entered promiscuous mode [ 732.934831][T32165] vlan2: entered promiscuous mode [ 733.050771][T32177] __nla_validate_parse: 11 callbacks suppressed [ 733.050788][T32177] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8257'. [ 733.379037][T32196] openvswitch: netlink: IP tunnel dst address not specified [ 733.392904][T32204] x_tables: duplicate underflow at hook 2 [ 733.716517][T32219] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8273'. [ 733.857002][T32226] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 733.864359][T32226] IPv6: NLM_F_CREATE should be set when creating new route [ 733.869185][T32227] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8272'. [ 734.035953][T32232] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8278'. [ 734.047310][T32234] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.8275'. [ 734.057334][T32232] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8278'. [ 734.384834][T32260] netlink: 'syz.3.8285': attribute type 1 has an invalid length. [ 734.404248][T32260] netlink: 'syz.3.8285': attribute type 3 has an invalid length. [ 734.420178][T32260] netlink: 64 bytes leftover after parsing attributes in process `syz.3.8285'. [ 734.479944][T32264] Bluetooth: MGMT ver 1.23 [ 734.533450][T32269] xt_recent: Unsupported userspace flags (000000b1) [ 734.729695][T32282] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8290'. [ 734.760960][T32283] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8293'. [ 734.781785][T32288] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8292'. [ 734.836843][T32288] veth0_to_team: entered promiscuous mode [ 734.869606][T32288] veth0_to_team: left promiscuous mode [ 734.922767][T32291] veth0_to_team: entered promiscuous mode [ 734.959410][T32291] veth0_to_team: left promiscuous mode [ 735.045166][T32294] bond7 (unregistering): Released all slaves [ 735.126669][T32307] xt_recent: Unsupported userspace flags (000000b1) [ 735.363325][T32319] gretap0: entered promiscuous mode [ 735.387674][T32319] gretap0: left promiscuous mode [ 735.409795][T32319] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 735.949214][T32347] tunl0: Caught tx_queue_len zero misconfig [ 735.987187][T32352] netlink: 'syz.3.8313': attribute type 15 has an invalid length. [ 736.330852][T32377] x_tables: duplicate entry at hook 3 [ 736.348332][T32377] x_tables: duplicate entry at hook 3 [ 736.354214][T32377] x_tables: duplicate entry at hook 3 [ 736.361044][T32377] x_tables: duplicate entry at hook 3 [ 736.367025][T32377] x_tables: duplicate entry at hook 3 [ 736.372733][T32377] x_tables: duplicate entry at hook 3 [ 736.379735][T32377] x_tables: duplicate entry at hook 3 [ 736.385437][T32377] x_tables: duplicate entry at hook 3 [ 736.391642][T32377] x_tables: duplicate entry at hook 3 [ 736.625685][T32392] x_tables: ip_tables: udp match: only valid for protocol 17 [ 736.691246][T32397] xt_recent: Unsupported userspace flags (000000b1) [ 737.172677][T32412] xt_recent: Unsupported userspace flags (000000b1) [ 737.518661][T32435] gretap0: entered promiscuous mode [ 737.540742][T32435] gretap0: left promiscuous mode [ 737.578827][T32435] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 737.836914][T32444] FAULT_INJECTION: forcing a failure. [ 737.836914][T32444] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.874988][T32444] CPU: 0 UID: 0 PID: 32444 Comm: syz.4.8347 Not tainted syzkaller #0 PREEMPT(full) [ 737.875016][T32444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 737.875028][T32444] Call Trace: [ 737.875036][T32444] [ 737.875044][T32444] dump_stack_lvl+0xe8/0x150 [ 737.875072][T32444] should_fail_ex+0x412/0x560 [ 737.875099][T32444] _copy_from_user+0x2d/0xb0 [ 737.875124][T32444] ___sys_sendmsg+0x1c6/0x360 [ 737.875148][T32444] ? __lock_acquire+0x6b5/0x2cf0 [ 737.875175][T32444] ? __pfx____sys_sendmsg+0x10/0x10 [ 737.875229][T32444] ? __fget_files+0x2a/0x420 [ 737.875249][T32444] ? __fget_files+0x3a0/0x420 [ 737.875277][T32444] __x64_sys_sendmsg+0x1bd/0x2a0 [ 737.875302][T32444] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 737.875333][T32444] ? __pfx_ksys_write+0x10/0x10 [ 737.875366][T32444] do_syscall_64+0xe2/0xf80 [ 737.875387][T32444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.875403][T32444] ? trace_irq_disable+0x37/0x100 [ 737.875420][T32444] ? clear_bhb_loop+0x60/0xb0 [ 737.875441][T32444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.875457][T32444] RIP: 0033:0x7f1e6939aeb9 [ 737.875473][T32444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.875488][T32444] RSP: 002b:00007f1e6a32e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 737.875507][T32444] RAX: ffffffffffffffda RBX: 00007f1e69615fa0 RCX: 00007f1e6939aeb9 [ 737.875520][T32444] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000006 [ 737.875530][T32444] RBP: 00007f1e6a32e090 R08: 0000000000000000 R09: 0000000000000000 [ 737.875540][T32444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.875550][T32444] R13: 00007f1e69616038 R14: 00007f1e69615fa0 R15: 00007ffd2284cac8 [ 737.875577][T32444] [ 738.155757][T32454] tipc: Enabling of bearer rejected, failed to enable media [ 738.243677][T32461] __nla_validate_parse: 133 callbacks suppressed [ 738.243697][T32461] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8352'. [ 738.307775][T32461] x_tables: ip_tables: udp match: only valid for protocol 17 [ 738.347920][T32467] netlink: 'syz.4.8354': attribute type 1 has an invalid length. [ 738.453441][T32467] bond3: entered promiscuous mode [ 738.480405][T32467] 8021q: adding VLAN 0 to HW filter on device bond3 [ 738.548654][T32472] 8021q: adding VLAN 0 to HW filter on device bond3 [ 738.556024][T32472] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 738.570130][T32484] netlink: 9 bytes leftover after parsing attributes in process `syz.3.8356'. [ 738.590125][T32472] bond3: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 738.613029][T32472] bond3: (slave wireguard0): making interface the new active one [ 738.623602][T32472] wireguard0: entered promiscuous mode [ 738.631312][T32472] bond3: (slave wireguard0): Enslaving as an active interface with an up link [ 738.650714][T32467] bond3: entered allmulticast mode [ 738.669779][T32467] wireguard0: entered allmulticast mode [ 738.692660][T32484] gretap0: entered promiscuous mode [ 738.733604][T32490] gretap0: left promiscuous mode [ 738.770959][T32490] 8021q: adding VLAN 0 to HW filter on device bond0 [ 738.783020][T32495] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8360'. [ 738.792643][T32490] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 738.910774][T32499] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8361'. [ 738.924035][T32495] vlan2: entered promiscuous mode [ 739.007243][T32500] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8361'. [ 739.222509][T32519] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8367'. [ 739.257061][T32510] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8365'. [ 739.504875][T32540] netlink: 9 bytes leftover after parsing attributes in process `syz.4.8371'. [ 741.238183][T32540] gretap0: entered promiscuous mode [ 741.248862][T32541] gretap0: left promiscuous mode [ 741.282019][T32541] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 741.394798][T32551] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8374'. [ 741.437603][T32551] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8374'. [ 741.682206][T32566] x_tables: ip_tables: udp match: only valid for protocol 17 [ 742.250652][T32553] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 742.762163][T32577] netlink: 'syz.2.8383': attribute type 3 has an invalid length. [ 742.803387][T32582] syz_tun: entered allmulticast mode [ 742.820222][ T3561] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.853612][ T3561] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 742.879278][ T3561] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.904244][ T3561] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 742.984470][T32586] 8021q: adding VLAN 0 to HW filter on device bond4 [ 742.994896][T32584] syz_tun: left allmulticast mode [ 743.002865][ T3561] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 743.047505][ T3561] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 743.085598][ T3561] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 743.119158][ T3561] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 743.355613][T32620] __nla_validate_parse: 180 callbacks suppressed [ 743.355634][T32620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8393'. [ 743.440314][T32624] xt_bpf: check failed: parse error [ 743.682149][T32635] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8400'. [ 743.715468][T32635] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8400'. [ 743.795858][T32640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8402'. [ 743.807296][T32640] tipc: Enabling of bearer rejected, failed to enable media [ 744.063964][T32648] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8403'. [ 744.081284][T32648] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8403'. [ 744.096724][T32648] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8403'. [ 744.108969][T32653] netlink: 'syz.3.8407': attribute type 1 has an invalid length. [ 744.116977][T32648] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8403'. [ 744.454553][T32679] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8415'. [ 745.412582][T32726] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8432'. [ 746.473218][ T321] gretap0: entered promiscuous mode [ 746.500179][ T324] gretap0: left promiscuous mode [ 746.568981][ T324] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 746.722548][ T333] netlink: 'syz.3.8455': attribute type 2 has an invalid length. [ 746.969071][ T352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 747.215881][ T364] xt_bpf: check failed: parse error [ 747.385640][ T370] netlink: 'syz.3.8467': attribute type 3 has an invalid length. [ 747.400931][ T370] syz_tun: entered allmulticast mode [ 747.409218][ T370] siw: device registration error -23 [ 747.419638][ T369] syz_tun: left allmulticast mode [ 747.477927][ T374] xt_recent: Unsupported userspace flags (000000b1) [ 747.593785][ T381] xt_recent: Unsupported userspace flags (000000b1) [ 747.653270][ T385] syzkaller1: entered promiscuous mode [ 747.666290][ T385] syzkaller1: entered allmulticast mode [ 747.782558][ T394] x_tables: ip_tables: udp match: only valid for protocol 17 [ 748.010840][ T404] netlink: 'syz.1.8480': attribute type 3 has an invalid length. [ 748.037917][ T404] syz_tun: entered allmulticast mode [ 748.056419][ T404] siw: device registration error -23 [ 748.081204][ T403] syz_tun: left allmulticast mode [ 748.522350][ T436] __nla_validate_parse: 16 callbacks suppressed [ 748.522371][ T436] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8492'. [ 748.609113][ T438] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 749.153839][ T450] netlink: 6 bytes leftover after parsing attributes in process `syz.0.8495'. [ 749.235491][ T455] delete_channel: no stack [ 749.290208][ T456] netlink: 'syz.4.8498': attribute type 4 has an invalid length. [ 749.461279][ T469] xt_recent: Unsupported userspace flags (000000b1) [ 749.569964][ T476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8506'. [ 749.605460][ T478] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8507'. [ 749.896892][ T497] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8510'. [ 750.118464][ T504] netlink: 'syz.2.8513': attribute type 4 has an invalid length. [ 750.158559][ T508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8515'. [ 750.312082][ T520] netlink: 9 bytes leftover after parsing attributes in process `syz.3.8522'. [ 750.318397][ T522] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8520'. [ 750.339407][ T520] gretap0: entered promiscuous mode [ 750.361032][ T520] gretap0: left promiscuous mode [ 750.409389][ T520] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 750.431251][ T529] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8525'. [ 750.470070][ T529] netlink: 252 bytes leftover after parsing attributes in process `syz.1.8525'. [ 750.488739][ T534] gretap0: entered promiscuous mode [ 750.514942][ T531] gretap0: left promiscuous mode [ 750.580150][ T531] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 750.874065][ T554] netlink: 'syz.0.8530': attribute type 4 has an invalid length. [ 751.031317][ T564] bridge0: entered promiscuous mode [ 751.433068][ T574] 8021q: adding VLAN 0 to HW filter on device bond5 [ 751.546534][ T588] macsec1: entered promiscuous mode [ 751.577246][ T591] netlink: 'syz.0.8542': attribute type 4 has an invalid length. [ 751.651372][ T595] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 751.846386][ T610] x_tables: ip_tables: udp match: only valid for protocol 17 [ 751.874204][ T603] vlan2: entered promiscuous mode [ 752.170969][ T626] netlink: 'syz.0.8555': attribute type 4 has an invalid length. [ 752.244777][ T629] tipc: Enabled bearer , priority 0 [ 752.252727][ T629] syzkaller0: entered promiscuous mode [ 752.258396][ T629] syzkaller0: entered allmulticast mode [ 752.276911][ T629] tipc: Resetting bearer [ 752.311697][ T628] tipc: Resetting bearer [ 752.361214][ T628] tipc: Disabling bearer [ 752.403748][ T1141] bridge_slave_1: left allmulticast mode [ 752.422569][ T1141] bridge_slave_1: left promiscuous mode [ 752.442071][ T1141] bridge0: port 2(bridge_slave_1) entered disabled state [ 752.467496][ T646] x_tables: ip_tables: udp match: only valid for protocol 17 [ 752.490933][ T644] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 752.509003][ T1141] bridge_slave_0: left allmulticast mode [ 752.527223][ T1141] bridge_slave_0: left promiscuous mode [ 752.534348][ T1141] bridge0: port 1(bridge_slave_0) entered disabled state [ 753.098937][ T1141] bond1 (unregistering): (slave gretap2): Releasing active interface [ 753.180009][ T679] netlink: 'syz.4.8569': attribute type 4 has an invalid length. [ 753.287344][ T683] netlink: 'syz.3.8570': attribute type 30 has an invalid length. [ 753.515358][ T1141] bond0 (unregistering): Released all slaves [ 753.528046][ T1141] bond1 (unregistering): Released all slaves [ 753.664995][ T1141] bond2 (unregistering): Released all slaves [ 753.784325][ T1141] bond3 (unregistering): Released all slaves [ 753.906923][ T1141] bond4 (unregistering): Released all slaves [ 754.036224][ T1141] bond5 (unregistering): (slave veth7): Releasing active interface [ 754.044986][ T1141] bond5 (unregistering): Released all slaves [ 754.162053][ T1141] bond6 (unregistering): Released all slaves [ 754.180509][ T681] __nla_validate_parse: 12 callbacks suppressed [ 754.180527][ T681] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8570'. [ 754.315799][ T689] netlink: 'syz.2.8572': attribute type 3 has an invalid length. [ 754.328563][ T683] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8570'. [ 754.339068][ T683] netlink: 'syz.3.8570': attribute type 30 has an invalid length. [ 754.348259][ T1141] mÿ5nè‹Ò: left promiscuous mode [ 754.364246][ T690] netlink: 'syz.4.8573': attribute type 3 has an invalid length. [ 754.380995][ T690] syz_tun: entered allmulticast mode [ 754.400724][ T692] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8574'. [ 754.432451][ T1141] tipc: Left network mode [ 754.467284][ T689] syz_tun: entered allmulticast mode [ 754.472174][ T690] siw: device registration error -23 [ 754.500187][ T690] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8573'. [ 754.521721][ T689] macsec0: left allmulticast mode [ 754.526845][ T689] veth1_macvtap: left allmulticast mode [ 754.542321][ T689] siw: device registration error -23 [ 754.556810][ T689] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8572'. [ 754.585755][ T688] syz_tun: left allmulticast mode [ 754.606765][ T687] syz_tun: left allmulticast mode [ 754.703039][ T703] xt_bpf: check failed: parse error [ 754.810004][ T707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 755.012392][ T717] netlink: 'syz.3.8583': attribute type 4 has an invalid length. [ 755.283237][ T726] : entered promiscuous mode [ 755.471026][ T1141] hsr_slave_0: left promiscuous mode [ 755.492240][ T1141] hsr_slave_1: left promiscuous mode [ 755.500508][ T1141] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 755.529962][ T1141] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 755.538141][ T1141] batman_adv: batadv0: Removing interface: dummy0 [ 755.587654][ T1141] pim6reg99999999 (unregistering): left allmulticast mode [ 755.851429][ T754] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8591'. [ 756.707276][ T1141] team_slave_1 (unregistering): left promiscuous mode [ 756.716771][ T1141] team_slave_1 (unregistering): left allmulticast mode [ 756.725396][ T1141] team0 (unregistering): Port device team_slave_1 removed [ 756.770901][ T1141] team_slave_0 (unregistering): left promiscuous mode [ 756.777926][ T1141] team_slave_0 (unregistering): left allmulticast mode [ 756.785551][ T1141] team0 (unregistering): Port device team_slave_0 removed [ 757.176636][ T734] netlink: 'syz.2.8589': attribute type 3 has an invalid length. [ 757.188046][ T748] syz_tun: entered allmulticast mode [ 757.253120][ T755] syz_tun: left allmulticast mode [ 757.360587][ T772] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8595'. [ 757.361840][ T768] bond6 (unregistering): Released all slaves [ 757.384686][ T775] netlink: 'syz.4.8594': attribute type 39 has an invalid length. [ 757.420661][ T776] netlink: 'syz.0.8596': attribute type 4 has an invalid length. [ 757.474818][ T779] veth4: entered allmulticast mode [ 757.496388][ T772] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 757.659119][ T782] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8599'. [ 757.699576][ T786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 757.772823][ T1141] IPVS: stop unused estimator thread 0... [ 757.809829][ T788] xt_bpf: check failed: parse error [ 757.963833][ T805] syzkaller1: entered allmulticast mode [ 757.995952][ T801] syzkaller0: entered promiscuous mode [ 758.002187][ T801] syzkaller0: entered allmulticast mode [ 758.131205][ T812] netlink: 'syz.2.8609': attribute type 4 has an invalid length. [ 758.307073][ T825] xt_bpf: check failed: parse error [ 758.371442][ T831] netlink: 92 bytes leftover after parsing attributes in process `syz.2.8615'. [ 758.589949][ T832] netlink: 76 bytes leftover after parsing attributes in process `syz.0.8617'. [ 758.666154][ T837] xt_recent: Unsupported userspace flags (000000b1) [ 759.171192][ T848] netlink: 'syz.1.8622': attribute type 4 has an invalid length. [ 759.244690][ T852] netlink: 'syz.1.8624': attribute type 1 has an invalid length. [ 759.299529][ T859] netlink: 'syz.4.8625': attribute type 3 has an invalid length. [ 759.369200][ T863] __nla_validate_parse: 3 callbacks suppressed [ 759.369218][ T863] netlink: 124 bytes leftover after parsing attributes in process `syz.3.8627'. [ 759.464889][ T865] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 759.486984][ T870] xt_recent: Unsupported userspace flags (000000b1) [ 759.498509][ T871] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 759.567266][ T874] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8632'. [ 759.586616][ T874] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8632'. [ 759.685607][ T878] netlink: 'syz.0.8634': attribute type 4 has an invalid length. [ 759.892712][ T893] netlink: 'syz.2.8639': attribute type 3 has an invalid length. [ 759.912988][ T893] syz_tun: entered allmulticast mode [ 759.932694][ T892] syz_tun: left allmulticast mode [ 760.110575][ T904] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8640'. [ 760.153806][ T911] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8644'. [ 760.213578][ T912] netlink: 'syz.3.8643': attribute type 23 has an invalid length. [ 760.480651][ T932] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8647'. [ 760.507925][ T932] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8647'. [ 760.572103][ T936] netlink: 'syz.1.8648': attribute type 4 has an invalid length. [ 760.677143][ T944] netlink: 'syz.3.8651': attribute type 2 has an invalid length. [ 760.735783][ T947] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 760.835576][ T958] sctp: [Deprecated]: syz.1.8652 (pid 958) Use of struct sctp_assoc_value in delayed_ack socket option. [ 760.835576][ T958] Use struct sctp_sack_info instead [ 760.865205][ T958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8652'. [ 761.048141][ T968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8656'. [ 761.358517][ T978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8658'. [ 761.760158][ T990] netlink: 'syz.3.8663': attribute type 3 has an invalid length. [ 761.809176][ T990] syz_tun: entered allmulticast mode [ 761.818957][ T990] siw: device registration error -23 [ 761.831678][ T988] syz_tun: left allmulticast mode [ 762.164437][ T1017] block nbd1: Unsupported socket: should be TCP or UNIX. [ 762.370497][ T1037] netlink: 'syz.3.8680': attribute type 3 has an invalid length. [ 762.417909][ T1037] syz_tun: entered allmulticast mode [ 762.426205][ T1033] syz_tun: left allmulticast mode [ 762.944528][ T1060] IPVS: lc: FWM 3 0x00000003 - no destination available [ 763.740010][ T1062] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 763.766806][ T1062] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 763.830577][ T1062] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 763.840965][ T1062] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 763.856675][ T1062] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 763.877186][ T1062] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 764.073482][ T1062] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 764.094807][ T1062] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 764.395558][ T1124] xt_bpf: check failed: parse error [ 764.574664][ T1062] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 764.610314][ T1130] __nla_validate_parse: 8 callbacks suppressed [ 764.610328][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.625728][ T1062] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 764.650586][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.675645][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.694887][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.711591][ T1137] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8706'. [ 764.727830][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.738163][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.749412][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.768300][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.789096][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8704'. [ 764.870653][ T1149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 764.873034][ T1138] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.948413][ T1149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 764.963686][ T1149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 764.977298][ T1149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 764.989700][ T1138] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.094595][ T1138] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.209647][ T1138] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.284698][ T1164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 765.327211][T24893] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.352945][T24893] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.375430][T24893] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.390658][T24893] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.853655][ T1196] Cannot find del_set index 3 as target [ 766.242204][ T1212] syzkaller0: entered promiscuous mode [ 766.249610][ T1212] syzkaller0: entered allmulticast mode [ 766.527816][ T1237] netlink: 'syz.2.8737': attribute type 21 has an invalid length. [ 766.584409][ T1241] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 766.746759][ T1230] 8021q: adding VLAN 0 to HW filter on device bond1 [ 766.830659][ T5913] IPVS: starting estimator thread 0... [ 766.856645][ T1242] 8021q: adding VLAN 0 to HW filter on device bond1 [ 766.874643][ T1242] bond1: (slave vxcan1): The slave device specified does not support setting the MAC address [ 766.886339][ T1242] bond1: (slave vxcan1): Error -95 calling set_mac_address [ 766.917558][ T1265] IPVS: using max 34 ests per chain, 81600 per kthread [ 767.050481][ T1273] syzkaller1: entered promiscuous mode [ 767.056412][ T1273] syzkaller1: entered allmulticast mode [ 767.341366][ T1289] xt_recent: Unsupported userspace flags (000000b1) [ 767.567301][ T1306] xt_bpf: check failed: parse error [ 767.950062][ T5496] 8021q: adding VLAN 0 to HW filter on device bond1 [ 768.143288][ T1335] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 768.229873][ T1340] xt_recent: Unsupported userspace flags (000000b1) [ 768.390843][ T1351] tap0: tun_chr_ioctl cmd 2148553947 [ 768.418571][ T1351] tap0: tun_chr_ioctl cmd 2147767521 [ 768.480648][ T1360] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 768.508369][ T1360] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 768.527782][ T1359] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 768.576734][ T1366] xt_bpf: check failed: parse error [ 769.089042][T23803] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 769.106728][T23803] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 769.115413][T23803] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 769.123478][T23803] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 769.131840][T23803] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 769.274052][ T1396] netlink: 'syz.4.8773': attribute type 1 has an invalid length. [ 769.299943][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 769.307343][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 769.315166][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 769.325437][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 769.334885][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 769.439922][ T1397] bond6 (unregistering): Released all slaves [ 769.582402][ T1413] netlink: 'syz.0.8777': attribute type 32 has an invalid length. [ 769.781888][ T1428] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 769.881295][T23754] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.023335][T23754] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.181782][T23754] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.339018][T23754] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.376186][ T1452] nbd: must specify at least one socket [ 770.416472][ T1449] __nla_validate_parse: 69 callbacks suppressed [ 770.416493][ T1449] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8782'. [ 770.613865][ T1458] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8783'. [ 770.681638][T24894] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.732583][T24894] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.815943][ T1141] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.847619][ T1389] chnl_net:caif_netlink_parms(): no params data found [ 770.897966][ T1476] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8789'. [ 770.938750][ T1141] netdevsim netdevsim3 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 771.020549][ T1485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 771.100966][ T1491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 771.208372][T23754] bond2 (unregistering): (slave ip6gretap2): Releasing active interface [ 771.417758][ T5841] Bluetooth: hci0: command tx timeout [ 771.651236][T23754] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 771.661155][T23754] bond_slave_0: left promiscuous mode [ 771.666695][T23754] bond_slave_0: left allmulticast mode [ 771.673606][T23754] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 771.683445][T23754] bond_slave_1: left promiscuous mode [ 771.689398][T23754] bond_slave_1: left allmulticast mode [ 771.695202][T23754] bond0 (unregistering): Released all slaves [ 771.847196][T23754] bond1 (unregistering): Released all slaves [ 771.859710][T23754] bond2 (unregistering): Released all slaves [ 771.862753][ T1507] netlink: 'syz.2.8796': attribute type 4 has an invalid length. [ 771.875240][T23754] bond3 (unregistering): Released all slaves [ 771.887877][T23754] bond4 (unregistering): Released all slaves [ 771.904044][T23754] bond5 (unregistering): Released all slaves [ 772.073920][T23754] æÿîÿ: left promiscuous mode [ 772.187202][T23754] !: left promiscuous mode [ 772.219321][ T1524] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8800'. [ 772.264344][ T1389] bridge0: port 1(bridge_slave_0) entered blocking state [ 772.278661][ T1389] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.289134][ T1389] bridge_slave_0: entered allmulticast mode [ 772.296957][ T1389] bridge_slave_0: entered promiscuous mode [ 772.306415][T23754] : left promiscuous mode [ 772.330022][ T1389] bridge0: port 2(bridge_slave_1) entered blocking state [ 772.338783][ T1389] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.346493][ T1389] bridge_slave_1: entered allmulticast mode [ 772.358964][ T1389] bridge_slave_1: entered promiscuous mode [ 772.384110][ T1531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 772.398272][T23754] tipc: Left network mode [ 772.515779][ T1389] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 772.548816][ T1536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8806'. [ 772.558595][ T1536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8806'. [ 772.582938][ T1389] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 772.784760][ T1389] team0: Port device team_slave_0 added [ 772.865028][ T1389] team0: Port device team_slave_1 added [ 772.993672][ T1561] netlink: 9 bytes leftover after parsing attributes in process `syz.0.8809'. [ 773.030368][ T1561] gretap0: entered promiscuous mode [ 773.041561][ T1566] netlink: 'syz.2.8811': attribute type 4 has an invalid length. [ 773.104168][ T1389] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 773.127564][ T1389] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 773.197944][ T1389] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 773.251009][ T1567] gretap0: left promiscuous mode [ 773.287754][ T1567] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 773.332698][ T1389] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 773.350776][ T1389] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 773.411312][ T1389] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 773.498123][ T5841] Bluetooth: hci0: command tx timeout [ 773.729664][ T1389] hsr_slave_0: entered promiscuous mode [ 773.742894][ T1598] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8819'. [ 773.744284][ T1389] hsr_slave_1: entered promiscuous mode [ 773.760492][ T1389] debugfs: 'hsr0' already exists in 'hsr' [ 773.766924][ T1389] Cannot create hsr debugfs directory [ 773.921716][ T1611] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8822'. [ 774.032439][ T1612] netlink: 348 bytes leftover after parsing attributes in process `syz.2.8821'. [ 774.130648][ T1621] netlink: 'syz.4.8824': attribute type 4 has an invalid length. [ 774.726080][ T1389] netdevsim netdevsim3 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.922834][ T1389] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.063698][ T1389] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.247986][ T1389] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.577931][ T5841] Bluetooth: hci0: command tx timeout [ 775.645863][ T1672] __nla_validate_parse: 3 callbacks suppressed [ 775.645885][ T1672] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8833'. [ 775.666986][ T1672] x_tables: ip_tables: udp match: only valid for protocol 17 [ 775.734460][ T1669] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8834'. [ 776.155813][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 776.157779][ T1685] netlink: 'syz.0.8836': attribute type 4 has an invalid length. [ 776.237586][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 776.242962][ T1389] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 776.343396][ T1389] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 776.376145][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 776.413192][ T1389] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 776.530091][ T1389] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 777.026103][ T1732] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8844'. [ 777.194591][ T1675] infiniband syz1: set active [ 777.241364][ T1675] infiniband syz1: added xfrm0 [ 777.269989][T25603] xfrm0 speed is unknown, defaulting to 1000 [ 777.307952][ T1675] RDS/IB: syz1: added [ 777.316593][ T1675] smc: adding ib device syz1 with port count 1 [ 777.367741][ T1675] smc: ib device syz1 port 1 has no pnetid [ 777.421963][T25603] xfrm0 speed is unknown, defaulting to 1000 [ 777.438091][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 777.511910][ T1389] 8021q: adding VLAN 0 to HW filter on device bond0 [ 777.600486][ T1389] 8021q: adding VLAN 0 to HW filter on device team0 [ 777.633737][T23755] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.640943][T23755] bridge0: port 1(bridge_slave_0) entered forwarding state [ 777.657795][ T5841] Bluetooth: hci0: command tx timeout [ 777.691439][ T1761] netlink: 'syz.1.8849': attribute type 2 has an invalid length. [ 777.727162][ T1763] netlink: 'syz.4.8850': attribute type 1 has an invalid length. [ 777.739543][ T3461] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.746701][ T3461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 777.759836][ T1765] netlink: 'syz.0.8848': attribute type 4 has an invalid length. [ 777.767423][ T1763] netlink: 96 bytes leftover after parsing attributes in process `syz.4.8850'. [ 777.776646][ T1763] netlink: 658 bytes leftover after parsing attributes in process `syz.4.8850'. [ 777.799242][ T1763] netlink: 1 bytes leftover after parsing attributes in process `syz.4.8850'. [ 778.129267][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 778.237061][ T1389] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 778.269195][ T1784] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8855'. [ 778.326184][ T1389] veth0_vlan: entered promiscuous mode [ 778.351588][ T1786] netlink: 44 bytes leftover after parsing attributes in process `syz.4.8856'. [ 778.353128][ T1389] veth1_vlan: entered promiscuous mode [ 778.367189][ T1786] openvswitch: netlink: Flow key attr not present in new flow. [ 778.392976][ T1786] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8856'. [ 778.419526][ T1389] veth0_macvtap: entered promiscuous mode [ 778.440166][ T1389] veth1_macvtap: entered promiscuous mode [ 778.493214][ T1389] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 778.509685][ T1389] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 778.530694][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 778.551141][ T3461] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.568099][ T3461] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.588006][ T3461] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.602633][ T3461] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.752899][ T1799] netlink: 'syz.4.8858': attribute type 39 has an invalid length. [ 778.774269][ T1796] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8858'. [ 778.814563][ T1796] netlink: 'syz.4.8858': attribute type 5 has an invalid length. [ 778.858891][T24900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.879644][T24900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 778.958457][ T1041] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 778.969562][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 778.980748][ T1041] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 779.222900][ T1812] netlink: 'syz.3.8861': attribute type 4 has an invalid length. [ 779.303517][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 779.546150][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 779.576144][ T1829] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20004 [ 779.787187][ T1836] xt_bpf: check failed: parse error [ 779.976986][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 780.316425][ T1850] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 780.329094][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 780.535866][ T1852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 780.546557][ T1675] xfrm0 speed is unknown, defaulting to 1000 [ 780.658520][ T1774] siw: device registration error -23 [ 780.756032][ T1855] netlink: 'syz.2.8872': attribute type 4 has an invalid length. [ 780.908109][T24903] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 780.924301][T24903] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 780.936711][ T9968] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 780.968488][T23754] hsr_slave_0: left promiscuous mode [ 781.034590][T23754] hsr_slave_1: left promiscuous mode [ 781.048183][T23754] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 781.061550][T23754] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 781.181749][T23754] pim6reg (unregistering): left allmulticast mode [ 781.357608][ T9968] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 781.473958][ T1881] netlink: 'syz.4.8880': attribute type 16 has an invalid length. [ 781.483064][ T1881] __nla_validate_parse: 4 callbacks suppressed [ 781.483083][ T1881] netlink: 64138 bytes leftover after parsing attributes in process `syz.4.8880'. [ 781.512096][ T1897] netlink: 'syz.0.8884': attribute type 4 has an invalid length. [ 781.670904][ T9968] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 781.690293][ T1905] xt_hashlimit: size too large, truncated to 1048576 [ 781.707282][ T1905] xt_hashlimit: max too large, truncated to 1048576 [ 782.319581][ T1896] netlink: 'syz.2.8885': attribute type 3 has an invalid length. [ 782.328774][ T1881] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8880'. [ 782.364954][ T1906] syz_tun: entered allmulticast mode [ 782.378544][ T1906] syz_tun: left allmulticast mode [ 782.410727][ T1885] xfrm0 speed is unknown, defaulting to 1000 [ 782.755823][ T1928] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8891'. [ 782.920749][ T1933] netlink: 9 bytes leftover after parsing attributes in process `syz.1.8892'. [ 782.933526][T23754] IPVS: stop unused estimator thread 0... [ 782.969711][ T1933] gretap0: entered promiscuous mode [ 783.018666][ T1884] xfrm0 speed is unknown, defaulting to 1000 [ 783.078812][ T1933] gretap0: left promiscuous mode [ 783.112122][ T1933] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 783.265150][ T1947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8897'. [ 783.634214][ T1952] netlink: 'syz.1.8899': attribute type 3 has an invalid length. [ 783.652409][ T1968] syz_tun: entered allmulticast mode [ 783.756232][ T1969] syzkaller0: entered promiscuous mode [ 783.782121][ T1969] syzkaller0: entered allmulticast mode [ 783.930061][ T1949] syz_tun: left allmulticast mode [ 784.061422][ T1976] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8902'. [ 784.169106][ T1985] syz.2.8902: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 784.236677][ T1985] CPU: 1 UID: 0 PID: 1985 Comm: syz.2.8902 Not tainted syzkaller #0 PREEMPT(full) [ 784.236704][ T1985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 784.236717][ T1985] Call Trace: [ 784.236725][ T1985] [ 784.236734][ T1985] dump_stack_lvl+0xe8/0x150 [ 784.236765][ T1985] warn_alloc+0x249/0x340 [ 784.236787][ T1985] ? stack_trace_save+0xa9/0x100 [ 784.236814][ T1985] ? __pfx_warn_alloc+0x10/0x10 [ 784.236841][ T1985] ? kasan_save_track+0x4f/0x80 [ 784.236857][ T1985] ? kasan_save_track+0x3e/0x80 [ 784.236873][ T1985] ? __kasan_kmalloc+0x93/0xb0 [ 784.236890][ T1985] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 784.236908][ T1985] ? xskq_create+0x56/0x170 [ 784.236928][ T1985] ? xsk_setsockopt+0x54c/0x990 [ 784.236943][ T1985] ? do_sock_setsockopt+0x17c/0x1b0 [ 784.236967][ T1985] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 784.236990][ T1985] ? do_syscall_64+0xe2/0xf80 [ 784.237015][ T1985] __vmalloc_node_range_noprof+0x132/0x1730 [ 784.237066][ T1985] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 784.237092][ T1985] ? __kasan_kmalloc+0x93/0xb0 [ 784.237116][ T1985] vmalloc_user_noprof+0xad/0xe0 [ 784.237135][ T1985] ? xskq_create+0xbf/0x170 [ 784.237156][ T1985] xskq_create+0xbf/0x170 [ 784.237179][ T1985] xsk_init_queue+0xad/0x110 [ 784.237201][ T1985] xsk_setsockopt+0x54c/0x990 [ 784.237222][ T1985] ? __pfx_xsk_setsockopt+0x10/0x10 [ 784.237240][ T1985] ? __pfx_aa_sk_perm+0x10/0x10 [ 784.237266][ T1985] ? aa_sock_opt_perm+0xff/0x1a0 [ 784.237291][ T1985] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 784.237311][ T1985] ? __pfx_xsk_setsockopt+0x10/0x10 [ 784.237331][ T1985] do_sock_setsockopt+0x17c/0x1b0 [ 784.237362][ T1985] __x64_sys_setsockopt+0x13d/0x1b0 [ 784.237390][ T1985] do_syscall_64+0xe2/0xf80 [ 784.237412][ T1985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.237431][ T1985] ? trace_irq_disable+0x37/0x100 [ 784.237450][ T1985] ? clear_bhb_loop+0x60/0xb0 [ 784.237473][ T1985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.237492][ T1985] RIP: 0033:0x7f32bbd9aeb9 [ 784.237511][ T1985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 784.237525][ T1985] RSP: 002b:00007f32bcbdc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 784.237550][ T1985] RAX: ffffffffffffffda RBX: 00007f32bc016090 RCX: 00007f32bbd9aeb9 [ 784.237565][ T1985] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000d [ 784.237575][ T1985] RBP: 00007f32bbe08c1f R08: 0000000000000004 R09: 0000000000000000 [ 784.237587][ T1985] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 784.237599][ T1985] R13: 00007f32bc016128 R14: 00007f32bc016090 R15: 00007ffe21e93e28 [ 784.237630][ T1985] [ 784.528191][ T1985] Mem-Info: [ 784.531462][ T1985] active_anon:8125 inactive_anon:0 isolated_anon:0 [ 784.531462][ T1985] active_file:4263 inactive_file:40258 isolated_file:0 [ 784.531462][ T1985] unevictable:768 dirty:318 writeback:0 [ 784.531462][ T1985] slab_reclaimable:14369 slab_unreclaimable:161385 [ 784.531462][ T1985] mapped:32683 shmem:1362 pagetables:1590 [ 784.531462][ T1985] sec_pagetables:0 bounce:0 [ 784.531462][ T1985] kernel_misc_reclaimable:0 [ 784.531462][ T1985] free:1241514 free_pcp:21950 free_cma:0 [ 784.578070][ T1985] Node 0 active_anon:32500kB inactive_anon:0kB active_file:17052kB inactive_file:160832kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:24152kB dirty:1272kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14608kB pagetables:6212kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 784.610583][ T1985] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:106580kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 784.677846][ T1985] Node 0 DMA free:11216kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:48kB local_pcp:40kB free_cma:0kB [ 784.710058][ T1985] lowmem_reserve[]: 0 2494 2495 2495 2495 [ 784.716095][ T1985] Node 0 DMA32 free:1462588kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:32600kB inactive_anon:0kB active_file:17052kB inactive_file:160832kB unevictable:1536kB writepending:1272kB zspages:0kB present:3129332kB managed:2554052kB mlocked:0kB bounce:0kB free_pcp:29808kB local_pcp:18824kB free_cma:0kB [ 784.751245][ T1985] lowmem_reserve[]: 0 0 1 1 1 [ 784.756082][ T1985] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 784.790345][ T1985] lowmem_reserve[]: 0 0 0 0 0 [ 784.795118][ T1985] Node 1 Normal free:3491916kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:56680kB local_pcp:27136kB free_cma:0kB [ 784.797762][ T1967] xfrm0 speed is unknown, defaulting to 1000 [ 784.857547][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 784.860044][ T1985] lowmem_reserve[]: 0 0 0 0 0 [ 784.877547][ T1985] Node 0 DMA: 0*4kB 2*8kB (U) 2*16kB (U) 1*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11216kB [ 784.939637][ T1985] Node 0 DMA32: 6023*4kB (UM) 6331*8kB (UM) 4024*16kB (UME) 679*32kB (UME) 849*64kB (UME) 598*128kB (UM) 640*256kB (UME) 481*512kB (UM) 370*1024kB (U) 186*2048kB (UM) 0*4096kB = 1461652kB [ 784.976663][ T1985] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 785.020719][ T1985] Node 1 Normal: 209*4kB (UE) 73*8kB (UME) 60*16kB (UME) 124*32kB (UME) 54*64kB (UME) 22*128kB (UM) 19*256kB (UME) 18*512kB (UME) 14*1024kB (UM) 15*2048kB (UE) 835*4096kB (UM) = 3491916kB [ 785.077796][ T1985] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 785.091118][ T1985] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 785.101040][ T1985] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 785.115601][ T1985] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 785.132190][ T1985] 45879 total pagecache pages [ 785.141080][ T1985] 0 pages in swap cache [ 785.146506][ T1985] Free swap = 124996kB [ 785.153101][ T1985] Total swap = 124996kB [ 785.160090][ T1985] 2097051 pages RAM [ 785.166235][ T1985] 0 pages HighMem/MovableOnly [ 785.173655][ T1985] 426640 pages reserved [ 785.180398][ T1985] 0 pages cma reserved [ 785.283835][ T2008] syz1: rxe_newlink: already configured on xfrm0 [ 787.123004][ T1994] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8905'. [ 787.351767][ T2021] netlink: 100 bytes leftover after parsing attributes in process `syz.0.8909'. [ 787.561437][ T2031] netlink: 'syz.2.8913': attribute type 3 has an invalid length. [ 787.606183][ T2031] syz_tun: entered allmulticast mode [ 787.648712][ T2030] syz_tun: left allmulticast mode [ 787.924285][ T2043] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8917'. [ 788.119777][ T2054] netlink: 100 bytes leftover after parsing attributes in process `syz.2.8922'. [ 788.213276][ T2062] netlink: 'syz.2.8925': attribute type 3 has an invalid length. [ 788.233998][ T2062] syz_tun: entered allmulticast mode [ 788.245172][ T2060] syz_tun: left allmulticast mode [ 788.551236][ T2074] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8927'. [ 789.327664][ T2109] xt_bpf: check failed: parse error [ 789.464397][ T2111] netlink: 'syz.2.8936': attribute type 3 has an invalid length. [ 789.501840][ T2111] syz_tun: entered allmulticast mode [ 789.596599][ T2110] syz_tun: left allmulticast mode [ 789.598444][ T2120] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8939'. [ 789.876749][ T2139] xt_bpf: check failed: parse error [ 790.126391][ T2157] netlink: 120 bytes leftover after parsing attributes in process `syz.2.8954'. [ 790.180071][ T2157] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8954'. [ 790.295872][ T2164] netlink: 'syz.4.8955': attribute type 3 has an invalid length. [ 790.412041][ T2172] lo: Caught tx_queue_len zero misconfig [ 790.441352][ T2170] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 790.601353][ T2174] xt_CT: No such helper "snmp" [ 790.899725][ T2196] netlink: 'syz.1.8967': attribute type 3 has an invalid length. [ 790.922206][ T2196] syz_tun: entered allmulticast mode [ 790.929330][ T2194] syz_tun: left allmulticast mode [ 791.020233][ T2201] netlink: 9 bytes leftover after parsing attributes in process `syz.3.8970'. [ 791.070927][ T2201] gretap0: entered promiscuous mode [ 791.080598][ T2206] smc: net device wlan0 applied user defined pnetid SYZ0 [ 791.091967][ T2209] gretap0: left promiscuous mode [ 791.103031][ T2206] smc: ib device syz1 ibport 1 applied user defined pnetid SYZ0 [ 791.145528][ T2209] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 791.205581][ T2214] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 791.394802][ T2221] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8976'. [ 791.636878][ T2236] sctp: [Deprecated]: syz.4.8983 (pid 2236) Use of int in maxseg socket option. [ 791.636878][ T2236] Use struct sctp_assoc_value instead [ 791.765692][ T2247] gretap0: entered promiscuous mode [ 791.822140][ T2247] gretap0: left promiscuous mode [ 791.848347][ T2247] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 792.020181][ T2262] netlink: 'syz.1.8992': attribute type 11 has an invalid length. [ 792.285502][ T2275] __nla_validate_parse: 2 callbacks suppressed [ 792.285520][ T2275] netlink: 60 bytes leftover after parsing attributes in process `syz.3.8996'. [ 792.362538][ T2276] xfrm0 speed is unknown, defaulting to 1000 [ 792.496522][ T2281] tipc: Enabling of bearer rejected, failed to enable media [ 792.692730][ T2291] tipc: Enabling of bearer rejected, failed to enable media [ 792.707612][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 792.721909][ T2292] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9001'. [ 792.759093][ T2292] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9001'. [ 792.954327][ T2301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9004'. [ 792.990489][ T2301] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9004'. [ 793.020116][T23803] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 793.031366][T23803] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 793.040217][T23803] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 793.051114][T23803] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 793.059299][T23803] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 793.467007][ T2307] xfrm0 speed is unknown, defaulting to 1000 [ 793.491586][ T2325] netlink: 'syz.4.9009': attribute type 5 has an invalid length. [ 793.513573][ T2325] ip6erspan0: entered promiscuous mode [ 793.915719][ T2352] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9015'. [ 793.929993][ T2351] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9016'. [ 793.962319][ T2351] vlan2: entered allmulticast mode [ 793.968772][ T2344] siw: device registration error -23 [ 793.987644][ T2351] erspan0: entered allmulticast mode [ 794.361065][ T2358] xfrm0 speed is unknown, defaulting to 1000 [ 794.414932][ T2373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9021'. [ 794.581413][ T2373] bond3: option arp_all_targets: invalid value (129) [ 794.605520][ T2373] bond3 (unregistering): Released all slaves [ 794.831800][ T2371] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 794.865664][ T2371] bond1 (unregistering): Released all slaves [ 794.901206][ T2390] 8021q: adding VLAN 0 to HW filter on device bond2 [ 794.938065][ T2307] chnl_net:caif_netlink_parms(): no params data found [ 795.098914][T23803] Bluetooth: hci4: command tx timeout [ 795.117243][T24898] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.282558][ T2420] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9024'. [ 795.367064][T24898] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.486102][T24898] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.736643][ T2437] syz_tun: entered allmulticast mode [ 795.778329][ T2307] bridge0: port 1(bridge_slave_0) entered blocking state [ 795.787231][ T2307] bridge0: port 1(bridge_slave_0) entered disabled state [ 795.796448][ T2307] bridge_slave_0: entered allmulticast mode [ 795.806641][ T2307] bridge_slave_0: entered promiscuous mode [ 795.817206][ T2432] siw: device registration error -23 [ 795.822625][T24898] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 795.833970][ T2432] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9027'. [ 795.861074][ T2428] syz_tun: left allmulticast mode [ 795.867277][ T2307] bridge0: port 2(bridge_slave_1) entered blocking state [ 795.883276][ T2307] bridge0: port 2(bridge_slave_1) entered disabled state [ 795.894862][ T2307] bridge_slave_1: entered allmulticast mode [ 795.904148][ T2307] bridge_slave_1: entered promiscuous mode [ 796.015611][ T2307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 796.032370][ T2460] gretap0: entered promiscuous mode [ 796.069701][ T2307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 796.102543][ T2455] gretap0: left promiscuous mode [ 796.142112][ T2455] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 796.244961][ T3461] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.269871][ T2307] team0: Port device team_slave_0 added [ 796.353374][ T2307] team0: Port device team_slave_1 added [ 796.376667][ T2483] netlink: 'syz.3.9034': attribute type 4 has an invalid length. [ 796.410115][ T3461] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.428700][ T2476] netlink: 'syz.3.9034': attribute type 4 has an invalid length. [ 796.514838][ T2307] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 796.531156][ T2307] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 796.567339][ T2307] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 796.582510][T23754] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.602788][ T1041] netdevsim netdevsim2 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.615426][ T2307] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 796.631053][ T2307] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 796.672269][ T2496] openvswitch: netlink: Message has 4 unknown bytes. [ 796.691602][ T2307] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 797.064773][T24898] bond6 (unregistering): (slave ip6gretap1): Releasing active interface [ 797.178015][ T5841] Bluetooth: hci4: command tx timeout [ 797.270653][T23754] smc: removing ib device syz1 [ 797.652802][T24898] bond0 (unregistering): left promiscuous mode [ 797.659477][T24898] bond_slave_0: left promiscuous mode [ 797.665291][T24898] bond_slave_1: left promiscuous mode [ 797.673312][T24898] mac80211_hwsim hwsim76 wlan1: left promiscuous mode [ 797.684547][T24898] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 797.708532][T24898] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 797.724519][T24898] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 797.734821][T24898] bond0 (unregistering): Released all slaves [ 797.902931][T24898] bond1 (unregistering): Released all slaves [ 797.931082][T24898] bond2 (unregistering): Released all slaves [ 797.995399][T24898] bond3 (unregistering): Released all slaves [ 798.027952][T24898] bond4 (unregistering): Released all slaves [ 798.279151][T24898] bond5 (unregistering): Released all slaves [ 798.510574][T24898] bond6 (unregistering): Released all slaves [ 798.569965][ T5913] xfrm0 speed is unknown, defaulting to 1000 [ 798.587897][ T5913] syz1: Port: 1 Link DOWN [ 798.600341][ T2528] syz_tun: entered allmulticast mode [ 798.799528][ T2535] syz_tun: left allmulticast mode [ 798.839688][ T2307] hsr_slave_0: entered promiscuous mode [ 798.846406][ T2307] hsr_slave_1: entered promiscuous mode [ 798.861647][ T2307] debugfs: 'hsr0' already exists in 'hsr' [ 798.870743][ T2307] Cannot create hsr debugfs directory [ 798.933607][ T2546] __nla_validate_parse: 11 callbacks suppressed [ 798.933627][ T2546] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9044'. [ 799.056424][ T2546] gretap0: entered promiscuous mode [ 799.082731][ T2552] gretap0: left promiscuous mode [ 799.114655][ T2552] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 799.257771][T23803] Bluetooth: hci4: command tx timeout [ 799.490177][ T2566] syzkaller0: entered promiscuous mode [ 799.495823][ T2566] syzkaller0: entered allmulticast mode [ 799.615575][ T2566] tipc: Enabled bearer , priority 0 [ 799.687739][ T2565] tipc: Resetting bearer [ 799.690476][ T2544] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 799.768792][ T2565] tipc: Disabling bearer [ 799.960146][ T2307] netdevsim netdevsim2 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.071830][ T2600] pimreg: entered allmulticast mode [ 800.129340][ T2594] pimreg: left allmulticast mode [ 800.226434][ T2612] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9056'. [ 800.235849][ T2612] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9056'. [ 800.251966][ T2307] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.294033][ T2597] syz_tun: entered allmulticast mode [ 800.372474][ T2307] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.441988][ T2597] siw: device registration error -23 [ 800.469333][ T2597] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9054'. [ 800.588272][ T2307] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 800.606693][ T2595] syz_tun: left allmulticast mode [ 800.777717][ T2643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9062'. [ 800.923440][ T2651] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9065'. [ 801.017285][T24898] team0: left promiscuous mode [ 801.041237][T24898] team_slave_0: left promiscuous mode [ 801.057049][T24898] team_slave_1: left promiscuous mode [ 801.071135][T24898] hsr_slave_0: left promiscuous mode [ 801.092233][T24898] hsr_slave_1: left promiscuous mode [ 801.110623][T24898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 801.130734][T24898] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 801.143662][ T2668] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9067'. [ 801.162526][T24898] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 801.178253][T23803] Bluetooth: hci0: command 0x0401 tx timeout [ 801.184513][T24898] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 801.275192][T24898] veth1_macvtap: left promiscuous mode [ 801.298002][T24898] veth0_macvtap: left promiscuous mode [ 801.327629][T24898] veth1_vlan: left promiscuous mode [ 801.334434][T24898] veth0_vlan: left promiscuous mode [ 801.348402][T23803] Bluetooth: hci4: command tx timeout [ 802.215822][T24898] team0 (unregistering): Port device team_slave_1 removed [ 802.260400][T24898] team0 (unregistering): Port device team_slave_0 removed [ 802.688635][ T2707] syz_tun: entered allmulticast mode [ 802.708710][ T2307] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 802.760679][ T2307] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 802.924206][ T2709] syz_tun: left allmulticast mode [ 802.942703][ T2725] can: request_module (can-proto-4) failed. [ 802.949026][ T2307] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 802.989579][ T2307] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 803.001089][ T2729] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9075'. [ 803.060062][ T2731] netlink: 'syz.3.9076': attribute type 4 has an invalid length. [ 803.111426][ T2743] netlink: 'syz.3.9076': attribute type 4 has an invalid length. [ 803.240431][ T2748] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9079'. [ 803.241715][T24898] IPVS: stop unused estimator thread 0... [ 803.266205][ T2307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 803.341017][ T2307] 8021q: adding VLAN 0 to HW filter on device team0 [ 803.373234][T16484] bridge0: port 1(bridge_slave_0) entered blocking state [ 803.380453][T16484] bridge0: port 1(bridge_slave_0) entered forwarding state [ 803.423344][T16484] bridge0: port 2(bridge_slave_1) entered blocking state [ 803.428490][ T2758] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 803.430574][T16484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 803.995610][ T2785] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9087'. [ 804.052440][ T2307] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 804.091319][ T2788] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9088'. [ 804.178922][ T2788] 8021q: adding VLAN 0 to HW filter on device bond1 [ 804.318006][ T2794] 8021q: adding VLAN 0 to HW filter on device bond1 [ 804.338565][ T2794] bond1: (slave sit1): The slave device specified does not support setting the MAC address [ 804.364484][ T2794] bond1: (slave sit1): Error -95 calling set_mac_address [ 804.488709][ T2307] veth0_vlan: entered promiscuous mode [ 804.513632][ T2812] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9093'. [ 804.572934][ T2812] gretap0: entered promiscuous mode [ 804.593958][ T2307] veth1_vlan: entered promiscuous mode [ 804.636953][ T2812] gretap0: left promiscuous mode [ 804.703460][ T2829] netlink: 'syz.0.9096': attribute type 1 has an invalid length. [ 804.741815][ T2812] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 804.917126][ T2829] 8021q: adding VLAN 0 to HW filter on device bond4 [ 804.998843][ T2841] af_packet: tpacket_rcv: packet too big, clamped from 92 to 4294967272. macoff=96 [ 805.005718][ T2834] vlan3: entered promiscuous mode [ 805.014278][ T2834] bond4: entered promiscuous mode [ 805.056285][ T2834] vlan3: entered allmulticast mode [ 805.077528][ T2834] bond4: entered allmulticast mode [ 805.170213][ T2841] bond4: (slave gretap2): making interface the new active one [ 805.210583][ T2841] gretap2: entered promiscuous mode [ 805.231591][ T2841] gretap2: entered allmulticast mode [ 805.256013][ T2841] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 805.376201][ T2307] veth0_macvtap: entered promiscuous mode [ 805.410731][ T2307] veth1_macvtap: entered promiscuous mode [ 805.479860][ T2307] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 805.589084][ T2307] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 805.613945][ T2886] netlink: 'syz.1.9103': attribute type 3 has an invalid length. [ 805.713356][T24900] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 805.746102][ T2886] syz_tun: entered allmulticast mode [ 805.762860][T24900] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 805.795112][ T2885] syz_tun: left allmulticast mode [ 805.808582][T24900] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 805.833075][T24900] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 805.875646][ T2896] openvswitch: netlink: Unknown key attributes 2 [ 806.037929][ T2900] netlink: 'syz.1.9107': attribute type 3 has an invalid length. [ 806.067615][ T2903] xt_bpf: check failed: parse error [ 806.105017][ T2900] syz_tun: entered allmulticast mode [ 806.121291][T16484] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 806.145442][T16484] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 806.237023][ T2900] siw: device registration error -23 [ 806.256738][ T2900] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9107'. [ 806.266854][T16484] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 806.290640][T16484] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 806.300166][ T2899] syz_tun: left allmulticast mode [ 806.474368][ T2922] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9115'. [ 806.491808][ T2924] netlink: 'syz.3.9116': attribute type 3 has an invalid length. [ 806.539422][ T2930] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9115'. [ 806.571092][ T2924] syz_tun: entered allmulticast mode [ 806.577129][ T2922] netlink: 'syz.1.9115': attribute type 58 has an invalid length. [ 806.588091][ T2921] syz_tun: left allmulticast mode [ 806.593755][ T2922] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9115'. [ 806.792227][ T2936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9119'. [ 806.813093][ T3900] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 806.813211][ T2936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9119'. [ 806.845498][ T3900] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 806.984681][ T3900] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 807.009386][ T3900] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 807.244850][ T2952] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.9123'. [ 807.255682][ T2954] netlink: 'syz.3.9124': attribute type 3 has an invalid length. [ 807.306442][ T2952] netlink: 'syz.0.9123': attribute type 1 has an invalid length. [ 807.337152][ T2954] syz_tun: entered allmulticast mode [ 807.350471][ T2956] netlink: 'syz.1.9125': attribute type 4 has an invalid length. [ 807.361547][ T2954] siw: device registration error -23 [ 807.400169][ T2953] syz_tun: left allmulticast mode [ 807.432073][ T2957] A link change request failed with some changes committed already. Interface veth0_to_batadv may have been left with an inconsistent configuration, please check. [ 807.850144][ T2977] syz_tun: entered allmulticast mode [ 807.866947][ T2976] syz_tun: left allmulticast mode [ 808.889534][ T3021] validate_nla: 3 callbacks suppressed [ 808.889558][ T3021] netlink: 'syz.0.9143': attribute type 3 has an invalid length. [ 809.043948][ T3028] __nla_validate_parse: 2 callbacks suppressed [ 809.043969][ T3028] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9145'. [ 809.096697][ T3030] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9146'. [ 809.253549][ T3037] netlink: 'syz.4.9148': attribute type 3 has an invalid length. [ 809.297226][ T3037] siw: device registration error -23 [ 809.303486][ T3037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9148'. [ 809.437561][ T3046] netlink: 'syz.2.9152': attribute type 1 has an invalid length. [ 809.466333][ T3046] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9152'. [ 809.633824][ T3056] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9157'. [ 809.653087][ T3056] openvswitch: netlink: Missing key (keys=40, expected=80) [ 809.825982][ T3065] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9159'. [ 809.992043][ T3073] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9162'. [ 810.120008][ T3075] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9163'. [ 810.426387][ T3092] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9167'. [ 810.570268][ T3098] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9168'. [ 810.653476][ T3103] bridge_slave_1: left allmulticast mode [ 810.667318][ T3103] bridge_slave_1: left promiscuous mode [ 810.683801][ T3103] bridge0: port 2(bridge_slave_1) entered disabled state [ 810.702643][ T3103] bridge_slave_0: left allmulticast mode [ 810.713941][ T3103] bridge_slave_0: left promiscuous mode [ 810.729094][ T3103] bridge0: port 1(bridge_slave_0) entered disabled state [ 810.913815][ T3114] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 812.306857][ T3143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 812.468953][ T3171] xt_bpf: check failed: parse error [ 812.617848][ T3179] macvtap1: entered promiscuous mode [ 812.623194][ T3179] veth1_to_hsr: entered promiscuous mode [ 812.640570][ T3179] macvtap1: entered allmulticast mode [ 812.646417][ T3179] veth1_to_hsr: entered allmulticast mode [ 812.849346][ T3194] TCP: TCP_TX_DELAY enabled [ 813.191929][ T3214] bond5: option tlb_dynamic_lb: invalid value (5) [ 813.211188][ T3214] bond5 (unregistering): Released all slaves [ 813.511898][ T3231] team0: entered promiscuous mode [ 813.543509][ T3231] team_slave_0: entered promiscuous mode [ 813.571827][ T3231] team_slave_1: entered promiscuous mode [ 813.604011][ T3231] bond0: entered promiscuous mode [ 813.620855][ T3231] bond_slave_0: entered promiscuous mode [ 813.636942][ T3231] bond_slave_1: entered promiscuous mode [ 813.647056][ T3231] debugfs: 'hsr1' already exists in 'hsr' [ 813.654096][ T3242] netlink: 'syz.1.9211': attribute type 4 has an invalid length. [ 813.666104][ T3231] Cannot create hsr debugfs directory [ 813.686930][ T3231] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 813.703964][ T3241] netlink: 'syz.1.9211': attribute type 4 has an invalid length. [ 813.822539][ T3247] syzkaller0: entered promiscuous mode [ 813.866114][ T3247] syzkaller0: entered allmulticast mode [ 813.872025][ T3255] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 813.971439][ T3247] macsec1: entered promiscuous mode [ 814.390364][ T3279] __nla_validate_parse: 8 callbacks suppressed [ 814.390385][ T3279] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9224'. [ 814.459640][ T3282] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9224'. [ 814.543474][ T3279] bond5: option ad_actor_sys_prio: invalid value (0) [ 814.586807][ T3279] bond5: option ad_actor_sys_prio: allowed values 1 - 65535 [ 814.638039][ T3288] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9226'. [ 814.647067][ T3288] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9226'. [ 814.661927][ T3279] bond5 (unregistering): Released all slaves [ 814.740409][ T3291] netlink: 'syz.1.9228': attribute type 3 has an invalid length. [ 814.757592][ T3292] syz_tun: entered allmulticast mode [ 814.766234][ T3289] syz_tun: left allmulticast mode [ 814.804566][ T3291] syz_tun: entered allmulticast mode [ 814.824985][ T3290] syz_tun: left allmulticast mode [ 815.211739][ T3318] netlink: 9 bytes leftover after parsing attributes in process `syz.4.9235'. [ 815.227939][ T3318] gretap0: entered promiscuous mode [ 815.277017][ T3318] gretap0: left promiscuous mode [ 815.373309][ T3318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 815.381798][ T3318] 8021q: adding VLAN 0 to HW filter on device team0 [ 815.395325][ T3318] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 815.448020][ T3327] netlink: 'syz.2.9238': attribute type 4 has an invalid length. [ 815.490079][ T3327] netlink: 'syz.2.9238': attribute type 4 has an invalid length. [ 815.504237][ T3284] infiniband !yz!: set down [ 815.532846][ T3284] infiniband !yz!: added team_slave_0 [ 815.622770][ T3335] syz_tun: entered allmulticast mode [ 815.631610][ T3334] syz_tun: left allmulticast mode [ 815.653345][ T3284] RDS/IB: !yz!: added [ 815.690538][ T3284] smc: adding ib device !yz! with port count 1 [ 815.696756][ T3284] smc: ib device !yz! port 1 has no pnetid [ 815.750801][ T3340] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9240'. [ 815.785686][ T3340] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9240'. [ 815.829791][ T3333] netlink: 'syz.4.9240': attribute type 32 has an invalid length. [ 815.892597][ T3342] syz_tun: entered promiscuous mode [ 815.899046][ T3342] vlan2: entered promiscuous mode [ 816.149067][ T3351] xt_bpf: check failed: parse error [ 816.215045][ T3353] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9246'. [ 816.330618][ T3359] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 816.957990][ T3369] netlink: 'syz.1.9251': attribute type 4 has an invalid length. [ 817.015365][ T3369] netlink: 'syz.1.9251': attribute type 4 has an invalid length. [ 817.053153][ T3372] syz_tun: entered allmulticast mode [ 817.069339][ T3371] syz_tun: left allmulticast mode [ 817.456846][ T3379] syz_tun: entered promiscuous mode [ 817.481680][ T3379] vlan2: entered promiscuous mode [ 817.599484][ T5841] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 817.610994][ T5841] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 817.622331][ T5841] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 817.630746][ T5841] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 817.638531][ T5841] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 819.487222][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 819.628109][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 819.641163][ T3385] xt_bpf: check failed: parse error [ 819.655666][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 819.662249][T23803] Bluetooth: hci5: command tx timeout [ 819.975377][ T3401] vxcan1: tx drop: invalid sa for name 0x0000000000000001 [ 820.211410][ T3411] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 820.233029][ T3380] chnl_net:caif_netlink_parms(): no params data found [ 820.442509][ T3367] infiniband syz1: set active [ 820.452048][ T3367] infiniband syz1: added xfrm0 [ 820.473543][ T5913] xfrm0 speed is unknown, defaulting to 1000 [ 820.475081][ T3422] netlink: 'syz.4.9265': attribute type 4 has an invalid length. [ 820.487871][ T3422] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9265'. [ 820.497025][ T3421] netlink: 'syz.4.9265': attribute type 4 has an invalid length. [ 820.527635][ T3421] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9265'. [ 820.571588][ T3428] ip6tnl0: Caught tx_queue_len zero misconfig [ 820.596214][ T3367] RDS/IB: syz1: added [ 820.614865][ T3367] smc: adding ib device syz1 with port count 1 [ 820.643859][ T3367] smc: ib device syz1 port 1 has pnetid SYZ0 (user defined) [ 820.726418][ T3421] batadv_slave_0: Caught tx_queue_len zero misconfig [ 820.788156][ T5913] xfrm0 speed is unknown, defaulting to 1000 [ 820.807706][ T3380] bridge0: port 1(bridge_slave_0) entered blocking state [ 820.814877][ T3380] bridge0: port 1(bridge_slave_0) entered disabled state [ 820.831215][ T3380] bridge_slave_0: entered allmulticast mode [ 820.851557][ T3380] bridge_slave_0: entered promiscuous mode [ 820.866092][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 820.879980][ T3380] bridge0: port 2(bridge_slave_1) entered blocking state [ 820.907748][ T3380] bridge0: port 2(bridge_slave_1) entered disabled state [ 820.915066][ T3380] bridge_slave_1: entered allmulticast mode [ 820.958749][ T3380] bridge_slave_1: entered promiscuous mode [ 821.094904][ T3380] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 821.170524][ T3380] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 821.324571][ T3380] team0: Port device team_slave_0 added [ 821.353029][ T3380] team0: Port device team_slave_1 added [ 821.434025][ T3465] netlink: 9 bytes leftover after parsing attributes in process `syz.3.9275'. [ 821.459400][ T3380] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 821.466390][ T3380] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 821.522851][ T3380] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 821.534878][ T3467] netlink: 9 bytes leftover after parsing attributes in process `syz.0.9276'. [ 821.545148][ T3465] gretap0: entered promiscuous mode [ 821.553968][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 821.560808][ T3380] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 821.577712][ T3380] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 821.606955][ T3472] netlink: 'syz.4.9277': attribute type 4 has an invalid length. [ 821.627663][ T3380] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 821.659603][ T3467] gretap0: entered promiscuous mode [ 821.666851][ T3474] netlink: 'syz.4.9277': attribute type 4 has an invalid length. [ 821.676598][ T3465] gretap0: left promiscuous mode [ 821.689119][ T3465] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 821.733572][ T3473] gretap0: left promiscuous mode [ 821.747515][T23803] Bluetooth: hci5: command tx timeout [ 821.755409][ T3473] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 821.913570][ T3380] hsr_slave_0: entered promiscuous mode [ 821.951670][ T3380] hsr_slave_1: entered promiscuous mode [ 821.972183][ T3380] debugfs: 'hsr0' already exists in 'hsr' [ 821.987601][ T3380] Cannot create hsr debugfs directory [ 822.096919][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 822.294262][ T3487] xt_bpf: check failed: parse error [ 822.439792][ T3491] syzkaller0: entered promiscuous mode [ 822.445438][ T3491] syzkaller0: entered allmulticast mode [ 822.462007][ T3493] netlink: 'syz.0.9285': attribute type 4 has an invalid length. [ 822.549742][ T3494] netlink: 'syz.0.9285': attribute type 4 has an invalid length. [ 822.730056][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 823.147167][ T3489] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9283'. [ 823.185984][ T3506] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 823.380957][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 823.442002][ T3380] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 823.500693][ T3380] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 823.528641][ T3380] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 823.572132][ T3510] netlink: 'syz.0.9288': attribute type 4 has an invalid length. [ 823.581156][ T3380] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 823.637816][ T3510] netlink: 'syz.0.9288': attribute type 4 has an invalid length. [ 823.661533][ T3512] netlink: 9 bytes leftover after parsing attributes in process `syz.4.9289'. [ 823.694065][ T3512] gretap0: entered promiscuous mode [ 823.731497][ T3512] gretap0: left promiscuous mode [ 823.775544][ T3512] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 823.817977][T23803] Bluetooth: hci5: command tx timeout [ 823.939561][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 823.960721][ T3380] 8021q: adding VLAN 0 to HW filter on device bond0 [ 824.016656][ T3380] 8021q: adding VLAN 0 to HW filter on device team0 [ 824.050508][ T3532] xt_bpf: check failed: parse error [ 824.069589][ T3799] bridge0: port 1(bridge_slave_0) entered blocking state [ 824.076788][ T3799] bridge0: port 1(bridge_slave_0) entered forwarding state [ 824.132909][ T3900] bridge0: port 2(bridge_slave_1) entered blocking state [ 824.140116][ T3900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 824.345810][ T3543] netlink: 7 bytes leftover after parsing attributes in process `syz.3.9298'. [ 824.466688][ T3546] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9296'. [ 824.518780][ T3546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9296'. [ 824.621776][ T3553] netlink: 'syz.4.9300': attribute type 4 has an invalid length. [ 824.636641][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 824.680274][ T3553] netlink: 'syz.4.9300': attribute type 4 has an invalid length. [ 824.855963][ T3380] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 825.002750][ T3380] veth0_vlan: entered promiscuous mode [ 825.056797][ T3380] veth1_vlan: entered promiscuous mode [ 825.088922][ T3563] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9304'. [ 825.186507][ T3380] veth0_macvtap: entered promiscuous mode [ 825.235986][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 825.265775][ T3380] veth1_macvtap: entered promiscuous mode [ 825.342152][ T3380] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 825.362792][ T3380] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 825.434638][T24903] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.489621][T24903] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.500053][ T3580] validate_nla: 2 callbacks suppressed [ 825.500072][ T3580] netlink: 'syz.0.9312': attribute type 4 has an invalid length. [ 825.523262][T24903] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.556168][T24903] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.898834][T23803] Bluetooth: hci5: command tx timeout [ 825.914325][T24900] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 825.964806][T24900] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 825.993623][ T3600] netlink: 'syz.0.9318': attribute type 3 has an invalid length. [ 826.011047][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 826.063929][ T3604] tipc: Started in network mode [ 826.093517][ T3604] tipc: Node identity be8b39e6baff, cluster identity 4711 [ 826.114316][ T3604] tipc: Enabled bearer , priority 0 [ 826.145036][ T3609] syzkaller0: entered promiscuous mode [ 826.146444][ T3600] __nla_validate_parse: 1 callbacks suppressed [ 826.146461][ T3600] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9318'. [ 826.150722][T24900] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 826.150740][T24900] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 826.162074][ T3609] syzkaller0: entered allmulticast mode [ 826.415312][ T3604] tipc: Resetting bearer [ 826.446842][ T3603] tipc: Resetting bearer [ 826.466209][ T3613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9320'. [ 826.559044][ T3603] tipc: Disabling bearer [ 826.701669][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 826.797822][ T3621] netlink: 'syz.1.9323': attribute type 13 has an invalid length. [ 826.875945][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 826.891759][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 826.900797][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 826.909623][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 826.918224][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 827.049149][ T3624] syz_tun: entered allmulticast mode [ 827.124190][ T3628] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 827.209729][ T3628] syzkaller0: entered promiscuous mode [ 827.215357][ T3628] syzkaller0: entered allmulticast mode [ 827.418232][ T3632] netlink: 'syz.3.9325': attribute type 4 has an invalid length. [ 828.943866][ T5841] Bluetooth: hci1: command tx timeout [ 829.603617][ T3367] xfrm0 speed is unknown, defaulting to 1000 [ 830.242085][ T3657] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9335'. [ 830.343624][ T3664] 8021q: adding VLAN 0 to HW filter on device bond1 [ 830.358245][ T3623] xfrm0 speed is unknown, defaulting to 1000 [ 830.358513][ T3657] nbd: socks must be embedded in a SOCK_ITEM attr [ 830.418085][ T2113] block nbd64: NBD_DISCONNECT [ 830.529418][ T3657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9335'. [ 830.579703][ T3657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9335'. [ 830.580029][ T3672] smc: net device hsr0 applied user defined pnetid SYZ2 [ 830.663189][ T3677] smc: net device hsr0 erased user defined pnetid SYZ2 [ 830.748373][ T2113] udevd[2113]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 830.773125][ T3681] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 786440, id = 0 [ 830.773648][ T3672] IPVS: stopping backup sync thread 3681 ... [ 831.017995][ T5841] Bluetooth: hci1: command tx timeout [ 831.066328][ T3694] netlink: 'syz.4.9343': attribute type 13 has an invalid length. [ 831.652353][ T3623] chnl_net:caif_netlink_parms(): no params data found [ 831.709424][ T3680] xfrm0 speed is unknown, defaulting to 1000 [ 832.079044][ T3734] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9355'. [ 832.095094][ T3734] netlink: 168 bytes leftover after parsing attributes in process `syz.4.9355'. [ 832.154474][ T3623] bridge0: port 1(bridge_slave_0) entered blocking state [ 832.179617][ T3623] bridge0: port 1(bridge_slave_0) entered disabled state [ 832.186938][ T3623] bridge_slave_0: entered allmulticast mode [ 832.230595][ T3743] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9356'. [ 832.249356][ T3623] bridge_slave_0: entered promiscuous mode [ 832.279361][ T3623] bridge0: port 2(bridge_slave_1) entered blocking state [ 832.292801][ T3623] bridge0: port 2(bridge_slave_1) entered disabled state [ 832.309996][ T3623] bridge_slave_1: entered allmulticast mode [ 832.326309][ T3623] bridge_slave_1: entered promiscuous mode [ 832.589687][ T3745] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 832.630374][ T3623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 832.692846][ T3623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 832.729134][ T3745] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 832.808510][ T3623] team0: Port device team_slave_0 added [ 832.859758][ T3745] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 832.891070][ T3623] team0: Port device team_slave_1 added [ 832.992962][ T3745] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 833.100570][ T5841] Bluetooth: hci1: command tx timeout [ 833.230480][ T3623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 833.257838][ T3623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 833.327084][ T3623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 833.378477][ T3623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 833.408740][ T3623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 833.469016][ T3623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 833.565315][ T3778] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9368'. [ 833.744963][ T3623] hsr_slave_0: entered promiscuous mode [ 833.750413][ T3783] rdma_rxe: rxe_newlink: failed to add xfrm0 [ 833.763283][ T3623] hsr_slave_1: entered promiscuous mode [ 833.776411][ T3623] debugfs: 'hsr0' already exists in 'hsr' [ 833.790373][ T3623] Cannot create hsr debugfs directory [ 833.820622][ T3461] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.865772][ T3461] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.952934][ T1141] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.014739][ T3799] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.280118][ T3623] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.308810][ T3623] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.339909][ T3796] netlink: 'syz.2.9375': attribute type 3 has an invalid length. [ 834.362255][ T3796] syz_tun: entered allmulticast mode [ 834.392505][ T3623] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.413557][ T3623] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.457019][ T3797] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9376'. [ 834.470189][ T3796] siw: device registration error -23 [ 834.476522][ T3796] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9375'. [ 834.549638][ T3795] syz_tun: left allmulticast mode [ 834.568755][ T3623] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.591732][ T3623] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.683849][ T3623] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.719020][ T3623] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.901970][ T3812] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9381'. [ 835.008702][ T3802] xfrm0 speed is unknown, defaulting to 1000 [ 835.070195][ T3818] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9380'. [ 835.187563][ T5841] Bluetooth: hci1: command tx timeout [ 835.594756][ T3826] vlan2: entered promiscuous mode [ 835.686451][ T3623] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 835.735623][ T3623] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 835.784000][ T3623] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 835.820866][ T3623] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 835.930833][ T3817] xfrm0 speed is unknown, defaulting to 1000 [ 836.122952][ T3623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 836.154670][ T3843] netlink: 'syz.4.9389': attribute type 3 has an invalid length. [ 836.209362][ T3623] 8021q: adding VLAN 0 to HW filter on device team0 [ 836.243738][T16484] bridge0: port 1(bridge_slave_0) entered blocking state [ 836.250987][T16484] bridge0: port 1(bridge_slave_0) entered forwarding state [ 836.300260][ T3799] bridge0: port 2(bridge_slave_1) entered blocking state [ 836.307484][ T3799] bridge0: port 2(bridge_slave_1) entered forwarding state [ 836.319765][ T3843] siw: device registration error -23 [ 836.320181][ T3846] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9389'. [ 836.532483][ T3848] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.560553][ T3852] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9392'. [ 836.688519][ T3848] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 836.847791][ T3848] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.057790][ T3848] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.305292][T23754] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 837.343404][T23754] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 837.411802][ T3461] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 837.455720][T16484] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 837.478730][ T3623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 837.605463][ T3623] veth0_vlan: entered promiscuous mode [ 837.643829][ T3623] veth1_vlan: entered promiscuous mode [ 837.670212][ T3862] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.705369][ T3851] xfrm0 speed is unknown, defaulting to 1000 [ 837.747336][ T3862] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.790126][ T3623] veth0_macvtap: entered promiscuous mode [ 837.822810][ T3862] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.851432][ T3623] veth1_macvtap: entered promiscuous mode [ 837.902041][ T3862] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 837.934341][ T3623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 837.953962][ T3623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 837.996765][ T3461] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.026306][ T3461] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.047709][ T3461] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.066825][ T3461] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.301111][T16484] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 838.319425][T16484] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 838.413112][ T1141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 838.438951][ T1141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 839.126901][ T3899] netlink: 'syz.1.9405': attribute type 16 has an invalid length. [ 839.141371][ T3899] netlink: 'syz.1.9405': attribute type 17 has an invalid length. [ 839.207930][ T3908] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9407'. [ 839.232570][ T3903] bridge0: port 1(bridge_slave_0) entered disabled state [ 839.261045][ T3903] bridge0: port 2(bridge_slave_1) entered disabled state [ 839.431916][ T3899] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 839.457289][ T3909] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9405'. [ 839.499873][ T3912] syz_tun: entered allmulticast mode [ 839.520374][ T3906] syz_tun: left allmulticast mode [ 839.675950][ T3920] netlink: 52 bytes leftover after parsing attributes in process `syz.0.9410'. [ 840.149919][T23803] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 840.162254][T23803] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 840.174558][T23803] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 840.183553][T23803] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 840.191393][T23803] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 840.202224][ T3943] xt_check_table_hooks: 24 callbacks suppressed [ 840.202242][ T3943] x_tables: unsorted entry at hook 3 [ 840.515956][ T3932] xfrm0 speed is unknown, defaulting to 1000 [ 840.600955][ T3948] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9419'. [ 840.936839][ T3940] xfrm0 speed is unknown, defaulting to 1000 [ 841.026991][ T3954] nftables ruleset with unbound set [ 841.308525][ T3561] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.317722][ T3960] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9424'. [ 841.353449][ T3960] gretap0: entered promiscuous mode [ 841.405797][ T1041] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.429360][ T3960] gretap0: left promiscuous mode [ 841.465513][ T3960] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 841.655345][T16484] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 841.982209][ T3900] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 842.094937][ T3971] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9429'. [ 842.299457][T23803] Bluetooth: hci2: command tx timeout [ 842.453720][ T3982] vlan2: entered promiscuous mode [ 842.541308][ T3940] chnl_net:caif_netlink_parms(): no params data found [ 842.595145][ T3989] sctp: [Deprecated]: syz.0.9435 (pid 3989) Use of struct sctp_assoc_value in delayed_ack socket option. [ 842.595145][ T3989] Use struct sctp_sack_info instead [ 842.819086][ T3994] bond2: option lp_interval: invalid value (0) [ 842.833910][ T3994] bond2: option lp_interval: allowed values 1 - 2147483647 [ 842.864246][ T3994] bond2 (unregistering): Released all slaves [ 843.032953][ T3940] bridge0: port 1(bridge_slave_0) entered blocking state [ 843.050778][ T3940] bridge0: port 1(bridge_slave_0) entered disabled state [ 843.080269][ T3940] bridge_slave_0: entered allmulticast mode [ 843.103846][ T3940] bridge_slave_0: entered promiscuous mode [ 843.129094][ T3940] bridge0: port 2(bridge_slave_1) entered blocking state [ 843.136328][ T3940] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.157679][ T3940] bridge_slave_1: entered allmulticast mode [ 843.175417][ T3940] bridge_slave_1: entered promiscuous mode [ 843.322386][ T3940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 843.403821][ T3940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 843.506340][ T3940] team0: Port device team_slave_0 added [ 843.532513][ T3940] team0: Port device team_slave_1 added [ 843.570548][ T4024] netlink: 'syz.1.9445': attribute type 2 has an invalid length. [ 843.620449][ T4024] netlink: 'syz.1.9445': attribute type 1 has an invalid length. [ 843.645378][ T3940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 843.652760][ T4024] netlink: 'syz.1.9445': attribute type 1 has an invalid length. [ 843.670516][ T3940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 843.727298][ T3940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 843.765074][ T4031] FAULT_INJECTION: forcing a failure. [ 843.765074][ T4031] name failslab, interval 1, probability 0, space 0, times 0 [ 843.765713][ T3940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 843.777766][ T4031] CPU: 0 UID: 0 PID: 4031 Comm: syz.3.9447 Not tainted syzkaller #0 PREEMPT(full) [ 843.777789][ T4031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 843.777800][ T4031] Call Trace: [ 843.777808][ T4031] [ 843.777816][ T4031] dump_stack_lvl+0xe8/0x150 [ 843.777843][ T4031] should_fail_ex+0x412/0x560 [ 843.777869][ T4031] should_failslab+0xa8/0x100 [ 843.777892][ T4031] kmem_cache_alloc_noprof+0x87/0x6e0 [ 843.777920][ T4031] ? dst_alloc+0x105/0x170 [ 843.777951][ T4031] dst_alloc+0x105/0x170 [ 843.777982][ T4031] ip_route_input_rcu+0x1432/0x3130 [ 843.778021][ T4031] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 843.778049][ T4031] ? __skb_flow_dissect+0x649c/0x6d20 [ 843.778083][ T4031] ? ip_route_input_noref+0xad/0x270 [ 843.778105][ T4031] ? lock_acquire+0x106/0x330 [ 843.778137][ T4031] ? ip_route_input_noref+0xad/0x270 [ 843.778159][ T4031] ? ipt_do_table+0x13d2/0x1630 [ 843.778179][ T4031] ? ip_route_input_noref+0xad/0x270 [ 843.778201][ T4031] ip_route_input_noref+0x17c/0x270 [ 843.778226][ T4031] ? __pfx_ip_route_input_noref+0x10/0x10 [ 843.778251][ T4031] ? ipt_do_table+0x2b2/0x1630 [ 843.778271][ T4031] ? __pfx_ipt_do_table+0x10/0x10 [ 843.778294][ T4031] ip_rcv_finish_core+0x5af/0x1c00 [ 843.778325][ T4031] ip_rcv_finish+0x14c/0x2f0 [ 843.778346][ T4031] NF_HOOK+0x336/0x3c0 [ 843.778366][ T4031] ? __pfx_ip_rcv_finish+0x10/0x10 [ 843.778383][ T4031] ? NF_HOOK+0x9e/0x3c0 [ 843.778400][ T4031] ? __pfx_NF_HOOK+0x10/0x10 [ 843.778420][ T4031] ? __pfx_ip_rcv_finish+0x10/0x10 [ 843.778445][ T4031] ? netif_receive_skb+0x102/0xbb0 [ 843.778463][ T4031] ? __pfx_ip_rcv+0x10/0x10 [ 843.778480][ T4031] netif_receive_skb+0x45b/0xbb0 [ 843.778505][ T4031] ? __pfx_netif_receive_skb+0x10/0x10 [ 843.778529][ T4031] ? tun_rx_batched+0x185/0x790 [ 843.778552][ T4031] tun_rx_batched+0x1de/0x790 [ 843.778571][ T4031] ? rcu_is_watching+0x15/0xb0 [ 843.778594][ T4031] ? __pfx_tun_rx_batched+0x10/0x10 [ 843.778613][ T4031] ? tun_get_user+0x2669/0x3dd0 [ 843.778632][ T4031] ? tun_get_user+0x2669/0x3dd0 [ 843.778656][ T4031] ? tun_get_user+0x2354/0x3dd0 [ 843.778674][ T4031] ? __local_bh_enable_ip+0xd0/0x130 [ 843.778695][ T4031] ? tun_get_user+0x2669/0x3dd0 [ 843.778713][ T4031] tun_get_user+0x2a78/0x3dd0 [ 843.778750][ T4031] ? aa_file_perm+0x440/0x1630 [ 843.778775][ T4031] ? __pfx_tun_get_user+0x10/0x10 [ 843.778796][ T4031] ? __lock_acquire+0x6b5/0x2cf0 [ 843.778833][ T4031] ? ref_tracker_alloc+0x363/0x4d0 [ 843.778860][ T4031] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 843.778885][ T4031] ? tun_get+0x1c/0x2f0 [ 843.778904][ T4031] ? tun_get+0x1c/0x2f0 [ 843.778928][ T4031] ? tun_get+0x1c/0x2f0 [ 843.778946][ T4031] ? tun_get+0x1c/0x2f0 [ 843.778969][ T4031] tun_chr_write_iter+0x113/0x200 [ 843.778991][ T4031] vfs_write+0x61d/0xb90 [ 843.779025][ T4031] ? __pfx_vfs_write+0x10/0x10 [ 843.779060][ T4031] ? __fget_files+0x2a/0x420 [ 843.779089][ T4031] ksys_write+0x150/0x270 [ 843.779116][ T4031] ? __pfx_ksys_write+0x10/0x10 [ 843.779163][ T4031] do_syscall_64+0xe2/0xf80 [ 843.779185][ T4031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.779202][ T4031] ? trace_irq_disable+0x37/0x100 [ 843.779219][ T4031] ? clear_bhb_loop+0x60/0xb0 [ 843.779241][ T4031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.779259][ T4031] RIP: 0033:0x7fd88b55b78e [ 843.779277][ T4031] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 843.779294][ T4031] RSP: 002b:00007fd88c374fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 843.779314][ T4031] RAX: ffffffffffffffda RBX: 00007fd88c3756c0 RCX: 00007fd88b55b78e [ 843.779328][ T4031] RDX: 000000000000003e RSI: 0000200000000140 RDI: 00000000000000c8 [ 843.779340][ T4031] RBP: 00007fd88c375090 R08: 0000000000000000 R09: 0000000000000000 [ 843.779352][ T4031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.779363][ T4031] R13: 00007fd88b816038 R14: 00007fd88b815fa0 R15: 00007ffe861b07b8 [ 843.779395][ T4031] [ 844.233675][ T3940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 844.265566][ T4053] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9451'. [ 844.289785][ T3940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 844.331831][ T4040] tipc: Started in network mode [ 844.359609][ T4040] tipc: Node identity 662eec0bb3f6, cluster identity 4711 [ 844.376010][ T4040] tipc: Enabled bearer , priority 0 [ 844.377905][T23803] Bluetooth: hci2: command tx timeout [ 844.408981][ T4043] netlink: 156 bytes leftover after parsing attributes in process `syz.0.9448'. [ 844.500663][ T4050] tipc: Resetting bearer [ 844.684698][ T4063] netlink: 'syz.2.9455': attribute type 3 has an invalid length. [ 844.693812][ T4035] tipc: Disabling bearer [ 844.715614][ T4063] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9455'. [ 844.732770][ T3940] hsr_slave_0: entered promiscuous mode [ 844.767081][ T3940] hsr_slave_1: entered promiscuous mode [ 844.783766][ T3940] debugfs: 'hsr0' already exists in 'hsr' [ 844.796529][ T3940] Cannot create hsr debugfs directory [ 844.915646][ T4073] netlink: 9 bytes leftover after parsing attributes in process `syz.0.9457'. [ 844.993462][ T4073] gretap0: entered promiscuous mode [ 845.045542][ T4073] gretap0: left promiscuous mode [ 845.107795][ T4073] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 845.159200][ T4085] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9459'. [ 845.350771][ T4090] syz_tun: entered allmulticast mode [ 845.432808][ T4091] netlink: 64 bytes leftover after parsing attributes in process `syz.0.9462'. [ 845.448292][ T4083] syz_tun: left allmulticast mode [ 845.776170][ T4104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9466'. [ 845.931799][ T4121] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9470'. [ 846.277157][ T4126] workqueue: Failed to create a rescuer kthread for wq "nfc5_nci_tx_wq": -EINTR [ 846.301056][ T3940] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 846.345593][ T3940] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 846.457943][T23803] Bluetooth: hci2: command tx timeout [ 846.473507][ T3940] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 846.541256][ T3940] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 846.631838][ T4154] rdma_rxe: rxe_newlink: failed to add xfrm0 [ 846.642065][ T4152] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9477'. [ 846.899094][ T4174] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 846.929779][ T4167] syz_tun: entered allmulticast mode [ 846.938326][ T4175] netlink: 'syz.3.9482': attribute type 3 has an invalid length. [ 846.975669][ T4151] syz_tun: left allmulticast mode [ 847.060012][ T4175] syz_tun: left allmulticast mode [ 847.075194][ T4175] siw: device registration error -23 [ 847.095045][ T4175] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9482'. [ 847.176672][ T3940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 847.263947][ T3940] 8021q: adding VLAN 0 to HW filter on device team0 [ 847.300871][ T3900] bridge0: port 1(bridge_slave_0) entered blocking state [ 847.308096][ T3900] bridge0: port 1(bridge_slave_0) entered forwarding state [ 847.369000][ T3900] bridge0: port 2(bridge_slave_1) entered blocking state [ 847.376227][ T3900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 847.503595][ T4193] netlink: 'syz.0.9491': attribute type 6 has an invalid length. [ 847.552284][ T4193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 847.700261][ T4193] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 847.838501][ T4202] team0: entered promiscuous mode [ 847.843687][ T4202] team_slave_0: entered promiscuous mode [ 847.850130][ T4202] team_slave_1: entered promiscuous mode [ 847.862833][ T4202] bond0: entered promiscuous mode [ 847.868147][ T4202] bond_slave_0: entered promiscuous mode [ 847.874200][ T4202] bond_slave_1: entered promiscuous mode [ 847.882021][ T4202] bridge_slave_1: entered promiscuous mode [ 847.890117][ T4202] debugfs: 'hsr1' already exists in 'hsr' [ 847.896034][ T4202] Cannot create hsr debugfs directory [ 847.903047][ T4202] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 848.196113][ T4214] syzkaller0: entered promiscuous mode [ 848.220943][ T4214] syzkaller0: entered allmulticast mode [ 848.243978][ T4219] netlink: 'syz.1.9497': attribute type 3 has an invalid length. [ 848.298281][ T3940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 848.539373][T23803] Bluetooth: hci2: command tx timeout [ 848.601660][ T4241] siw: device registration error -23 [ 851.076604][ T4222] syz_tun: entered allmulticast mode [ 851.084891][ T4238] gretap0: entered promiscuous mode [ 851.100980][ T4244] netlink: 'syz.0.9504': attribute type 3 has an invalid length. [ 851.123925][ T4249] syz_tun: entered allmulticast mode [ 851.153183][ T4228] syz_tun: left allmulticast mode [ 851.259571][ T4254] __nla_validate_parse: 7 callbacks suppressed [ 851.259590][ T4254] netlink: 296 bytes leftover after parsing attributes in process `syz.1.9505'. [ 851.286728][ T4251] syz_tun: left allmulticast mode [ 851.347145][ T4254] netlink: 'syz.1.9505': attribute type 1 has an invalid length. [ 851.388466][ T4254] netlink: 'syz.1.9505': attribute type 2 has an invalid length. [ 851.476315][ T4269] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9508'. [ 851.506945][ T4269] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9508'. [ 851.634047][ T3940] veth0_vlan: entered promiscuous mode [ 851.648292][ T3940] veth1_vlan: entered promiscuous mode [ 851.693024][ T3940] veth0_macvtap: entered promiscuous mode [ 851.712698][ T3940] veth1_macvtap: entered promiscuous mode [ 851.752077][ T3940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 851.766463][ T3940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 851.948719][ T4314] netlink: 'syz.3.9514': attribute type 4 has an invalid length. [ 851.956667][ T3799] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.965780][ T3799] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.017805][ T3799] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.023725][ T4316] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.9515'. [ 852.054234][ T3799] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.118234][ T4316] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9515'. [ 852.121299][ T4321] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9516'. [ 852.193027][ T4321] gretap0: entered promiscuous mode [ 852.245655][ T4319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9517'. [ 852.284857][ T4319] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9517'. [ 852.452219][T24896] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.487506][T24896] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.641461][ T4300] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.687586][ T4300] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.696528][ T4327] xfrm0 speed is unknown, defaulting to 1000 [ 853.130828][ T4347] xt_bpf: check failed: parse error [ 853.333376][ T4350] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9525'. [ 853.510977][ T4359] netlink: 52 bytes leftover after parsing attributes in process `syz.0.9528'. [ 854.585563][ T4390] bond2 (unregistering): Released all slaves [ 854.741277][ T4399] FAULT_INJECTION: forcing a failure. [ 854.741277][ T4399] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 854.806415][ T4399] CPU: 0 UID: 0 PID: 4399 Comm: syz.3.9541 Not tainted syzkaller #0 PREEMPT(full) [ 854.806444][ T4399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 854.806456][ T4399] Call Trace: [ 854.806465][ T4399] [ 854.806474][ T4399] dump_stack_lvl+0xe8/0x150 [ 854.806503][ T4399] should_fail_ex+0x412/0x560 [ 854.806530][ T4399] _copy_from_user+0x2d/0xb0 [ 854.806556][ T4399] ___sys_sendmsg+0x1c6/0x360 [ 854.806579][ T4399] ? __lock_acquire+0x6b5/0x2cf0 [ 854.806605][ T4399] ? __pfx____sys_sendmsg+0x10/0x10 [ 854.806653][ T4399] ? __fget_files+0x2a/0x420 [ 854.806670][ T4399] ? __fget_files+0x3a0/0x420 [ 854.806697][ T4399] __x64_sys_sendmsg+0x1bd/0x2a0 [ 854.806724][ T4399] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 854.806757][ T4399] ? __pfx_ksys_write+0x10/0x10 [ 854.806790][ T4399] do_syscall_64+0xe2/0xf80 [ 854.806809][ T4399] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 854.806826][ T4399] ? trace_irq_disable+0x37/0x100 [ 854.806842][ T4399] ? clear_bhb_loop+0x60/0xb0 [ 854.806864][ T4399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 854.806881][ T4399] RIP: 0033:0x7fd88b59aeb9 [ 854.806897][ T4399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 854.806913][ T4399] RSP: 002b:00007fd88c375028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 854.806932][ T4399] RAX: ffffffffffffffda RBX: 00007fd88b815fa0 RCX: 00007fd88b59aeb9 [ 854.806945][ T4399] RDX: 0000000020008000 RSI: 0000200000000100 RDI: 0000000000000003 [ 854.806957][ T4399] RBP: 00007fd88c375090 R08: 0000000000000000 R09: 0000000000000000 [ 854.806968][ T4399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 854.806977][ T4399] R13: 00007fd88b816038 R14: 00007fd88b815fa0 R15: 00007ffe861b07b8 [ 854.807013][ T4399] [ 855.064965][ T4401] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.201087][ T4409] gretap0: entered promiscuous mode [ 855.378903][ T4401] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.576009][ T4401] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.707977][ T4432] nbd: socks must be embedded in a SOCK_ITEM attr [ 855.728318][ T4432] block nbd1: shutting down sockets [ 855.788991][ T4401] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.827193][ T4439] netlink: 'syz.0.9555': attribute type 3 has an invalid length. [ 855.924944][ T4439] syz_tun: entered allmulticast mode [ 855.970110][ T4439] siw: device registration error -23 [ 855.981013][ T4437] syz_tun: left allmulticast mode [ 856.036757][T24896] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.070251][T24896] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.123161][T24896] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.155139][ T4447] netlink: 'syz.1.9559': attribute type 2 has an invalid length. [ 856.189299][T24896] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.439882][ T4455] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 856.494101][ T4455] batman_adv: batadv0: Adding interface: gretap1 [ 856.507619][ T4455] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 856.540545][ T4476] __nla_validate_parse: 13 callbacks suppressed [ 856.540564][ T4476] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9567'. [ 856.565414][ T4476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9567'. [ 856.589837][ T4455] batman_adv: batadv0: Interface activated: gretap1 [ 856.628009][ T4471] netlink: 96 bytes leftover after parsing attributes in process `syz.1.9567'. [ 856.704402][ T4487] netlink: 64 bytes leftover after parsing attributes in process `syz.0.9570'. [ 856.977033][ T4482] syzkaller0: entered promiscuous mode [ 857.054434][ T4482] syzkaller0: entered allmulticast mode [ 857.352715][ T4476] netlink: 'syz.1.9567': attribute type 10 has an invalid length. [ 857.863076][ T4518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 859.889779][ T4476] veth0_vlan: left promiscuous mode [ 859.896196][ T4476] veth0_vlan: entered promiscuous mode [ 859.907208][ T4476] team0: Device veth0_vlan failed to register rx_handler [ 859.961077][ T4523] bridge0: port 2(bridge_slave_1) entered disabled state [ 859.981743][ T4523] bridge_slave_1: left allmulticast mode [ 859.987792][ T4523] bridge_slave_1: left promiscuous mode [ 859.993614][ T4523] bridge0: port 2(bridge_slave_1) entered disabled state [ 860.058556][ T4523] bridge_slave_1: entered promiscuous mode [ 860.065858][ T4523] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 860.093600][ T4530] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9585'. [ 860.104639][ T4529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9584'. [ 860.114483][ T4531] netlink: 64 bytes leftover after parsing attributes in process `syz.0.9583'. [ 860.704240][ T4561] netlink: 9 bytes leftover after parsing attributes in process `syz.2.9597'. [ 860.843247][ T4566] netlink: 64 bytes leftover after parsing attributes in process `syz.2.9599'. [ 861.466797][ T4581] syzkaller0: entered promiscuous mode [ 861.494770][ T4581] syzkaller0: entered allmulticast mode [ 861.496149][ T4582] IPVS: set_ctl: invalid protocol: 58 172.20.20.52:20001 [ 861.632427][ T4588] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.9607'. [ 861.710974][ T4591] netlink: 9 bytes leftover after parsing attributes in process `syz.1.9608'. [ 861.885907][T30416] IPVS: starting estimator thread 0... [ 861.914345][ T4600] vlan2: entered allmulticast mode [ 861.924146][ T4600] veth0_to_bond: entered allmulticast mode [ 861.950087][ T4600] team0: Port device vlan2 added [ 862.007861][ T4601] IPVS: using max 42 ests per chain, 100800 per kthread [ 862.018638][ T4605] gretap1: entered promiscuous mode [ 862.038117][ T4608] netlink: 'syz.3.9616': attribute type 1 has an invalid length. [ 862.118403][ T4608] 8021q: adding VLAN 0 to HW filter on device bond2 [ 862.146052][ T4608] bond2: (slave ip6gretap1): making interface the new active one [ 862.159787][ T4608] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 862.205912][ T4608] veth3: entered promiscuous mode [ 862.222081][ T4608] bond2: (slave veth3): Enslaving as an active interface with a down link [ 862.399977][ T4608] erspan0: entered allmulticast mode [ 862.446373][ T4608] bond2: (slave erspan0): Enslaving as an active interface with an up link [ 862.530419][ T4611] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 862.567812][ T4621] netlink: 'syz.4.9618': attribute type 16 has an invalid length. [ 862.585512][ T4621] netlink: 'syz.4.9618': attribute type 17 has an invalid length. [ 862.648872][ T4625] netlink: 64 bytes leftover after parsing attributes in process `syz.2.9621'. [ 862.677124][ T4620] bridge0: port 1(bridge_slave_0) entered disabled state [ 862.695215][ T4620] bridge0: port 2(bridge_slave_1) entered disabled state [ 862.847612][ T4621] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 862.983927][ T4645] netlink: 'syz.2.9629': attribute type 3 has an invalid length. [ 863.000532][ T4645] syz_tun: entered allmulticast mode [ 863.023091][ T4645] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9629'. [ 863.052616][ T4644] syz_tun: left allmulticast mode [ 863.224834][ T4657] netlink: 56 bytes leftover after parsing attributes in process `syz.4.9633'. [ 863.300787][ T4660] netlink: 830 bytes leftover after parsing attributes in process `syz.3.9634'. [ 863.542896][T24898] ------------[ cut here ]------------ [ 863.548927][T24898] conntrack cleanup blocked for 60s [ 863.548960][T24898] WARNING: net/netfilter/nf_conntrack_core.c:2512 at nf_conntrack_cleanup_net_list+0x234/0x340, CPU#0: kworker/u8:32/24898 [ 863.567954][T24898] Modules linked in: [ 863.572366][T24898] CPU: 0 UID: 0 PID: 24898 Comm: kworker/u8:32 Not tainted syzkaller #0 PREEMPT(full) [ 863.583454][T24898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 863.593659][T24898] Workqueue: netns cleanup_net [ 863.599442][T24898] RIP: 0010:nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.607585][T24898] Code: 08 48 89 df e8 6d ce 75 f8 4c 8b 3b 49 39 df 74 69 e8 a0 83 0d f8 45 31 e4 e9 8e fe ff ff e8 93 83 0d f8 48 8d 3d 6c 20 47 06 <67> 48 0f b9 3a eb c0 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fe ff [ 863.629030][T24898] RSP: 0018:ffffc90003f8f870 EFLAGS: 00010293 [ 863.635148][T24898] RAX: ffffffff89b6f36d RBX: ffffc90003f8fa00 RCX: ffff888024740000 [ 863.643377][T24898] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffff8ffe13e0 [ 863.651478][T24898] RBP: 0000000000000001 R08: ffff88805940a403 R09: 1ffff1100b281480 [ 863.659947][T24898] R10: dffffc0000000000 R11: ffffed100b281481 R12: 0000000000000001 [ 863.668031][T24898] R13: dffffc0000000000 R14: 000000010000db6b R15: 000000010000db6c [ 863.676030][T24898] FS: 0000000000000000(0000) GS:ffff8881256f3000(0000) knlGS:0000000000000000 [ 863.685073][T24898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 863.691746][T24898] CR2: 00007fbe08d7f000 CR3: 00000000aa998000 CR4: 00000000003526f0 [ 863.699849][T24898] Call Trace: [ 863.703154][T24898] [ 863.707277][T24898] ? __pfx_nf_conntrack_pernet_exit+0x10/0x10 [ 863.714359][T24898] ops_undo_list+0x52b/0x940 [ 863.719091][T24898] ? __pfx_ops_undo_list+0x10/0x10 [ 863.724241][T24898] ? do_raw_spin_unlock+0xf5/0x210 [ 863.729520][T24898] cleanup_net+0x4df/0x7b0 [ 863.733979][T24898] ? __pfx_cleanup_net+0x10/0x10 [ 863.740304][T24898] ? process_scheduled_works+0xa0f/0x17a0 [ 863.746537][T24898] ? process_scheduled_works+0xa0f/0x17a0 [ 863.752362][T24898] process_scheduled_works+0xaec/0x17a0 [ 863.758084][T24898] ? __pfx_process_scheduled_works+0x10/0x10 [ 863.764080][T24898] ? do_raw_spin_lock+0x12b/0x2f0 [ 863.769163][T24898] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 863.774556][T24898] ? schedule+0x90/0x360 [ 863.778927][T24898] worker_thread+0xda6/0x1360 [ 863.783650][T24898] ? __kthread_parkme+0x19c/0x1f0 [ 863.788840][T24898] kthread+0x726/0x8b0 [ 863.792948][T24898] ? __pfx_worker_thread+0x10/0x10 [ 863.798210][T24898] ? __pfx_kthread+0x10/0x10 [ 863.802833][T24898] ? _raw_spin_unlock_irq+0x23/0x50 [ 863.809236][T24898] ? __pfx_kthread+0x10/0x10 [ 863.813864][T24898] ret_from_fork+0x51b/0xa40 [ 863.819588][T24898] ? __pfx_ret_from_fork+0x10/0x10 [ 863.824747][T24898] ? __switch_to+0xc82/0x1410 [ 863.829587][T24898] ? __pfx_kthread+0x10/0x10 [ 863.834205][T24898] ret_from_fork_asm+0x1a/0x30 [ 863.839102][T24898] [ 863.842135][T24898] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 863.849428][T24898] CPU: 0 UID: 0 PID: 24898 Comm: kworker/u8:32 Not tainted syzkaller #0 PREEMPT(full) [ 863.859071][T24898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 863.869143][T24898] Workqueue: netns cleanup_net [ 863.873939][T24898] Call Trace: [ 863.877233][T24898] [ 863.880192][T24898] vpanic+0x1e0/0x670 [ 863.884236][T24898] panic+0xc5/0xd0 [ 863.887983][T24898] ? __pfx_panic+0x10/0x10 [ 863.892407][T24898] ? ret_from_fork_asm+0x1a/0x30 [ 863.897346][T24898] __warn+0x315/0x4a0 [ 863.901346][T24898] ? nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.907532][T24898] ? nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.913704][T24898] __report_bug+0x29a/0x540 [ 863.918216][T24898] ? nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.924399][T24898] ? __pfx___report_bug+0x10/0x10 [ 863.929561][T24898] ? nf_conntrack_cleanup_net_list+0x13e/0x340 [ 863.935743][T24898] report_bug_entry+0x19a/0x290 [ 863.940588][T24898] ? nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.946743][T24898] ? nf_conntrack_cleanup_net_list+0x239/0x340 [ 863.952894][T24898] handle_bug+0xca/0x200 [ 863.957145][T24898] exc_invalid_op+0x1a/0x50 [ 863.961653][T24898] asm_exc_invalid_op+0x1a/0x20 [ 863.966499][T24898] RIP: 0010:nf_conntrack_cleanup_net_list+0x234/0x340 [ 863.973259][T24898] Code: 08 48 89 df e8 6d ce 75 f8 4c 8b 3b 49 39 df 74 69 e8 a0 83 0d f8 45 31 e4 e9 8e fe ff ff e8 93 83 0d f8 48 8d 3d 6c 20 47 06 <67> 48 0f b9 3a eb c0 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fe ff [ 863.992859][T24898] RSP: 0018:ffffc90003f8f870 EFLAGS: 00010293 [ 863.998919][T24898] RAX: ffffffff89b6f36d RBX: ffffc90003f8fa00 RCX: ffff888024740000 [ 864.006883][T24898] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: ffffffff8ffe13e0 [ 864.014846][T24898] RBP: 0000000000000001 R08: ffff88805940a403 R09: 1ffff1100b281480 [ 864.022814][T24898] R10: dffffc0000000000 R11: ffffed100b281481 R12: 0000000000000001 [ 864.030780][T24898] R13: dffffc0000000000 R14: 000000010000db6b R15: 000000010000db6c [ 864.038753][T24898] ? nf_conntrack_cleanup_net_list+0x22d/0x340 [ 864.044922][T24898] ? __pfx_nf_conntrack_pernet_exit+0x10/0x10 [ 864.050982][T24898] ops_undo_list+0x52b/0x940 [ 864.055575][T24898] ? __pfx_ops_undo_list+0x10/0x10 [ 864.060691][T24898] ? do_raw_spin_unlock+0xf5/0x210 [ 864.065799][T24898] cleanup_net+0x4df/0x7b0 [ 864.070210][T24898] ? __pfx_cleanup_net+0x10/0x10 [ 864.075144][T24898] ? process_scheduled_works+0xa0f/0x17a0 [ 864.080857][T24898] ? process_scheduled_works+0xa0f/0x17a0 [ 864.086574][T24898] process_scheduled_works+0xaec/0x17a0 [ 864.092142][T24898] ? __pfx_process_scheduled_works+0x10/0x10 [ 864.098126][T24898] ? do_raw_spin_lock+0x12b/0x2f0 [ 864.103146][T24898] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 864.108511][T24898] ? schedule+0x90/0x360 [ 864.113193][T24898] worker_thread+0xda6/0x1360 [ 864.117915][T24898] ? __kthread_parkme+0x19c/0x1f0 [ 864.122940][T24898] kthread+0x726/0x8b0 [ 864.127007][T24898] ? __pfx_worker_thread+0x10/0x10 [ 864.132118][T24898] ? __pfx_kthread+0x10/0x10 [ 864.136709][T24898] ? _raw_spin_unlock_irq+0x23/0x50 [ 864.141898][T24898] ? __pfx_kthread+0x10/0x10 [ 864.146483][T24898] ret_from_fork+0x51b/0xa40 [ 864.151077][T24898] ? __pfx_ret_from_fork+0x10/0x10 [ 864.156193][T24898] ? __switch_to+0xc82/0x1410 [ 864.160872][T24898] ? __pfx_kthread+0x10/0x10 [ 864.165459][T24898] ret_from_fork_asm+0x1a/0x30 [ 864.170235][T24898] [ 864.173646][T24898] Kernel Offset: disabled [ 864.177959][T24898] Rebooting in 86400 seconds..