last executing test programs: 1.685544442s ago: executing program 1 (id=4665): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x0, @loopback}, @in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}], 0x2c) (rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000000a74000000060a09040000000000000000020000000900020073797a32000000000900010073797a300000350dd2f4000048000480440001800b000100657874686472000034000280080007400000000005000200000000000800034000000000080006400000000108000440000000000800054000000000140000001100010000000000000000000000000a0000000000000000"], 0x9c}}, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000580)=[@in6={0xa, 0x0, 0x0, @private0}], 0x1c) (async) r2 = socket$netlink(0x10, 0x3, 0x10) (async, rerun: 32) r3 = socket$nl_crypto(0x10, 0x3, 0x15) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x14, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6}]}]}]}, 0x7c}}, 0x0) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbff, 0x20000000}, 0xc) (async) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x20, 0x29, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0xc, 0xc, 0x0, 0x0, @u64=0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4000804) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) (rerun: 32) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x104, r6, 0x20, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xf}, @NL80211_ATTR_FRAME_MATCH={0xce, 0x5b, "5a0ea29f43e5685b32a0a05f098bcb3e15e6e0b0646c17f7c29f3a4ad3ea9fc3df2c598f9048486f077960aee16e79c31ae837a4a87171686f6f793744938fab58f89e1009cbfc5dab6d2835f6f8cd84460015a0e621ca4e32434798b7bbab551b8f5f9a7e5b0683286aa75a64b145954cba28ee86a355b6644cc9897fa45ca7cacb7bea2e2b617803b752b10005fe80611cba05b8e0629bd1b8e9150259cd26347818ebae6793889160aa75da7122bfae4f40f7a1f875b17e9826927221509b362cab759f3043c1d083"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xeb33}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x81}]}, 0x104}}, 0x880) 1.521305628s ago: executing program 0 (id=4667): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000340), 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newrule={0x30, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x80}, [@FRA_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @multicast1}}]}, 0x30}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)=@ipmr_newroute={0x24, 0x18, 0x8, 0x70bd2c, 0x92b7, {0x80, 0x0, 0x14, 0x6, 0xfc, 0x4, 0xfd, 0x2, 0x1d00}, [@RTA_DST={0x8, 0x1, @local}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4001) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000200)=[{0xac}, {0x6}]}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000d5ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000005e0001002abd7000fedbdb2500000000", @ANYRES32=r7, @ANYBLOB="0d13"], 0x1c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000004000000000000003b0000000085000000000000009500000000000000"], &(0x7f0000000a00)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, r5, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) 1.468949232s ago: executing program 1 (id=4670): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0xffffffffffffffff) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="bd838681401cc190000067f0ff0008000300", @ANYRES32=r3, @ANYBLOB="0800c300741300000800c400"], 0x30}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000005080)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, 'W'}]}], {0x14}}, 0x70}}, 0x0) 1.200855511s ago: executing program 0 (id=4671): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x58, 0x6, 0x6, 0x7f916aaf6e495bb0, 0x0, 0x0, {0x5, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20040000}, 0x8000) sendmsg$kcm(r0, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@map=r2, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000900)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) ppoll(0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000003700), r5) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000003880)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r5, &(0x7f0000003980)={0x0, 0x0, &(0x7f0000003940)={&(0x7f0000001080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002bbd7000fddbdf252500000005002b000200000005002a000000000008000200", @ANYRES32=r7, @ANYBLOB="630b11e044ce205299045d927ecd4cd59b75af369e817c7c7c4f264ea74bb7ee6e613c1eaa5495e3a9eeaa90843f68c30e004ccd30a26c48cfa0859aa8b15ed37b08da3f0367605cff83ada1c7d7751b00000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0xc5}, 0x10) recvmsg$kcm(r0, &(0x7f0000000600)={&(0x7f0000000180)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000000)=""/61, 0x3d}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000000200)=""/155, 0x9b}, {&(0x7f00000002c0)=""/187, 0xbb}, {&(0x7f0000000380)=""/122, 0x7a}, {&(0x7f0000000100)=""/57, 0x39}, {&(0x7f0000002940)=""/4096, 0x1000}, {&(0x7f0000000400)=""/81, 0x51}], 0x8, &(0x7f0000000500)=""/211, 0xd3}, 0x40002160) r8 = socket$kcm(0x10, 0x3, 0x10) r9 = socket$isdn(0x22, 0x3, 0x3) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000b40)=0x0, &(0x7f0000000b80)=0x4) r11 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d00)={&(0x7f0000000bc0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x44, 0x44, 0x5, [@ptr={0x7, 0x0, 0x0, 0x2, 0x4}, @ptr={0xc, 0x0, 0x0, 0x2, 0x1}, @const={0xb, 0x0, 0x0, 0xa, 0x3}, @int={0x0, 0x0, 0x0, 0x1, 0x0, 0x75, 0x0, 0xc, 0x2}, @var={0x9, 0x0, 0x0, 0xe, 0x1}]}, {0x0, [0x2e, 0x48, 0x61]}}, &(0x7f0000000c40)=""/143, 0x61, 0x8f, 0x1, 0xfffffffd}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000ec0)={0xffffffffffffffff, 0x20, &(0x7f0000000e80)={&(0x7f0000000dc0)=""/21, 0x15, 0x0, &(0x7f0000000e00)=""/120, 0x78}}, 0x10) r13 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000f00)={0x0, 0x4b, 0x18}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000fc0)={0xc, 0x19, &(0x7f0000000a40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x3, 0x1, 0x6, 0x2, 0x9, 0x100, 0xfffffffffffffff0}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffffa}, @func={0x85, 0x0, 0x1, 0x0, 0x7}, @ldst={0x1, 0x0, 0x1, 0xc, 0x6, 0x50, 0xfffffffffffffff1}, @map_fd={0x18, 0x7, 0x1, 0x0, r2}]}, &(0x7f00000008c0)='syzkaller\x00', 0x3, 0x73, &(0x7f0000000940)=""/115, 0x41000, 0x40, '\x00', r10, @fallback=0xc, r11, 0x8, &(0x7f0000000d40)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000d80)={0xfffffffd, 0x0, 0xe99, 0xfffffff8}, 0x10, r12, 0xffffffffffffffff, 0x1, &(0x7f0000000f40)=[r3, r13, r3], &(0x7f0000000f80)=[{0x1, 0x2, 0xf, 0x6}], 0x10, 0xd84a}, 0x94) sendto$isdn(r9, &(0x7f0000000780)={0x2, 0x7fff, "4add392f34b523eee8cad6ebdb8de7405cce90b0924d91911487e023e6162d66cbbb3ef5128d462391d100c1523f6eca412a9cc765f7fa9dec677723274d84fcde35f1f867455359cd98f1fba69f54ecd166c3484205d7f81b15598a58edab61f03f361f55079eb8477de3df14fb4b367193510635618bda4f4dd04a020751c099715afdb2b134e5d7d00f54e4a7bc229fc16c8cb0c87e92273808f95ad5fc3d865a785557aea24abce47a0fe636965b8e5f35355b4f7cfbb745a6af8a0fa3d523fa14f3ede54d7265cb022299f9dfeeaf593ee7eabe52685a7c331eb558b9"}, 0xe7, 0x40080, &(0x7f0000000880)={0x22, 0x0, 0x7, 0x7, 0x5}, 0x6) sendmsg$kcm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="1400000023000b6c8cfffdfccabb00f90429fc60", 0x14}], 0x1}, 0x20044080) 1.198674245s ago: executing program 1 (id=4672): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r0, &(0x7f00000005c0)=[{&(0x7f0000000080)='/', 0x1}], 0xe) (async) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB='-4'], 0xc) (async) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x27}, 0x74) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r4 = socket(0x10, 0x3, 0x0) (async) r5 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) (async) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000180)='`', 0xca, 0x0, &(0x7f0000000240)={0x3a, 0x0, r6, 0x1, 0x0, 0x6, @random="4a99fee2a74d"}, 0x14) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r9, @ANYBLOB="000000000000000010010c"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r4, &(0x7f0000000000), 0x400000000000235, 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaabe9689ce9f88080045b4daaf6e30000000019078ac1e0101ac1414aa031190780004ccce450600ff00670003e7330001ac1e0101ac1414aa"], 0x0) r10 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r11, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010026bd7000fddbdf251500000008000300", @ANYRES32=r13, @ANYBLOB='0\x00+'], 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x20000) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x4, &(0x7f00000000c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x8c}]}, &(0x7f00000001c0)='GPL\x00'}, 0x94) 1.197167818s ago: executing program 2 (id=4674): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xb8}}, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket(0x840000000002, 0x3, 0xfa) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x48, &(0x7f0000000080)={0xa, 0x0}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7c, 0x7c, 0x2, [@var, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0x800000}, {0x2}, {}, {0x0, 0x3}, {0x1}, {}]}, @fwd, @volatile={0x3}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}, @volatile={0x0, 0x0, 0x0, 0x9, 0x1}]}}, 0x0, 0x96}, 0x28) (async) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f00000006c0)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit, @exit, @jmp={0x5, 0x0, 0x9, 0x7, 0x9, 0x100, 0x1}]}, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0xffffffff}, 0x10}, 0x94) sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x300, 0x70bd29, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c084}, 0x0) (async) connect$pppl2tp(r3, &(0x7f0000000600)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x0, 0x2, 0x4, 0x2, {0xa, 0x4e22, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}}}, 0x32) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x5, @mcast2, 0x7f}, 0x1c) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) getsockopt$IP6T_SO_GET_INFO(r5, 0x29, 0xb, 0x0, &(0x7f0000000080)=0x1a) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01000000000000000000100000001800018014000200776c616e310000000000000000000000080006000300000008000700f3"], 0x3c}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f00000011c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r9, &(0x7f0000001280)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x24, r10, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x48000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r9, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000005c0)={0x30, r10, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000800}, 0x44000) (async) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000200), r8) sendmsg$NLBL_MGMT_C_ADDDEF(r8, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r12, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x27}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x9}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x8000) 1.089806941s ago: executing program 3 (id=4676): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x2, @broadcast}}, 0x1e) r2 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r2, 0x6b, 0x20, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={0x0, 0x1, 0x80000001, 0x8}, 0x10) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendto$inet6(r3, &(0x7f0000000080)="d32e0cbb94370000000000000048f562f535ab6c", 0x14, 0x0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @remote, 0x10000001}, 0x1c) 1.077047531s ago: executing program 4 (id=4677): ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'gretap0\x00', 0x0, 0x7, 0x8, 0xe48, 0x100, {{0x11, 0x4, 0x3, 0x2, 0x44, 0x64, 0x0, 0x8, 0x0, 0x0, @empty, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x6f, 0x3, 0x1, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xff}]}, @timestamp_prespec={0x44, 0x24, 0x40, 0x3, 0xa, [{@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x1}, {@empty, 0xb7be}, {@broadcast, 0x2}]}]}}}}}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x74, &(0x7f00000000c0)={r5, 0x6e4, 0x10, 0x6, 0xb1aa}, &(0x7f0000000040)=0x18) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100"], 0x38}}, 0x0) 992.144743ms ago: executing program 2 (id=4678): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000001d00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c80)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x4000040) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x15}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x44}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)={0x80, 0x0, 0x2, 0x401, 0x0, 0x0, {0x2}, [@CTA_EXPECT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASK={0x24, 0x3, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x80}}, 0x0) 884.65983ms ago: executing program 4 (id=4679): r0 = socket$nl_crypto(0x10, 0x3, 0x15) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@getstat={0xe0, 0x15, 0x200, 0x70bd2b, 0x25dfdbfc, {{'gcm(aes-aesni)\x00'}, '\x00', '\x00', 0x0, 0x2000}, ["", "", "", "", "", "", "", "", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x20004850}, 0x4c085) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000002c0)={0xe0, 0x11, 0x509, 0x0, 0x0, "", [@generic="113c2d9b38402aff6ec2f31166d97833f0f8ac30073eff5aaa90ef4e67d4d71828ded4e460d643d5fe600b15cafc4e6367740fd939728fe10c222557a0e48cc54ad5fdfc9d96eab83adb23e6ea0e30003b415709fe9e9350a9b902a2fb292a57b89faa24ff367c2ce45b80daa96489871ba8845ef4d57736723c2ec516cbbcde6afb99d265f81bc4e9", @generic="1847a803d02973685ab61f218a66b934b7160571e984e5f5d6ad7eff4305326d0affb35c79b457adbe3f0bf08fc949402f059090cf6bf0007718a6968a12e721a9f1fa73"]}, 0xe0}], 0x1}, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) (async) socket$nl_crypto(0x10, 0x3, 0x15) (async) sendmsg$nl_crypto(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)=@getstat={0xe0, 0x15, 0x200, 0x70bd2b, 0x25dfdbfc, {{'gcm(aes-aesni)\x00'}, '\x00', '\x00', 0x0, 0x2000}, ["", "", "", "", "", "", "", "", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x20004850}, 0x4c085) (async) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000002c0)={0xe0, 0x11, 0x509, 0x0, 0x0, "", [@generic="113c2d9b38402aff6ec2f31166d97833f0f8ac30073eff5aaa90ef4e67d4d71828ded4e460d643d5fe600b15cafc4e6367740fd939728fe10c222557a0e48cc54ad5fdfc9d96eab83adb23e6ea0e30003b415709fe9e9350a9b902a2fb292a57b89faa24ff367c2ce45b80daa96489871ba8845ef4d57736723c2ec516cbbcde6afb99d265f81bc4e9", @generic="1847a803d02973685ab61f218a66b934b7160571e984e5f5d6ad7eff4305326d0affb35c79b457adbe3f0bf08fc949402f059090cf6bf0007718a6968a12e721a9f1fa73"]}, 0xe0}], 0x1}, 0x0) (async) 872.824454ms ago: executing program 3 (id=4680): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xd762a06931ea442}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x9, 0x801, 0x0, 0x0, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x2400c814}, 0x8000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="9b7c2af93f6cdb9766a1c2dcef3b1966bb99234234fd2389fb0c749793d54c5e2fb65e7304b5830ce801f19a721203514d4668fa4fb72fc912430eed675c7ad090ec77a1284d070fafa767e92fae"], 0xc4}, 0x1, 0x0, 0x0, 0x1}, 0x0) 793.231104ms ago: executing program 1 (id=4681): socket(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r4, 0x400452c9, &(0x7f0000000100)) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@mpls_delroute={0xa0, 0x19, 0x1, 0x0, 0x1, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_NEWDST={0x84, 0x13, [{0x3ff}, {0x5}, {}, {0x2, 0x0, 0x1}, {0x6}, {0x4, 0x0, 0x1}, {0x2}, {0x1fdc}, {0xff, 0x0, 0x1}, {0xfff, 0x0, 0x1}, {}, {0x9, 0x0, 0x1}, {0x5f5}, {0x7, 0x0, 0x1}, {0xffffc, 0x0, 0x1}, {0x101, 0x0, 0x1}, {0x4}, {0x4, 0x0, 0x1}, {0xe}, {0xe2}, {0x1, 0x0, 0x1}, {0x2}, {0x101, 0x0, 0x1}, {0x1000}, {0xf30b}, {0xe1e3, 0x0, 0x1}, {0x1}, {0xffc00, 0x0, 0x1}, {0x40, 0x0, 0x1}, {0x2}, {0xf2e}, {0x5, 0x0, 0x1}]}]}, 0xa0}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000700)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1b400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e23}]}}}]}, 0x3c}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r6, 0x0, 0xb, &(0x7f0000000000)=0x1ff, 0x4) sendto$inet(r6, 0x0, 0xffef, 0x20000000, &(0x7f0000000240)={0x2, 0x4e22, @remote}, 0x10) recvmmsg(r6, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}], 0x1, 0x12061, 0x0) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x76, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x98}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f00000003c0)={'erspan0\x00', 0x0}) ioctl$sock_rose_SIOCRSCLRRT(r7, 0x89e4) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000440)="0b032212e0ff05000200", 0xa, 0x0, &(0x7f0000000180)={0x11, 0x9, r9}, 0x14) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x42072, 0xffffffffffffffff, 0x0) splice(r0, 0x0, r1, &(0x7f00000002c0), 0x6, 0x2) socket(0x10, 0x3, 0x0) r10 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r10, 0x5201) ioctl$RFKILL_IOCTL_NOINPUT(r10, 0x5201) 792.210466ms ago: executing program 2 (id=4682): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) close(r1) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4, 0x0, @mcast1={0xff, 0x7}, 0x8a4}}, {{0xa, 0x4e20, 0xfe, @remote}}}, 0x108) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000440)={'syz_tun\x00', 0x101}) accept4(r0, &(0x7f0000000080)=@l2={0x1f, 0x0, @fixed}, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002900010000000100fcdbdf25030100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5ead3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734351dc076eb43d9621dc08c02"], 0x114}], 0x1, 0x0, 0x0, 0x891}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) socket(0x80000000000000a, 0x2, 0x0) (async) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) (async) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) (async) close(r1) (async) socket(0x80000000000000a, 0x2, 0x0) (async) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4, 0x0, @mcast1={0xff, 0x7}, 0x8a4}}, {{0xa, 0x4e20, 0xfe, @remote}}}, 0x108) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000440)={'syz_tun\x00', 0x101}) (async) accept4(r0, &(0x7f0000000080)=@l2={0x1f, 0x0, @fixed}, 0x0, 0x0) (async) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002900010000000100fcdbdf25030100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5ead3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734351dc076eb43d9621dc08c02"], 0x114}], 0x1, 0x0, 0x0, 0x891}, 0x0) (async) 735.903759ms ago: executing program 3 (id=4683): r0 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000200)="4647b4f310d036b398bd576db787e7b4202ee128ae26c942fc41e537802686e83e6a0af1563bf3b021ec13c349eb6c1ed386de2085218c1cc9fb2decdb2a5f89154999df0aeebf9b9c41add84afb988eeb8fee205f4c", 0x56}, {&(0x7f0000000280)="af4c42680bee64c57b0c7748a3924e8e5599e0238057", 0x16}, {&(0x7f0000000140)="d6f12351876d5702fb64018cc67dcb307616eafb60", 0x15}], 0x3) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x7, 0x10012, r2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @remote}, 0x0, 0x2, 0x3, 0x4}}, 0x26) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r4, 0x100, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7f, 0x5a}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r5}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x60}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x800) (async) ioctl$PPPIOCGMRU(r0, 0x80047453, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2800000011140100000000000000000008004a000000000008000100000057cb0010640127660000"], 0x28}}, 0x0) 704.573019ms ago: executing program 4 (id=4684): r0 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000c40)="174f0309acc581c27c0835a541d5ace14751a6fb5991e1eabe613766930c5209d76188595688370a8db8878df98ad326d683f46b7b423a4583c043d396d52fafd67bbd19f7e86b03f0890da3e3e1ac30139e27351572c4c42e96f4dec4c0c9d710f16af63cc306aa379bad5c6e7ef0f71776f0abdddb9ba606e921bcb3ac6bbea2ab3a0823b23088bc5e39310f040dacfd595b4675421c0046d89f2840d233d1034173a0fe91900d926e8d3a481c32b4f6079741d13e2ebb782090c8f38a9daebb1dea84e78c216cd7f9f10bf4b35158e3b36df0c4e9e74b585fc66f7b1fe5305f073f6de409973543e731424ab0605f2f4dfd7efe495ea426a69b13b27b7497895984a1502bac0855ad2bb86e88efdd6c976bbd1cc04dc6b4e8d579f1aecdf38461db91d3661703dec17b9a22d66299cacd23fb463dbb3fd7d59674fa4c5ec8b36422965f55ae455ef5051d029fe657b3f6c79a2bbfe60b0d64870d4ca793ebf5054a40157f0c78c3337cb131700670bc7dfa1cfddb8eb2d85b97c56339f45c4ee490d259121cdccf7be5bbc0ab7a375d931c0365c9809756d4491c866161833663e49a310df546ed981572ca40e40faea56bb05216b3390d807f756db218749a1c9a1ee817b9e5e6a00ca98e185cd6f690cc9e9d1567788e572378f11f688d8133c58b727ae51f95787f7f9952b32ed1494ea7e55f21baea3c9edb8b4523bbef158c8c239d4a54faa5996eb1f3f1c06acf8cd273e298e44b5642b8a50369b152a67932f48bed55c1c01d9a0ad6b2a3540e753c16e3054d483baad028fe42b4e5ebe562b6350c3a093f7456dde046258b8bfe19494d19a66809b612ba8deefea6b7007460ad826313420ac8e3f889da3c9b01a3d1f76acbdafb990fbe8479ded245d750a534e61b6b5fe9914f3760cbe0434f0b1593579f9d124e7c90ef5a50b21aad14ecd0cd712164782cfd329175225d99f90df6d123dde263d9329317f501199ba87458c0ead4baddeef35da92fea8ac878fa84bebfce075cbf56fad7fe823198ef50ce9e24d6c888337cfecb65e6dc7a3bce8f7b2cf734a1bf52cc24b77045e94c39756cb4287777e6f7bdfa19c387565dcb5258c3758a6d8cf94fa2adde5454735f944f6fde3c61376bf65c4c65bf973e1bdcd646b5883098b9f00712ab947b5a45ae1949357a7ef580895e7201e36ae4ab14da32e0a55327d25278d07e102c4e45f6566f5394c2259baa6b5b9511751c35ad74364be8bcfb77b0eb0d3c182dd50ae9fa498d5595bce5201d43acf6411e8e6074bdf001d4e4ddae00133002d9af61c3d9b594a230511c77460e477ab5d9d3d2dbdad6a971c4d4911d877a6d9eae79196e95565994954a3904d473fb369983020b99466c804127e8baf8147b5d228a17608d3ab4c31c6ad03135929e35feb8d166f5f820e40f94dd8102c9ca76ac48c3d668b00ca76cff37dcd35ddbf63b62ecaf7934a8ede4980f3294365ea63f7584373f638134fba55526983dabf2f189c70ddec701b55256d383dd802b4b09b801fb6cbe3408c9eb6d1fd85bf93b60b966680485d4550a3aa3454d888d6f8e81f669d4d87914041ac313e39f0ae29f31dedba1c5964c6729045cbd010e4469a7220335f76983c7d22a53401cb25444b9103643843726bdbb28d4032f9258f8539b9a7dfd6558b2c524d38c9e2e1c23fd7a6a42bf4bb5ebdf0b75ecc547ef15865536ee1de07155bc5e6b5a227c1170a6e4e44991f0685219c417d7194a4cdbce6a1e76f830fdd07887b49a3b648772b6e1b6fda08931540cc521e44f3fb221ce86438759704ce2422653a35f62c483a21ae6b34b14e6d900172dddecf8846a9423d784341296e141423f1c1efed6a0c334430647c0408af67c54a8cad69a43bf28ebe4a650343151223969bafa661999342df2a160f45b950f258f1e444575d6251a917bfcbb4dc834bd08d4deeb3be0dabade5f46060e54bc71f137f47e42", 0x584}, {&(0x7f0000000140)="f40fde5062dbb824c2fd6304c0ee9ea6009993b3cf258e9f2503798b8c5451f24844e470938678bdcdc9767540ca85453a80c5a6adf1f3024d2b74c1efbc0cf8f1bc06c5871f41b914f715e8a8e4dbb0ac3022a224b50b9d1502c19f3079abbbeef5e96b19d0e60c9e3964f00293", 0x6e}], 0x2, &(0x7f0000001dc0)}, 0x4) 625.151687ms ago: executing program 0 (id=4685): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x7, 0x1, 0x4, 0x6, {{0x8, 0x4, 0x3, 0x27, 0x20, 0x68, 0x0, 0xe, 0x4, 0x0, @private=0xa010100, @multicast2, {[@timestamp_addr={0x44, 0xc, 0x4d, 0x1, 0x0, [{@private=0xa010102, 0x8}]}]}}}}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r5}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=@deltfilter={0x900, 0x2d, 0x200, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x10, 0xffe0}, {0x2, 0xd}, {0xf, 0xf}}, [@TCA_RATE={0x6, 0x5, {0x3, 0x6d}}, @TCA_RATE={0x6, 0x5, {0x58, 0x10}}, @TCA_RATE={0x6, 0x5, {0x87, 0x9}}, @filter_kind_options=@f_bpf={{0x8}, {0x28, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_POLICE={0x18, 0x2, [@TCA_POLICE_RATE64={0xc}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}]}]}}, @TCA_RATE={0x6, 0x5, {0xff, 0x2}}, @TCA_RATE={0x6, 0x5, {0x4, 0x8}}, @TCA_RATE={0x6, 0x5, {0x2, 0xb}}, @filter_kind_options=@f_flow={{0x9}, {0x860, 0x2, [@TCA_FLOW_MODE={0x8}, @TCA_FLOW_POLICE={0x854, 0xa, 0x0, 0x1, [@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x20000000, 0x800, 0x2, 0xd2fc, {0x2, 0x0, 0x4, 0x6, 0x1000, 0x3}, {0x7, 0x0, 0x9, 0x8, 0x4b52, 0xc}, 0x101, 0x3d, 0x5}}, @TCA_POLICE_RATE={0x404, 0x2, [0x1a16, 0x8, 0x7fff, 0x1, 0xffffffff, 0x7, 0x3ff, 0x10001, 0xe917, 0x6, 0x34000, 0x68, 0x10000, 0x2fab, 0x1, 0xd7, 0x0, 0xa25, 0x40d7, 0x5, 0x10000, 0xfff, 0xdad4, 0xfffffffc, 0x5, 0x8, 0x9, 0x2, 0x8, 0x6d, 0x80000000, 0x2, 0x7, 0x3, 0x4, 0x7fffffff, 0x3, 0x200, 0xd0a, 0x8, 0x1, 0x30, 0x7, 0x8, 0x2, 0x5, 0x3, 0xffff, 0x5, 0x0, 0x9, 0xb0, 0x9, 0x4, 0x9, 0x7fff, 0x4, 0x8, 0x720, 0xf, 0x9, 0x57b, 0x7fffffff, 0x2, 0x2, 0x2, 0xfa2, 0x701, 0x4, 0x9, 0x57, 0x76b, 0x7, 0x631, 0x3, 0x7ff, 0x8, 0x0, 0x7, 0x400, 0x1, 0x5, 0xffff, 0x7, 0x80, 0x5, 0x6, 0x0, 0x9, 0x2, 0x9, 0x7, 0x2, 0x7, 0x206, 0x2, 0x6, 0xff, 0x7fff, 0x8, 0x3dd, 0x3, 0x8000, 0x0, 0xb, 0x55711a3a, 0x6, 0x9, 0x1, 0x5, 0x6f, 0x4, 0x6a37, 0x1, 0xfff, 0x8001, 0x81, 0x80, 0x3, 0xffffffff, 0x9, 0x3, 0xb, 0x2, 0x3, 0x0, 0xd, 0x1, 0x9, 0x6, 0x10001, 0xfffffa62, 0x2, 0x2, 0x2, 0x0, 0x86, 0x7, 0x4, 0x8000, 0x0, 0x70, 0x6, 0x9, 0x1, 0x5, 0x6, 0x2, 0x100, 0x1137, 0x2, 0x6, 0xf61, 0x80000000, 0xb, 0x7, 0x8, 0x10, 0x80000001, 0x4, 0xe, 0x8, 0x7, 0x2, 0x1, 0x8, 0xf245, 0x800, 0x3, 0x4, 0x2b4, 0x101, 0xfff, 0xffff, 0xb34, 0x6d9d, 0x8, 0x3, 0x9, 0x7, 0x9, 0x4, 0x4, 0x4, 0x9, 0x0, 0xec, 0x7, 0x7, 0x3, 0x1, 0x5, 0x9, 0x10, 0x40, 0xffff7fff, 0x7ff, 0xfffffffb, 0x8, 0x4, 0x100000, 0x3, 0x3b, 0x7, 0xd, 0x3, 0x400, 0x7, 0x3, 0x8, 0x3, 0xb, 0x0, 0x0, 0x1, 0x7, 0x4, 0x3, 0x361d, 0x35ca18f2, 0x7ff, 0x1000, 0xb6, 0x648, 0x1000, 0x0, 0x8e61, 0xffff8001, 0x0, 0x3, 0x4, 0x8, 0x5, 0x9, 0x0, 0x5, 0x9, 0x81, 0xd47, 0x5, 0x80000000, 0x6, 0x4, 0x6, 0x6, 0x4, 0x3, 0x4, 0xff, 0xb62, 0x9, 0x5, 0x1, 0x80, 0x7, 0xcc3]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x2}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x400, 0x1, 0x95, 0xffff, 0x101, 0x1, 0x1067, 0x1, 0x3, 0x80, 0x9, 0x8, 0x7, 0x5de4, 0x2, 0x400, 0x0, 0x9, 0x2, 0x6, 0x6fe, 0xba, 0x9, 0x1, 0x7, 0x3ff, 0xff, 0x9, 0x3, 0x6, 0x42e, 0x7, 0x6, 0x0, 0x662b, 0xc, 0x0, 0x9, 0x100, 0x4, 0x3, 0x2, 0x7f, 0x1, 0x7, 0xfffffffb, 0x4, 0x3, 0x2, 0x7, 0xc, 0x57, 0xec, 0x10, 0xd, 0xe, 0xff, 0xf, 0xcc, 0x2, 0x9, 0x7, 0xfffffffb, 0x8, 0x6, 0x7, 0x200, 0x100, 0x17, 0x5, 0x8, 0x81, 0x4000000, 0x6, 0x7f, 0x6, 0x4, 0xfff, 0x7f, 0xffff, 0x8a4, 0x6, 0xc3, 0x9, 0xc8, 0x1, 0x1, 0x7, 0x6, 0x7, 0x6, 0xe14, 0x1, 0x7fff, 0x486, 0x9, 0x5, 0x7, 0xe, 0x6, 0xfffffff8, 0x8, 0x5, 0x7fff, 0xfff, 0x9, 0x6, 0x4, 0x0, 0x32, 0xa42, 0x86, 0x5, 0x80000001, 0x4, 0x4, 0x8f0, 0x101, 0x81, 0x9, 0x8, 0xc4, 0x4, 0x2, 0x2, 0x4, 0x3, 0x0, 0x5, 0x7, 0x4, 0x5, 0x7a7a, 0x40, 0xc3e6, 0x0, 0x1, 0x4329, 0x7f, 0x8, 0x5ff0, 0xc, 0x4, 0x80000000, 0xfffffff7, 0x10001, 0x8, 0xdf, 0x0, 0x20, 0x7, 0xffff, 0xba, 0x0, 0x80000000, 0x8, 0x4, 0x10001, 0x6, 0xfffffff8, 0xb96, 0x9b9, 0x8, 0x6e, 0xfffffffd, 0x3, 0xb, 0x100, 0x6, 0x3, 0x5, 0x9, 0x10, 0x2, 0x7, 0x9, 0x32c5, 0x9, 0x1934423, 0xff, 0x6, 0x6, 0x80000001, 0x200, 0x87, 0x0, 0x3, 0x3, 0xffff299c, 0x4, 0x49ee, 0xfffffff8, 0x7f, 0x2, 0xf, 0x4, 0x0, 0x1, 0x2, 0x0, 0x6, 0x6, 0x49, 0x6, 0x9, 0x0, 0x3, 0x8001, 0x9, 0x100, 0x7fffffff, 0x5, 0xada, 0x1, 0x3, 0x9, 0x2, 0xffffffff, 0x2, 0x31c, 0x3, 0x2, 0x80000001, 0xf, 0x24c4d94, 0x6, 0x7, 0x400, 0x3, 0xfff, 0x6, 0x0, 0x400, 0x6, 0x7fff, 0x800, 0x8, 0x25e, 0xb202, 0x2, 0x200, 0x6, 0x30000000, 0x9, 0x100, 0xd5d4, 0x4, 0x8, 0x7, 0x9, 0x6, 0x8001, 0x3, 0x2, 0x6e6]}]}]}}, @TCA_RATE={0x6, 0x5, {0x7f, 0x4}}, @TCA_RATE={0x6, 0x5, {0x9, 0x4}}]}, 0x900}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000007c0)=ANY=[@ANYBLOB="7800000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800b00010067656e65766500002000028014000700fe8000000000000000000000000000bb080001000100000004001a80140014007465616d300000000000000000000000080004"], 0x78}}, 0x0) 621.035952ms ago: executing program 2 (id=4686): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x64}}, 0x4800) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0x0, 0x2}, 0x95) socket$unix(0x1, 0x5, 0x0) (async) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYRESOCT=r0], 0x2c}, 0x1, 0x0, 0x0, 0x28000000}, 0x2000c010) 577.570129ms ago: executing program 4 (id=4687): r0 = socket(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000060a0b040000000000000000020000000900020073797a32000000006c000480680001800b00010074617267657400005800028040000300cd4b6abe42030763d02899c7e9ee2bcc9b6a37b458a8056dd9a87f963d140d7a9d3ac869f3a860917523c7000000000000006422a633a39f030000000a000100484d41524b00000008000240000000000900010073797a30"], 0xc0}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0xfffffffffffffe5e, 0x2, {{0x2, [0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1000]}, [@TCA_MQPRIO_MAX_RATE64={0x4}]}}}]}, 0x8c}}, 0x20000000) 521.473079ms ago: executing program 1 (id=4688): bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={0x1, 0x58, &(0x7f0000000140)}, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffe04, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0xec}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c00000052000100000000000000000002"], 0x1c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x80000001, 0x277, 0x100}}]}]}, @IFLA_GROUP={0x8}]}, 0x40}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000002000010000000000000000000a000080ffffffffffff0000140011"], 0x30}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="940000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0300000000000000640012800b0001006970366772650000540002800800150061db0a0008000100", @ANYRES32, @ANYBLOB="14000700fe8000000000000000000000000000aa08000d005fe1ffff060010004e22000008000500200c000014000600fc"], 0x94}}, 0x0) r4 = socket(0x10, 0x3, 0x6) r5 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0xfffffffffffffe5e, 0x2, {{0x2, [0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1000]}, [@TCA_MQPRIO_MAX_RATE64={0x4}]}}}]}, 0x8c}}, 0x20000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb01c010d84c81d639e200180000001800000007000000050000000100000f000000010d0000000400000000000001005f0000006100"], 0x0, 0x37, 0x0, 0xa}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000440)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff00003506000002000000170600000ee5e50cbf250000000000001f650000000000007507000002000000170700004c0001000f75000000000000bf54000000000000070400000400f9ff2d3501000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c45402000000a2d23da04d1ffc187fa1a2ba7ba030c7267c2de00435fd233cc0f0d9b2c3127c46b0f408398d09ee4dc258d726eae098804ce25df627a64ac7efde50fd7f1dd5b17ed764c33b06598bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d47dc570a385a459ef8e6ada84e987cc0000f6991078a21788cab9d53ad890206ab56506ab08b294c09ea4536e0b9bb0627a03a1eb9cbe6958812a98abad49f42a6fb2b69c0880548c39f13f4cca63a87ad7ff8d1006cc6d95e406deb61b9c7ac3f35f1fdb27e70900001fd13d4a22fc90e5f7300c53f2b6e7e001058dc04b434e379fd5526b52990b04b183c21e6b974a4bf85567348c6c6a4404d987f71d81fe988ddc82dac01bbb43e006203a31b02f9519ffb29cd3508d7da829712c98381a672db9fa6a8eb38d784c913a804557c4577a22acb7b73c4aa0e07998734fdfbb0d262ef88b3b8cd1a8518dd8326f6367ed938a05c108cf2639e8799fd7cb018f08453fa863f8fb8178569d26a0a48e4498f88d15abbb22d955a162ac1fd3710c1255fbe3c6d1e84152c81ec0192e54d13dc5beebe3de27967e5d1aa8a6139056e3fb738d0ca46b0a1c63a29002e5b12314390ca075ecb43e0c6cd5af64c8b676316b9bff845ea0b20562f53c5b34314411bf3d4af06bdc3def9f2791d6d076ca72e319e6a9e1098bab878a9f1274a61ddee47abb54d8cf901e78bdb85f47ef37dd0daeb6403820ee8414042904917ea1b80a0000000000004c84018fd19fb3581ca1ff9fb5758d76929ec0502802869c51511c2c9dc56ead1449c038e4d2382d6ef61a7d9399cb"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0xffffffffffffffa6, 0x0, 0xffffffffffffffff, 0x60}, 0x48) sendmsg$nl_route(r1, &(0x7f0000000d40)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)=@ipv6_getrule={0x1c, 0x22, 0x4, 0x70bd28, 0x2, {0xa, 0x80, 0x14, 0x1, 0xcd, 0x0, 0x0, 0x7, 0x11}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x80420c1) 519.409831ms ago: executing program 3 (id=4689): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0xfffffffb, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000001c0)}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000005c0)={'sit0\x00', &(0x7f0000000500)={'ip_vti0\x00', 0x0, 0x0, 0x700, 0x8, 0x7, {{0x28, 0x4, 0x2, 0x3e, 0xa0, 0x66, 0x0, 0x4, 0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x41}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x1b, 0x84, [@broadcast, @multicast2, @broadcast, @broadcast, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0x24, 0x9d, 0x1, 0x6, [{@loopback, 0x6}, {@dev={0xac, 0x14, 0x14, 0x18}, 0x2e2f}, {@empty, 0x7}, {@rand_addr=0x64010101, 0xff}]}, @generic={0x83, 0x7, "994e3acde9"}, @rr={0x7, 0xb, 0xb4, [@dev={0xac, 0x14, 0x14, 0x10}, @broadcast]}, @ssrr={0x89, 0x7, 0xc2, [@dev={0xac, 0x14, 0x14, 0x2a}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x2c, 0xe8, 0x1, 0x6, [{@multicast1, 0x80}, {@rand_addr=0x64010102, 0x6}, {@local, 0xa}, {@local, 0x10000}, {@rand_addr=0x64010101, 0x9}]}]}}}}}) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000600)=0xffffffffffffffff, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{0x1, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)}, 0x20) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3f, 0x38, 0x65, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, @time_exceeded={0x5, 0xea452954ff7d0934, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @empty, @loopback}, "001863718e9bf703"}}}}}, 0x0) write(r5, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000500000000000000050008000d000000", 0x24) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000780)='cgroup.controllers\x00', 0x0, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000008c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)='%ps \x00'}, 0x20) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x12, r9, 0x1f4d2000) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000900)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x2}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000980)={0x1, 0xffffffffffffffff}, 0x4) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ac0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000a40), &(0x7f0000000a80)}, 0x20) r14 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r14, 0x107, 0xe, &(0x7f0000000000)=0x1662cd33, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c00)={0x11, 0x15, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@alu={0x7, 0x0, 0x3, 0x6, 0x7, 0x8, 0x1}, @map_val={0x18, 0x6, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0xa}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='GPL\x00', 0x7f, 0xed, &(0x7f0000000400)=""/237, 0x40f00, 0x20, '\x00', r2, 0x0, r3, 0x8, &(0x7f0000000640)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000680)={0x2, 0xa, 0xffffffc9, 0xe}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000b00)=[r4, r6, r7, r8, r9, r10, r11, r12, r13], &(0x7f0000000b40)=[{0x4, 0x1, 0x3, 0x3}, {0x3, 0x4, 0x2, 0x7}, {0x3, 0x1, 0x0, 0x2}, {0x3, 0x3, 0x8, 0xb}, {0x3, 0x1, 0x9}, {0x2, 0x3, 0x10, 0xa}, {0x2, 0x2, 0x0, 0x4}, {0x2, 0x4, 0x2, 0xc}, {0x3, 0x5, 0xa, 0xb}], 0x10, 0x1ff}, 0x94) r15 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7020000140000007b030000000000008500000083000000790900000000000055090100000000009500000000000000bf91000000000000b70200000200000b8500000069000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r16 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r16, 0x8933, &(0x7f0000000300)={'vxcan0\x00', 0x0}) connect$can_bcm(r16, &(0x7f0000000080)={0x1d, r17}, 0xb) sendmsg$can_bcm(r16, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=r16, @ANYRES64, @ANYBLOB="000000000100000000000000840004"], 0x48}, 0x1, 0x0, 0x0, 0x400c011}, 0x0) r18 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r18, &(0x7f0000000000)={0x18, 0x0, {0x2, @local, 'nicvf0\x00'}}, 0x1e) 483.68438ms ago: executing program 2 (id=4690): syz_emit_ethernet(0xd2, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd60fc0600009c1100fe80000000000000005b9cb928000000000000bbff020000000000000000000000f7ff0000000e22009c907801000000010000008742fe4687d86e5da82e41ef2302058dc3b5674f0000ec494011ccec4f7d012cf2760709a418c2d54dfc3bcd6b0dc0f026e4dbbd0fc37c4cf9e05eebedd14ed77e5af90f021be4d1922cd5279600538f9cd204eeecae9a729ee1662af2f006faf435c215365df6e6c5db8235aeb6eb691496126a2d28d73f1a738b14fc81aa717bf9ce692ed96249827491df61a5e598bf7ab123042496dbcfea25c58c5122ce5684f54c4061d6c9be9a641698c6526dd92076add428909d2cbfb447335cacf0d7854669b7e7ed327f5cbebc4bba025f08c89e0a1a30e22cba4164dad625968080b9e29f02bd1302ab4d04f6dbbbb0adb437b8b09541f621f406a34fac7694069cac6fb6e4a9658e5b88d0cd76e157c9b8d2e0df6cffac985622881daf049f49f878e79bd94ee73b5c2776abee43175214ff8f523ca2c70b58892a561ea5e41510e454158d7d071f8dd75046a1fbc439c73cabc04ca9698dfd86b2ebc7bb847e5832dcb789d0d7587dadde6c7004ae23deae93c8453c20248982ff8ac0b77634480a4516d184d1741d20bbeb765d6fcf18311714c3bfc75d45d7a734b5580d7632c574adc0e6ad21a19fda4c45aa43d4a9016ab3289569febfa3e005348c2014af4404facaebe0eb247f22b12c501774d55abc29f6328a4a3c3aaff94ccf9cfadf9e3e31703e33fd3d50ebda26243ca00cfb"], 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r0}) getsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000340), 0x4) 345.148384ms ago: executing program 2 (id=4691): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000180)={r0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x11, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000012002927000000000000000028001a00e0000001000000000000000000000000fe8000000000000000060000000000000000ef00"], 0x38}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00U\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32, @ANYBLOB="050001"], 0x38}}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, r6, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4000001) accept(r4, 0x0, &(0x7f0000000000)) 269.449471ms ago: executing program 4 (id=4692): socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}}, 0x1c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0xfffffffffffffea9, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x8c050}, 0xc000) 222.973837ms ago: executing program 0 (id=4693): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="720ac4ff000000007110ac000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) (async) r0 = socket$inet(0x2b, 0x801, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000180)=0x2, 0x4) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCADDRT(r1, 0x8902, &(0x7f0000000080)={@loopback={0x8000000000}, @loopback, @empty}) (async, rerun: 32) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[], 0x48) (async, rerun: 32) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001e0000000c00018008000100", @ANYRES32=r6, @ANYBLOB="050003"], 0x28}}, 0x80) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r9) r10 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r10, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x30004081) (async, rerun: 32) recvmsg$unix(r9, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x2) (rerun: 32) writev(r7, &(0x7f0000003500)=[{&(0x7f00000035c0)='4', 0x1}, {&(0x7f0000000080)='C', 0x1}, {&(0x7f00000000c0)="d40d", 0x2}], 0x3) (async) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e1e, @initdev={0xac, 0x1e, 0xfe, 0x0}}, 0x10) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) (rerun: 32) 188.510578ms ago: executing program 1 (id=4694): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r4) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)={0x34, r5, 0x1, 0x0, 0x0, {0x7}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1}, @L2TP_ATTR_IFNAME={0x14}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(streebog256-generic,pcbc(fcrypt-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x437, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r6, 0x40c89}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x3}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x80}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44801}, 0x0) r8 = socket$inet(0x2, 0x2, 0x0) sendmmsg$inet(r8, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @empty, @loopback}}}], 0x20}}], 0x1, 0x4040880) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r9, &(0x7f0000000300), 0x0}, 0x20) r10 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x2, 0x0, 0x3, 0x8001, r9, 0x2, '\x00', r6, r1, 0x5, 0x5, 0x0, 0xf, @value=r10}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYRESHEX=r3], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc7, &(0x7f0000000a00)=""/199, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x9}, 0x10}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="1700000000000000040000084dffffff00000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200"/28], 0x50) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r13, @ANYRES32=r12, @ANYBLOB="260094600000000000000000", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61157300000000006113770000000000bfa000000000000007050000080013002d15010000000000950017b8000000006916000000000000bf6700000000000035060200c0ff3f006706000002000000160300000ee6fe5fbf500000000000000f650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f19de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03cc86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f674629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40446d7074be86a912a5ac00f7ffffffffffffff000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000001fe4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b00631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809f905f12f6106f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3f00004d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad0fceee5f339550130a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3116dbc7e2bf2402275fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453b65586f65c7943d54b52f06c870edf0c5d644b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a57ff52f657a67463d7db0825e9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f3b563ab9000000ff000000000077a99fb5b0a43749ca477c9c7ca20bd428d8f77bb920ad0db4c1da671bfad7f109b776476a54939e621232cd115ba9f37057ad891fea2353f3ad9c042c64a5ecf80f4e4cf927ae39347c22822375c26edf2754695c16780429e03759691adb63553e9c4561528ded5f35bb20e98b2e6d01dbfcde82608359c50881324524db0dbe21efba4f0fc338f4b0b11cb028d1063b3bacaab92fb7f9d2971440f873ec261d54c1570adef8004c91896fcd74c9e03dfd9a781210c0346ed1b02a44c64adad8a3f238a8ddf7207c45057c02e922b942f15ddcfbfb00"/1752], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r13}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) sendmsg$inet(r11, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x0) 109.293055ms ago: executing program 3 (id=4695): r0 = socket(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[], 0x1c}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d2, &(0x7f0000000100)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001e008d2a"], 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) 109.151512ms ago: executing program 0 (id=4696): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x1c, r1, 0x1, 0xf0bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4800}, 0x4044001) 105.84401ms ago: executing program 4 (id=4697): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@ipv6_delroute={0x34, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2200}, [@RTA_PRIORITY={0x8, 0x1e}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0xc, 0x1, {0x0, 0x8}}}]}, 0x34}}, 0x0) (async) syz_emit_ethernet(0x54, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa001101abdb61d0f61b080543e1bae15e537afd7292f7e0e5282b050ca0e149a23b6231f41bbf5f91daf312f1f61e98bbefa47d111730270d889b0989d72844e788740896d5fbd42a"], 0x0) 26.33092ms ago: executing program 3 (id=4698): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x9, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x6, 0xa, 0x0, 0xfe00, 0x41}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='illinois\x00', 0x9) getsockopt$inet6_tcp_buf(r2, 0x6, 0x1a, 0x0, &(0x7f00000001c0)) r3 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)='ns/pid_for_children\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r5 = openat$cgroup_devices(r4, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r5, &(0x7f0000000080)=ANY=[@ANYBLOB='b ', @ANYRESOCT], 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x22, 0x2, 0x2) setsockopt$SO_RDS_TRANSPORT(r7, 0x114, 0x8, 0x0, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r7, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x24, r8, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_LANES={0x8, 0x9, 0x2}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4c810}, 0x14) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x2}, {{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0x2}, {}, {0x85, 0x0, 0x0, 0x5e}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x6c}}}, &(0x7f0000000200)='GPL\x00'}, 0x90) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="020600000200"], 0x10}}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETQUEUE(r11, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x14, 0x12, 0x0, 0x1, [{0x11, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xa0}}, 0x0) ioctl$NS_GET_OWNER_UID(r3, 0xb704, 0x0) socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r12, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x0, 0x1000, {0xa, 0x0, 0x0, r13, 0x0, 0x5e}, [@NDA_DST_IPV6={0x14, 0x1, @private2}]}, 0x30}}, 0x4000040) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newsa={0x100, 0x10, 0x413, 0x70bd28, 0x0, {{@in6=@mcast2, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x20}, {@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x40000040, 0x32}, @in6=@rand_addr=' \x01\x00', {0x4, 0x7, 0x3, 0x40000000000004, 0x5a0033e2, 0xffffffffffffffff, 0x2007f}, {0x0, 0x8, 0xcc}, {0xf6}, 0x0, 0x0, 0x2, 0x1, 0xfe}, [@replay_val={0x10, 0xa, {0x70bd27, 0x70bd2b, 0x5}}]}, 0x100}}, 0x804) 0s ago: executing program 0 (id=4699): r0 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}]}}]}, 0x44}}, 0x24004000) r2 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000)=0x102, 0x4) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r5, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000b00)="68ddaa732d69a6f7eb258957fccb89134faf578e9ff0cc38595e4c9c1f2a32ceb6799c682d87e991cd718f04a1487a5d99bef5a95019bdd837d20274d2e98cfbde31b70e45fcc74efe1c42ba121fe280bf8af2c22489537e57dee1cc54c41bd8f9086f9498bc3bcc4f0501f1defec42e4faac1dd0b0b67b797182b6c4ce3ff3da7d4d4a1069cada5b152bbd64335f0254ecbfe43c5d7cd5b8403e53ae4f712b05945b98eb3420bb04c7ecf528693bb9693ada19e3a8f9522ab692a2d78aefa8af8f0e6b3b3af268e535bc4a610f7341e7da01249d929b75acf7c99bd21b2b5e3f210e2798f5636bed013dae7ff0d009ca52fffbd88a3964a60786f8f025e4b8fac68f910cdd4a991a6020fcd5a92bc7747acef6f62d087646d32fc37f6d1cabd609e6f392350ebcc02c341a3ce598522d3963374f5eb522919d029136288fd1c08cadfd7f43a3a6618d6dd5ae6baf5b2f321588e9dfc879e213badc550eb9982777b09d808ca8e5540695200193c820ad6ce1e924cdf342a1ff9feeab68af907798fbc0fa570ef885369090c35b0959baf6e29b86833a14cf3532cd537891f27caa37b10cda2cf6e75ddc11cb13c558cc210be334af3813630bb2c16145cf91ce50099452e0b10e4ce9beb32ab1a8692d2b3cff0e370f87e2219172b7bbcce5d8daca20ce4e047510920000e3a56747839920f7231", 0x1f5}], 0x1}}], 0x1, 0x44) shutdown(r5, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x10, 0x11}, @TCA_FQ_QUANTUM={0x8}]}}]}, 0x40}}, 0x0) r7 = accept4$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @broadcast}, 0x10) kernel console output (not intermixed with test programs): rer [ 204.944578][T12383] tipc: Disabling bearer [ 205.241052][T12402] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.291162][T12402] netlink: 'syz.3.1898': attribute type 1 has an invalid length. [ 205.324232][ T5186] Bluetooth: hci4: command 0x0405 tx timeout [ 205.385172][T12402] 8021q: adding VLAN 0 to HW filter on device bond2 [ 205.413683][T12407] netlink: 'syz.1.1899': attribute type 1 has an invalid length. [ 205.445228][T12344] hsr0 speed is unknown, defaulting to 1000 [ 205.560904][T12407] 8021q: adding VLAN 0 to HW filter on device bond5 [ 205.604873][T12413] bond5: (slave geneve3): making interface the new active one [ 205.622203][T12413] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 206.018988][T12438] syzkaller0: entered promiscuous mode [ 206.024650][T12438] syzkaller0: entered allmulticast mode [ 206.246767][T12446] netlink: 'syz.4.1909': attribute type 29 has an invalid length. [ 206.256753][T12446] netlink: 'syz.4.1909': attribute type 29 has an invalid length. [ 208.630622][T12484] siw: device registration error -23 [ 208.636380][T12480] netlink: 'syz.0.1916': attribute type 5 has an invalid length. [ 208.662360][T12480] __nla_validate_parse: 13 callbacks suppressed [ 208.662380][T12480] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1916'. [ 208.705888][T12487] vlan4: entered allmulticast mode [ 208.720505][T12487] hsr0: entered allmulticast mode [ 208.725590][T12487] hsr_slave_0: entered allmulticast mode [ 208.736191][T12487] hsr_slave_1: entered allmulticast mode [ 208.764734][T12488] vxcan1 speed is unknown, defaulting to 1000 [ 208.908607][T12499] netlink: 'syz.0.1925': attribute type 2 has an invalid length. [ 208.938781][T12495] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1923'. [ 208.948705][T12495] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1923'. [ 209.244622][T12518] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1932'. [ 209.424703][T12533] netlink: 'syz.2.1936': attribute type 10 has an invalid length. [ 209.492265][T12532] netlink: 'syz.0.1935': attribute type 10 has an invalid length. [ 209.616414][T12533] tipc: Disabling bearer [ 209.658924][T12532] team0: Device ipvlan1 failed to register rx_handler [ 209.807809][T12488] hsr0 speed is unknown, defaulting to 1000 [ 210.055939][T12553] dvmrp1: entered allmulticast mode [ 210.501346][T12579] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1946'. [ 211.161658][T12597] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 211.184539][T12597] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 211.340256][T12599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1956'. [ 211.627855][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 211.653963][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 211.670967][T12624] tipc: Enabled bearer , priority 10 [ 211.748360][T12632] veth0: entered promiscuous mode [ 211.824411][T12630] veth0: left promiscuous mode [ 211.943688][T12643] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1967'. [ 212.359179][T12664] netlink: 'syz.2.1973': attribute type 1 has an invalid length. [ 212.450621][T12664] 8021q: adding VLAN 0 to HW filter on device bond4 [ 212.565147][T12663] bond4: (slave gretap1): making interface the new active one [ 212.609970][T12686] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1977'. [ 212.642843][T12663] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 212.798055][ T8440] tipc: Node number set to 604561166 [ 212.972875][T12704] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1983'. [ 213.663620][T12730] syzkaller0: entered promiscuous mode [ 213.670679][T12730] syzkaller0: entered allmulticast mode [ 216.903756][T12764] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.910992][T12764] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.927169][T12772] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2001'. [ 216.952358][T12767] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1997'. [ 216.966670][T12764] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 217.024937][T12773] ip6gre1: entered allmulticast mode [ 217.028223][T12777] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2002'. [ 217.069965][T12777] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2002'. [ 217.272723][T12785] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 217.472187][T12804] netlink: 244 bytes leftover after parsing attributes in process `syz.0.2011'. [ 217.482840][T12791] netlink: 'syz.2.2007': attribute type 10 has an invalid length. [ 217.522802][T12791] veth0_vlan: entered allmulticast mode [ 217.567730][T12791] team0: Device veth0_vlan failed to register rx_handler [ 217.715750][T12819] tipc: Enabled bearer , priority 0 [ 217.720729][T12822] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 217.739716][T12819] syzkaller0: entered promiscuous mode [ 217.761651][T12819] syzkaller0: entered allmulticast mode [ 217.808242][T12819] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 217.829158][T12831] sctp: [Deprecated]: syz.2.2018 (pid 12831) Use of int in max_burst socket option deprecated. [ 217.829158][T12831] Use struct sctp_assoc_value instead [ 217.875046][T12835] tipc: Enabling of bearer rejected, failed to enable media [ 217.888356][T12819] tipc: Resetting bearer [ 217.901137][T12828] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 217.943694][T12828] netlink: 'syz.3.2019': attribute type 2 has an invalid length. [ 217.949939][T12818] tipc: Resetting bearer [ 217.956388][T12828] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2019'. [ 218.046597][T12818] tipc: Disabling bearer [ 218.171462][T12857] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 218.297721][T12868] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2025'. [ 218.309683][T12869] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2027'. [ 218.316430][T12868] (unnamed net_device) (uninitialized): option use_carrier: invalid value (4) [ 218.432009][T12874] netdevsim netdevsim3: Direct firmware load for ..€ failed with error -2 [ 218.442738][T12874] netdevsim netdevsim3: Falling back to sysfs fallback for: ..€ [ 218.485988][T12877] netdevsim netdevsim3: Direct firmware load for ..€ failed with error -2 [ 218.495007][T12877] netdevsim netdevsim3: Falling back to sysfs fallback for: ..€ [ 218.613601][T12886] netlink: 'syz.3.2031': attribute type 9 has an invalid length. [ 218.818778][T12893] netlink: 'syz.4.2034': attribute type 29 has an invalid length. [ 218.839315][T12893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2034'. [ 219.014693][T12911] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 219.044717][T12912] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 219.064358][T12911] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2040'. [ 219.679642][T12948] dvmrp0: left allmulticast mode [ 219.692585][T12948] pimreg: left allmulticast mode [ 219.736165][T12952] netlink: 'syz.2.2053': attribute type 1 has an invalid length. [ 219.754795][T12952] netlink: 'syz.2.2053': attribute type 2 has an invalid length. [ 219.763539][T12952] netlink: 'syz.2.2053': attribute type 1 has an invalid length. [ 219.821862][T12950] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.928248][T12958] netlink: 'syz.1.2055': attribute type 10 has an invalid length. [ 219.945241][T12958] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 220.409604][T12995] netlink: 'syz.4.2064': attribute type 3 has an invalid length. [ 220.459205][T13003] netem: invalid attributes len -24 [ 220.662217][T13018] netlink: 'syz.1.2070': attribute type 2 has an invalid length. [ 220.749285][T13019] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 221.334841][T13041] batadv_slave_1: entered promiscuous mode [ 221.375334][T13040] batadv_slave_1: left promiscuous mode [ 222.193117][T13087] xt_limit: Overflow, try lower: 271964/0 [ 222.206565][T13088] xt_limit: Overflow, try lower: 271964/0 [ 222.331005][T13088] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 223.582079][T13090] tipc: Enabled bearer , priority 0 [ 223.601305][T13091] syzkaller0: entered promiscuous mode [ 223.606821][T13091] syzkaller0: entered allmulticast mode [ 223.648011][T13096] tipc: Resetting bearer [ 223.675263][T13084] tipc: Resetting bearer [ 223.700704][T13084] tipc: Disabling bearer [ 223.711654][T13076] vxcan1 speed is unknown, defaulting to 1000 [ 224.205368][T13076] hsr0 speed is unknown, defaulting to 1000 [ 224.238466][T13130] __nla_validate_parse: 14 callbacks suppressed [ 224.238482][T13130] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2098'. [ 224.241949][T13127] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2099'. [ 224.353159][T13135] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2099'. [ 224.608591][T13150] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2105'. [ 225.084262][T13163] syzkaller0: entered promiscuous mode [ 225.091848][T13163] syzkaller0: entered allmulticast mode [ 225.107929][T13157] dvmrp1: left allmulticast mode [ 225.181627][T13158] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2107'. [ 225.269648][T13175] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2111'. [ 225.402711][T13180] FAULT_INJECTION: forcing a failure. [ 225.402711][T13180] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 225.416248][T13180] CPU: 0 UID: 0 PID: 13180 Comm: syz.3.2112 Not tainted syzkaller #0 PREEMPT(full) [ 225.416273][T13180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 225.416284][T13180] Call Trace: [ 225.416291][T13180] [ 225.416298][T13180] dump_stack_lvl+0x189/0x250 [ 225.416323][T13180] ? __pfx____ratelimit+0x10/0x10 [ 225.416342][T13180] ? __pfx_dump_stack_lvl+0x10/0x10 [ 225.416361][T13180] ? __pfx__printk+0x10/0x10 [ 225.416383][T13180] ? __might_fault+0xb0/0x130 [ 225.416416][T13180] should_fail_ex+0x414/0x560 [ 225.416445][T13180] _copy_from_iter+0x1de/0x1790 [ 225.416470][T13180] ? rcu_is_watching+0x15/0xb0 [ 225.416488][T13180] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 225.416512][T13180] ? __pfx__copy_from_iter+0x10/0x10 [ 225.416533][T13180] ? __build_skb_around+0x257/0x3e0 [ 225.416554][T13180] ? netlink_sendmsg+0x642/0xb30 [ 225.416570][T13180] ? skb_put+0x11b/0x210 [ 225.416592][T13180] netlink_sendmsg+0x6b2/0xb30 [ 225.416619][T13180] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.416641][T13180] ? aa_sock_msg_perm+0xf1/0x1d0 [ 225.416660][T13180] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 225.416678][T13180] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.416696][T13180] __sock_sendmsg+0x219/0x270 [ 225.416723][T13180] ____sys_sendmsg+0x505/0x830 [ 225.416749][T13180] ? __pfx_____sys_sendmsg+0x10/0x10 [ 225.416774][T13180] ? import_iovec+0x74/0xa0 [ 225.416798][T13180] ___sys_sendmsg+0x21f/0x2a0 [ 225.416820][T13180] ? __pfx____sys_sendmsg+0x10/0x10 [ 225.416877][T13180] ? __fget_files+0x2a/0x420 [ 225.416895][T13180] ? __fget_files+0x3a0/0x420 [ 225.416916][T13180] __x64_sys_sendmsg+0x19b/0x260 [ 225.416937][T13180] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 225.416967][T13180] ? __pfx_ksys_write+0x10/0x10 [ 225.416992][T13180] ? rcu_is_watching+0x15/0xb0 [ 225.417015][T13180] ? do_syscall_64+0xbe/0x3b0 [ 225.417037][T13180] do_syscall_64+0xfa/0x3b0 [ 225.417053][T13180] ? lockdep_hardirqs_on+0x9c/0x150 [ 225.417070][T13180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.417105][T13180] ? clear_bhb_loop+0x60/0xb0 [ 225.417125][T13180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.417142][T13180] RIP: 0033:0x7f9edcf8ec29 [ 225.417161][T13180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 225.417175][T13180] RSP: 002b:00007f9edde8e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 225.417194][T13180] RAX: ffffffffffffffda RBX: 00007f9edd1d6090 RCX: 00007f9edcf8ec29 [ 225.417213][T13180] RDX: 0000000000000040 RSI: 0000200000000540 RDI: 0000000000000006 [ 225.417224][T13180] RBP: 00007f9edde8e090 R08: 0000000000000000 R09: 0000000000000000 [ 225.417235][T13180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 225.417245][T13180] R13: 00007f9edd1d6128 R14: 00007f9edd1d6090 R15: 00007ffd29987168 [ 225.417275][T13180] [ 227.353568][ T30] audit: type=1800 audit(1758394750.930:2): pid=13185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2114" name="memory.events" dev="tmpfs" ino=2105 res=0 errno=0 [ 227.407910][ T30] audit: type=1804 audit(1758394750.970:3): pid=13185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.2114" name="/newroot/409/memory.events" dev="tmpfs" ino=2105 res=1 errno=0 [ 227.409039][T13189] netlink: 1196 bytes leftover after parsing attributes in process `syz.0.2116'. [ 227.584452][T13202] delete_channel: no stack [ 227.595299][T13202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2121'. [ 227.653425][T13209] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 227.692626][T13212] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2123'. [ 227.768149][T13215] FAULT_INJECTION: forcing a failure. [ 227.768149][T13215] name failslab, interval 1, probability 0, space 0, times 0 [ 227.782659][T13215] CPU: 0 UID: 0 PID: 13215 Comm: syz.3.2124 Not tainted syzkaller #0 PREEMPT(full) [ 227.782686][T13215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 227.782697][T13215] Call Trace: [ 227.782704][T13215] [ 227.782712][T13215] dump_stack_lvl+0x189/0x250 [ 227.782736][T13215] ? __pfx____ratelimit+0x10/0x10 [ 227.782755][T13215] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.782775][T13215] ? __pfx__printk+0x10/0x10 [ 227.782800][T13215] ? __pfx___might_resched+0x10/0x10 [ 227.782817][T13215] ? fs_reclaim_acquire+0x7d/0x100 [ 227.782839][T13215] should_fail_ex+0x414/0x560 [ 227.782866][T13215] should_failslab+0xa8/0x100 [ 227.782891][T13215] __kmalloc_noprof+0xcb/0x4f0 [ 227.782911][T13215] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 227.782938][T13215] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 227.782968][T13215] genl_family_rcv_msg_doit+0xb8/0x300 [ 227.782996][T13215] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 227.783027][T13215] ? apparmor_capable+0x137/0x1b0 [ 227.783053][T13215] ? bpf_lsm_capable+0x9/0x20 [ 227.783073][T13215] ? security_capable+0x7e/0x2e0 [ 227.783104][T13215] genl_rcv_msg+0x60e/0x790 [ 227.783132][T13215] ? __pfx_genl_rcv_msg+0x10/0x10 [ 227.783151][T13215] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 227.783171][T13215] ? __pfx_nl80211_del_tx_ts+0x10/0x10 [ 227.783189][T13215] ? __pfx_nl80211_post_doit+0x10/0x10 [ 227.783225][T13215] netlink_rcv_skb+0x205/0x470 [ 227.783241][T13215] ? __lock_acquire+0xab9/0xd20 [ 227.783263][T13215] ? __pfx_genl_rcv_msg+0x10/0x10 [ 227.783285][T13215] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 227.783325][T13215] ? down_read+0x1ad/0x2e0 [ 227.783348][T13215] genl_rcv+0x28/0x40 [ 227.783366][T13215] netlink_unicast+0x82f/0x9e0 [ 227.783400][T13215] ? __pfx_netlink_unicast+0x10/0x10 [ 227.783425][T13215] ? netlink_sendmsg+0x642/0xb30 [ 227.783441][T13215] ? skb_put+0x11b/0x210 [ 227.783464][T13215] netlink_sendmsg+0x805/0xb30 [ 227.783492][T13215] ? __pfx_netlink_sendmsg+0x10/0x10 [ 227.783514][T13215] ? aa_sock_msg_perm+0xf1/0x1d0 [ 227.783533][T13215] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 227.783551][T13215] ? __pfx_netlink_sendmsg+0x10/0x10 [ 227.783570][T13215] __sock_sendmsg+0x219/0x270 [ 227.783597][T13215] ____sys_sendmsg+0x505/0x830 [ 227.783623][T13215] ? __pfx_____sys_sendmsg+0x10/0x10 [ 227.783653][T13215] ? import_iovec+0x74/0xa0 [ 227.783679][T13215] ___sys_sendmsg+0x21f/0x2a0 [ 227.783702][T13215] ? __pfx____sys_sendmsg+0x10/0x10 [ 227.783761][T13215] ? __fget_files+0x2a/0x420 [ 227.783777][T13215] ? __fget_files+0x3a0/0x420 [ 227.783807][T13215] __x64_sys_sendmsg+0x19b/0x260 [ 227.783831][T13215] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 227.783861][T13215] ? __pfx_ksys_write+0x10/0x10 [ 227.783880][T13215] ? rcu_is_watching+0x15/0xb0 [ 227.783903][T13215] ? do_syscall_64+0xbe/0x3b0 [ 227.783926][T13215] do_syscall_64+0xfa/0x3b0 [ 227.783943][T13215] ? lockdep_hardirqs_on+0x9c/0x150 [ 227.783959][T13215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.783975][T13215] ? clear_bhb_loop+0x60/0xb0 [ 227.783994][T13215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.784010][T13215] RIP: 0033:0x7f9edcf8ec29 [ 227.784026][T13215] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 227.784040][T13215] RSP: 002b:00007f9eddeaf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 227.784058][T13215] RAX: ffffffffffffffda RBX: 00007f9edd1d5fa0 RCX: 00007f9edcf8ec29 [ 227.784070][T13215] RDX: 0000000000000040 RSI: 0000200000000540 RDI: 0000000000000006 [ 227.784081][T13215] RBP: 00007f9eddeaf090 R08: 0000000000000000 R09: 0000000000000000 [ 227.784092][T13215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 227.784102][T13215] R13: 00007f9edd1d6038 R14: 00007f9edd1d5fa0 R15: 00007ffd29987168 [ 227.784132][T13215] [ 228.433677][T13234] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2131'. [ 228.666399][T13253] FAULT_INJECTION: forcing a failure. [ 228.666399][T13253] name failslab, interval 1, probability 0, space 0, times 0 [ 228.704631][T13253] CPU: 1 UID: 0 PID: 13253 Comm: syz.0.2137 Not tainted syzkaller #0 PREEMPT(full) [ 228.704661][T13253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 228.704672][T13253] Call Trace: [ 228.704679][T13253] [ 228.704687][T13253] dump_stack_lvl+0x189/0x250 [ 228.704712][T13253] ? __pfx____ratelimit+0x10/0x10 [ 228.704731][T13253] ? __pfx_dump_stack_lvl+0x10/0x10 [ 228.704751][T13253] ? __pfx__printk+0x10/0x10 [ 228.704776][T13253] ? __pfx___might_resched+0x10/0x10 [ 228.704793][T13253] ? fs_reclaim_acquire+0x7d/0x100 [ 228.704814][T13253] should_fail_ex+0x414/0x560 [ 228.704843][T13253] should_failslab+0xa8/0x100 [ 228.704867][T13253] __kmalloc_noprof+0xcb/0x4f0 [ 228.704888][T13253] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 228.704915][T13253] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 228.704944][T13253] genl_family_rcv_msg_doit+0xb8/0x300 [ 228.704972][T13253] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 228.705002][T13253] ? apparmor_capable+0x137/0x1b0 [ 228.705024][T13253] ? bpf_lsm_capable+0x9/0x20 [ 228.705044][T13253] ? security_capable+0x7e/0x2e0 [ 228.705072][T13253] genl_rcv_msg+0x60e/0x790 [ 228.705099][T13253] ? __pfx_genl_rcv_msg+0x10/0x10 [ 228.705119][T13253] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 228.705139][T13253] ? __pfx_nl80211_del_tx_ts+0x10/0x10 [ 228.705180][T13253] ? __pfx_nl80211_post_doit+0x10/0x10 [ 228.705203][T13253] ? __asan_memcpy+0x40/0x70 [ 228.705222][T13253] ? __pfx_ref_tracker_free+0x10/0x10 [ 228.705247][T13253] netlink_rcv_skb+0x205/0x470 [ 228.705263][T13253] ? __lock_acquire+0xab9/0xd20 [ 228.705286][T13253] ? __pfx_genl_rcv_msg+0x10/0x10 [ 228.705309][T13253] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 228.705348][T13253] ? down_read+0x1ad/0x2e0 [ 228.705371][T13253] genl_rcv+0x28/0x40 [ 228.705390][T13253] netlink_unicast+0x82f/0x9e0 [ 228.705424][T13253] ? __pfx_netlink_unicast+0x10/0x10 [ 228.705450][T13253] ? netlink_sendmsg+0x642/0xb30 [ 228.705466][T13253] ? skb_put+0x11b/0x210 [ 228.705489][T13253] netlink_sendmsg+0x805/0xb30 [ 228.705518][T13253] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.705541][T13253] ? aa_sock_msg_perm+0xf1/0x1d0 [ 228.705560][T13253] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 228.705578][T13253] ? __pfx_netlink_sendmsg+0x10/0x10 [ 228.705598][T13253] __sock_sendmsg+0x219/0x270 [ 228.705625][T13253] ____sys_sendmsg+0x505/0x830 [ 228.705654][T13253] ? __pfx_____sys_sendmsg+0x10/0x10 [ 228.705683][T13253] ? import_iovec+0x74/0xa0 [ 228.705707][T13253] ___sys_sendmsg+0x21f/0x2a0 [ 228.705728][T13253] ? __pfx____sys_sendmsg+0x10/0x10 [ 228.705785][T13253] ? __fget_files+0x2a/0x420 [ 228.705801][T13253] ? __fget_files+0x3a0/0x420 [ 228.705828][T13253] __x64_sys_sendmsg+0x19b/0x260 [ 228.705853][T13253] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 228.705884][T13253] ? __pfx_ksys_write+0x10/0x10 [ 228.705903][T13253] ? rcu_is_watching+0x15/0xb0 [ 228.705926][T13253] ? do_syscall_64+0xbe/0x3b0 [ 228.705949][T13253] do_syscall_64+0xfa/0x3b0 [ 228.705966][T13253] ? lockdep_hardirqs_on+0x9c/0x150 [ 228.705983][T13253] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.706000][T13253] ? clear_bhb_loop+0x60/0xb0 [ 228.706021][T13253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.706037][T13253] RIP: 0033:0x7fbaa118ec29 [ 228.706054][T13253] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 228.706069][T13253] RSP: 002b:00007fbaa1fb4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 228.706087][T13253] RAX: ffffffffffffffda RBX: 00007fbaa13d5fa0 RCX: 00007fbaa118ec29 [ 228.706101][T13253] RDX: 0000000000000040 RSI: 0000200000000540 RDI: 0000000000000006 [ 228.706112][T13253] RBP: 00007fbaa1fb4090 R08: 0000000000000000 R09: 0000000000000000 [ 228.706123][T13253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 228.706134][T13253] R13: 00007fbaa13d6038 R14: 00007fbaa13d5fa0 R15: 00007ffccb0ef2d8 [ 228.706171][T13253] [ 229.280877][T13272] validate_nla: 3 callbacks suppressed [ 229.280895][T13272] netlink: 'syz.0.2143': attribute type 1 has an invalid length. [ 229.325439][T13272] netlink: 'syz.0.2143': attribute type 3 has an invalid length. [ 229.339620][T13272] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2143'. [ 229.370533][T13279] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2145'. [ 229.403270][T13278] syzkaller0: entered promiscuous mode [ 229.414115][T13278] syzkaller0: entered allmulticast mode [ 229.437664][T13278] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2144'. [ 229.714781][T13299] dvmrp0: entered allmulticast mode [ 229.734203][T13297] netlink: 'syz.2.2150': attribute type 2 has an invalid length. [ 230.158694][T13329] veth0: entered promiscuous mode [ 230.221578][T13329] veth0: left promiscuous mode [ 230.250960][T13334] netlink: 'syz.0.2164': attribute type 32 has an invalid length. [ 230.261716][T13334] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2164'. [ 230.297949][T13339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2167'. [ 230.305310][T13334] (unnamed net_device) (uninitialized): option coupled_control: invalid value (52) [ 230.397642][T13344] (unnamed net_device) (uninitialized): option use_carrier: invalid value (64) [ 230.628248][T13359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2173'. [ 230.700945][T13367] netlink: 'syz.4.2177': attribute type 12 has an invalid length. [ 230.793638][T13364] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2173'. [ 231.068683][T13385] vxcan1 speed is unknown, defaulting to 1000 [ 231.148181][T13390] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2179'. [ 231.523573][T13408] erspan0: entered promiscuous mode [ 231.562391][T13408] erspan0: entered allmulticast mode [ 231.745017][T13417] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2188'. [ 231.768400][T13385] hsr0 speed is unknown, defaulting to 1000 [ 231.775485][T13417] netlink: 'syz.1.2188': attribute type 1 has an invalid length. [ 231.794856][T13417] netlink: 'syz.1.2188': attribute type 2 has an invalid length. [ 231.800555][T13422] team0: Device ip6gre1 is of different type [ 231.989979][T13431] netlink: 'syz.0.2193': attribute type 1 has an invalid length. [ 232.070370][T13431] 8021q: adding VLAN 0 to HW filter on device bond10 [ 232.125621][T13437] 8021q: adding VLAN 0 to HW filter on device bond10 [ 232.133617][T13437] bond10: (slave vxcan1): The slave device specified does not support setting the MAC address [ 232.135385][T13439] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2194'. [ 232.152095][T13437] bond10: (slave vxcan1): Error -95 calling set_mac_address [ 232.209054][T13442] netlink: 'syz.3.2195': attribute type 1 has an invalid length. [ 232.246642][T13440] veth5: entered promiscuous mode [ 232.256782][T13440] bond10: (slave veth5): Enslaving as an active interface with a down link [ 232.269037][T13431] 8021q: adding VLAN 0 to HW filter on device bond10 [ 232.341252][T13443] bond3: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 232.356264][T13443] bond3: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 232.368099][T13443] bond3: (slave ipvlan0): Setting fail_over_mac to active for active-backup mode [ 232.692832][T13459] netlink: 'syz.2.2198': attribute type 4 has an invalid length. [ 233.285424][T13490] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 233.380935][T13497] syzkaller1: entered promiscuous mode [ 233.386557][T13497] syzkaller1: entered allmulticast mode [ 233.564443][T13516] veth0: entered promiscuous mode [ 233.596871][T13515] veth0: left promiscuous mode [ 233.617111][T13512] nbd1: detected capacity change from 0 to 127 [ 233.720102][T13511] nbd2: detected capacity change from 0 to 127 [ 233.732721][ T5186] block nbd1: Receive control failed (result -32) [ 233.737952][ T5866] block nbd2: Receive control failed (result -32) [ 233.822902][T13532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 233.928654][T13537] lo: left promiscuous mode [ 233.935384][T13537] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.956512][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 234.310744][T13566] IPVS: set_ctl: invalid protocol: 0 172.30.0.1:20000 [ 234.516365][T13578] __nla_validate_parse: 10 callbacks suppressed [ 234.516384][T13578] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2241'. [ 234.542909][T13578] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2241'. [ 234.634409][T13587] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2243'. [ 234.840338][T13598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2246'. [ 234.849465][T13598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2246'. [ 236.057759][T13621] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2254'. [ 236.228400][T13629] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 236.965186][T13664] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2271'. [ 237.282619][T13686] pim6reg1: entered promiscuous mode [ 237.293704][T13686] pim6reg1: entered allmulticast mode [ 238.131045][T13720] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2288'. [ 238.298186][T13732] netlink: 'syz.1.2290': attribute type 13 has an invalid length. [ 238.489497][T13746] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2296'. [ 238.585052][T13751] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2297'. [ 238.759004][T13759] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 238.951457][T13777] netlink: 'syz.3.2305': attribute type 10 has an invalid length. [ 238.994985][T13778] ipvlan0: entered allmulticast mode [ 239.030214][T13777] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 239.074124][T13783] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 239.400571][T13805] netlink: 'syz.3.2312': attribute type 13 has an invalid length. [ 239.561535][T13819] netlink: 'syz.1.2316': attribute type 13 has an invalid length. [ 239.609512][T13819] veth0_macvtap: left promiscuous mode [ 239.615962][T13819] macvtap0: entered allmulticast mode [ 239.640776][T13819] macvtap0: refused to change device tx_queue_len [ 239.820473][T13833] __nla_validate_parse: 8 callbacks suppressed [ 239.820493][T13833] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2322'. [ 239.979797][T13848] netlink: 'syz.2.2324': attribute type 39 has an invalid length. [ 240.471162][T13869] pim6reg1: entered promiscuous mode [ 240.491481][T13869] pim6reg1: entered allmulticast mode [ 240.719052][T13886] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2337'. [ 240.836285][T13895] tipc: Enabled bearer , priority 0 [ 240.863639][T13895] syzkaller0: entered promiscuous mode [ 240.881892][T13895] syzkaller0: entered allmulticast mode [ 241.004137][T13905] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2340'. [ 241.049574][T13895] tipc: Resetting bearer [ 241.073786][T13912] netlink: 'syz.2.2344': attribute type 1 has an invalid length. [ 241.097384][T13913] macvtap2: entered allmulticast mode [ 241.113021][T13913] veth0_macvtap: entered allmulticast mode [ 241.142648][T13919] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2346'. [ 241.168304][T13920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2345'. [ 241.216544][T13895] netlink: 'syz.1.2340': attribute type 12 has an invalid length. [ 241.276353][T13917] bond5: (slave geneve3): making interface the new active one [ 241.295502][T13917] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 241.322356][T13894] tipc: Resetting bearer [ 241.357696][T13894] tipc: Disabling bearer [ 241.374892][ T12] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 241.386091][T13928] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 241.452004][ T12] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 241.476003][ T12] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 241.529754][ T36] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 241.657318][ T30] audit: type=1800 audit(1758394765.230:4): pid=13941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2354" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=2536 res=0 errno=0 [ 241.691304][T13945] bond0: Caught tx_queue_len zero misconfig [ 241.950714][T13966] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2358'. [ 242.203391][T13980] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.2367'. [ 242.291701][T13988] dvmrp0: left allmulticast mode [ 242.416679][T14001] openvswitch: netlink: Actions may not be safe on all matching packets [ 242.468753][T13993] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 242.551401][T14009] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2373'. [ 242.625991][T14012] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2375'. [ 242.650600][T14013] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2375'. [ 242.865470][T14032] netlink: 'syz.4.2381': attribute type 1 has an invalid length. [ 242.921294][T14032] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 242.935193][T14032] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 242.989479][T14041] lo: entered promiscuous mode [ 242.999008][T14041] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 243.360221][T14068] bridge6: the hash_elasticity option has been deprecated and is always 16 [ 243.393868][T14068] bridge6: entered promiscuous mode [ 243.418605][T14068] bridge6: entered allmulticast mode [ 243.439039][T14066] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 243.768883][T14102] netlink: 'syz.4.2399': attribute type 8 has an invalid length. [ 244.300764][T14138] netlink: 'syz.4.2412': attribute type 9 has an invalid length. [ 244.649482][T14162] nbd: must specify at least one socket [ 245.378236][T14214] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 245.424176][T14214] __nla_validate_parse: 9 callbacks suppressed [ 245.424194][T14214] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2436'. [ 245.489071][T14214] netlink: 984 bytes leftover after parsing attributes in process `syz.2.2436'. [ 245.536164][T14214] netlink: 'syz.2.2436': attribute type 1 has an invalid length. [ 245.553739][T14221] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2438'. [ 245.577724][T14221] IPVS: set_ctl: invalid protocol: 98 172.30.0.4:20004 [ 245.644685][T14214] bond6 (unregistering): Released all slaves [ 246.154554][T14234] batadv_slave_1: entered promiscuous mode [ 246.198944][T14222] batadv_slave_1: left promiscuous mode [ 246.376110][T14251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2448'. [ 246.492504][T14256] vxcan1 speed is unknown, defaulting to 1000 [ 246.940173][T14271] netlink: 'syz.0.2453': attribute type 11 has an invalid length. [ 247.026259][T14256] hsr0 speed is unknown, defaulting to 1000 [ 247.068311][T14271] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2453'. [ 247.485153][T14301] netlink: 'syz.0.2461': attribute type 39 has an invalid length. [ 247.830465][T14319] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2464'. [ 248.005326][T14324] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2466'. [ 248.039357][T14332] netlink: 'syz.3.2467': attribute type 1 has an invalid length. [ 248.056031][T14332] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2467'. [ 248.134048][T14332] ip6tnl0: Caught tx_queue_len zero misconfig [ 248.225277][T14338] tipc: Enabled bearer , priority 0 [ 248.245313][T14338] syzkaller0: entered promiscuous mode [ 248.251039][T14338] syzkaller0: entered allmulticast mode [ 248.293227][T14338] tipc: Resetting bearer [ 248.314880][T14344] netlink: 348 bytes leftover after parsing attributes in process `syz.0.2473'. [ 248.324444][T14337] tipc: Resetting bearer [ 248.364108][T14337] tipc: Disabling bearer [ 248.383726][T14344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2473'. [ 248.396003][T14348] tipc: Enabled bearer , priority 0 [ 248.478825][T14344] bridge_slave_1 (unregistering): left allmulticast mode [ 248.491167][T14344] bridge_slave_1 (unregistering): left promiscuous mode [ 248.498757][T14344] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.772857][T14369] netlink: 'syz.3.2482': attribute type 1 has an invalid length. [ 249.160601][T14392] nbd: illegal input index -1 [ 249.180862][T14390] syzkaller0: entered promiscuous mode [ 249.195297][T14390] syzkaller0: entered allmulticast mode [ 249.397590][T14403] netlink: 'syz.0.2492': attribute type 1 has an invalid length. [ 249.435240][T14397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.446794][T14397] 8021q: adding VLAN 0 to HW filter on device team0 [ 249.475224][T14397] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 250.303873][T14469] netlink: 'syz.3.2513': attribute type 2 has an invalid length. [ 250.322059][T14470] netlink: 'syz.3.2513': attribute type 2 has an invalid length. [ 250.327470][T14469] netlink: 'syz.3.2513': attribute type 8 has an invalid length. [ 250.355312][T14470] netlink: 'syz.3.2513': attribute type 8 has an invalid length. [ 250.471853][T14480] netlink: 'syz.4.2515': attribute type 1 has an invalid length. [ 250.493980][T14480] netlink: 'syz.4.2515': attribute type 3 has an invalid length. [ 250.515574][T14480] netlink: 'syz.4.2515': attribute type 235 has an invalid length. [ 250.700495][T14488] FAULT_INJECTION: forcing a failure. [ 250.700495][T14488] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 250.734433][T14488] CPU: 0 UID: 0 PID: 14488 Comm: syz.1.2518 Not tainted syzkaller #0 PREEMPT(full) [ 250.734460][T14488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 250.734483][T14488] Call Trace: [ 250.734491][T14488] [ 250.734499][T14488] dump_stack_lvl+0x189/0x250 [ 250.734524][T14488] ? __pfx____ratelimit+0x10/0x10 [ 250.734562][T14488] ? __pfx_dump_stack_lvl+0x10/0x10 [ 250.734581][T14488] ? __pfx__printk+0x10/0x10 [ 250.734603][T14488] ? __might_fault+0xb0/0x130 [ 250.734636][T14488] should_fail_ex+0x414/0x560 [ 250.734664][T14488] _copy_from_user+0x2d/0xb0 [ 250.734686][T14488] ___sys_sendmsg+0x158/0x2a0 [ 250.734709][T14488] ? __pfx____sys_sendmsg+0x10/0x10 [ 250.734769][T14488] ? __fget_files+0x2a/0x420 [ 250.734785][T14488] ? __fget_files+0x3a0/0x420 [ 250.734811][T14488] __x64_sys_sendmsg+0x19b/0x260 [ 250.734834][T14488] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 250.734864][T14488] ? __pfx_ksys_write+0x10/0x10 [ 250.734883][T14488] ? rcu_is_watching+0x15/0xb0 [ 250.734906][T14488] ? do_syscall_64+0xbe/0x3b0 [ 250.734928][T14488] do_syscall_64+0xfa/0x3b0 [ 250.734945][T14488] ? lockdep_hardirqs_on+0x9c/0x150 [ 250.734962][T14488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.734978][T14488] ? clear_bhb_loop+0x60/0xb0 [ 250.734999][T14488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.735016][T14488] RIP: 0033:0x7f5ecb18ec29 [ 250.735032][T14488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 250.735046][T14488] RSP: 002b:00007f5ecbfe9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 250.735065][T14488] RAX: ffffffffffffffda RBX: 00007f5ecb3d5fa0 RCX: 00007f5ecb18ec29 [ 250.735078][T14488] RDX: 0000000000000040 RSI: 0000200000000540 RDI: 0000000000000004 [ 250.735089][T14488] RBP: 00007f5ecbfe9090 R08: 0000000000000000 R09: 0000000000000000 [ 250.735100][T14488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.735110][T14488] R13: 00007f5ecb3d6038 R14: 00007f5ecb3d5fa0 R15: 00007fff21816258 [ 250.735139][T14488] [ 251.209263][T14506] netlink: 'syz.2.2523': attribute type 5 has an invalid length. [ 251.217405][T14506] __nla_validate_parse: 10 callbacks suppressed [ 251.217422][T14506] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2523'. [ 251.331606][T14511] tipc: Enabled bearer , priority 0 [ 251.346855][T14508] syzkaller0: entered promiscuous mode [ 251.355090][T14508] syzkaller0: entered allmulticast mode [ 251.410894][T14508] tipc: Resetting bearer [ 251.461177][T14508] tipc: Disabling bearer [ 251.632592][T14524] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2530'. [ 251.656097][T14524] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2530'. [ 251.686234][T14526] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2531'. [ 251.762258][T14524] erspan0: entered promiscuous mode [ 251.801620][T14524] batadv_slave_1: entered promiscuous mode [ 251.900031][T14544] netlink: 'syz.4.2528': attribute type 2 has an invalid length. [ 251.915701][T14524] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2530'. [ 251.949538][T14544] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2528'. [ 252.038735][T14549] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 252.039148][T14552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2533'. [ 252.168518][T14557] FAULT_INJECTION: forcing a failure. [ 252.168518][T14557] name failslab, interval 1, probability 0, space 0, times 0 [ 252.219270][T14557] CPU: 1 UID: 0 PID: 14557 Comm: syz.1.2534 Not tainted syzkaller #0 PREEMPT(full) [ 252.219296][T14557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 252.219306][T14557] Call Trace: [ 252.219313][T14557] [ 252.219321][T14557] dump_stack_lvl+0x189/0x250 [ 252.219345][T14557] ? __pfx____ratelimit+0x10/0x10 [ 252.219364][T14557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 252.219382][T14557] ? __pfx__printk+0x10/0x10 [ 252.219409][T14557] ? __pfx___might_resched+0x10/0x10 [ 252.219431][T14557] should_fail_ex+0x414/0x560 [ 252.219459][T14557] should_failslab+0xa8/0x100 [ 252.219484][T14557] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 252.219506][T14557] ? __alloc_skb+0x112/0x2d0 [ 252.219528][T14557] __alloc_skb+0x112/0x2d0 [ 252.219549][T14557] netlink_sendmsg+0x5c6/0xb30 [ 252.219577][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.219598][T14557] ? aa_sock_msg_perm+0xf1/0x1d0 [ 252.219618][T14557] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 252.219636][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 252.219656][T14557] __sock_sendmsg+0x219/0x270 [ 252.219681][T14557] ____sys_sendmsg+0x505/0x830 [ 252.219708][T14557] ? __pfx_____sys_sendmsg+0x10/0x10 [ 252.219738][T14557] ? import_iovec+0x74/0xa0 [ 252.219761][T14557] ___sys_sendmsg+0x21f/0x2a0 [ 252.219816][T14557] ? __pfx____sys_sendmsg+0x10/0x10 [ 252.219874][T14557] ? __fget_files+0x2a/0x420 [ 252.219888][T14557] ? __fget_files+0x3a0/0x420 [ 252.219915][T14557] __x64_sys_sendmsg+0x19b/0x260 [ 252.219938][T14557] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 252.219965][T14557] ? __pfx_ksys_write+0x10/0x10 [ 252.219984][T14557] ? rcu_is_watching+0x15/0xb0 [ 252.220007][T14557] ? do_syscall_64+0xbe/0x3b0 [ 252.220029][T14557] do_syscall_64+0xfa/0x3b0 [ 252.220046][T14557] ? lockdep_hardirqs_on+0x9c/0x150 [ 252.220063][T14557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.220080][T14557] ? clear_bhb_loop+0x60/0xb0 [ 252.220100][T14557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.220116][T14557] RIP: 0033:0x7f5ecb18ec29 [ 252.220133][T14557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 252.220147][T14557] RSP: 002b:00007f5ecbfe9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 252.220167][T14557] RAX: ffffffffffffffda RBX: 00007f5ecb3d5fa0 RCX: 00007f5ecb18ec29 [ 252.220180][T14557] RDX: 0000000000000040 RSI: 0000200000000540 RDI: 0000000000000004 [ 252.220191][T14557] RBP: 00007f5ecbfe9090 R08: 0000000000000000 R09: 0000000000000000 [ 252.220202][T14557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.220213][T14557] R13: 00007f5ecb3d6038 R14: 00007f5ecb3d5fa0 R15: 00007fff21816258 [ 252.220242][T14557] [ 252.544196][T14554] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 252.851983][T14572] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2538'. [ 252.878248][T14572] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 252.903379][T14572] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2538'. [ 253.004473][T14587] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 253.030080][T14590] IPVS: Unknown mcast interface: vcan0 [ 253.056575][ T8443] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 253.125527][T14594] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2546'. [ 253.156597][T14594] geneve3: entered promiscuous mode [ 253.185013][T14594] geneve3: entered allmulticast mode [ 253.204832][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.216083][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.230522][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.244160][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.298978][ T8443] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 253.331629][T14603] veth0_macvtap: left promiscuous mode [ 253.826142][T14624] bond5: (slave vxcan1): The slave device specified does not support setting the MAC address [ 253.847933][T14624] bond5: (slave vxcan1): Error -95 calling set_mac_address [ 253.879939][T14633] gretap0: entered promiscuous mode [ 253.890556][T14633] bond0: (slave gretap0): Enslaving as an active interface with an up link [ 254.155941][T14644] mac80211_hwsim hwsim12 syzkaller0: entered promiscuous mode [ 254.196760][T14644] mac80211_hwsim hwsim12 syzkaller0: entered allmulticast mode [ 254.243727][T14653] : entered promiscuous mode [ 254.462839][T14668] validate_nla: 4 callbacks suppressed [ 254.462857][T14668] netlink: 'syz.2.2570': attribute type 3 has an invalid length. [ 254.653895][T14675] openvswitch: netlink: Missing key (keys=40, expected=100) [ 254.670024][T14675] netlink: 'syz.4.2573': attribute type 21 has an invalid length. [ 255.216685][T14697] netlink: 'syz.4.2581': attribute type 4 has an invalid length. [ 255.217280][T14663] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 255.356402][T14703] netlink: 'syz.4.2585': attribute type 3 has an invalid length. [ 255.804496][T14735] tipc: Enabled bearer , priority 0 [ 255.828724][T14735] tipc: Resetting bearer [ 255.876491][T14734] tipc: Disabling bearer [ 255.907626][T14739] vlan3: entered allmulticast mode [ 255.912924][T14739] veth1_to_bond: entered allmulticast mode [ 255.924939][T14739] veth1_to_bond: Caught tx_queue_len zero misconfig [ 256.433787][T14774] __nla_validate_parse: 23 callbacks suppressed [ 256.433804][T14774] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2606'. [ 256.517015][ T5866] Bluetooth: hci0: command 0x0406 tx timeout [ 256.608794][T14794] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 256.695699][T14798] lo: Caught tx_queue_len zero misconfig [ 256.722021][T14798] netlink: 'syz.3.2614': attribute type 10 has an invalid length. [ 256.783441][T14802] ip6gre2: entered allmulticast mode [ 256.872388][T14808] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2617'. [ 256.937145][T14808] xfrm2: entered promiscuous mode [ 256.946304][T14808] xfrm2: entered allmulticast mode [ 256.963749][T14808] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2617'. [ 257.001068][T14821] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2621'. [ 257.155835][T14833] tipc: Enabled bearer , priority 0 [ 257.186851][T14833] syzkaller0: entered promiscuous mode [ 257.206781][T14833] syzkaller0: entered allmulticast mode [ 257.255177][T14833] tipc: Resetting bearer [ 257.272646][T14833] netlink: 'syz.0.2624': attribute type 1 has an invalid length. [ 257.280539][T14833] netlink: 184 bytes leftover after parsing attributes in process `syz.0.2624'. [ 257.332637][T14832] tipc: Resetting bearer [ 257.425896][T14832] tipc: Disabling bearer [ 257.429323][T14851] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2629'. [ 257.437410][T14853] netlink: 'syz.1.2631': attribute type 1 has an invalid length. [ 257.445691][T14854] netlink: 'syz.1.2631': attribute type 1 has an invalid length. [ 257.452373][T14853] netlink: 'syz.1.2631': attribute type 2 has an invalid length. [ 257.456753][T14854] netlink: 'syz.1.2631': attribute type 2 has an invalid length. [ 257.465018][T14853] netlink: 1156 bytes leftover after parsing attributes in process `syz.1.2631'. [ 257.488562][T14854] netlink: 1156 bytes leftover after parsing attributes in process `syz.1.2631'. [ 257.498429][T14850] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 258.114340][T14904] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2645'. [ 258.158732][T14907] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2647'. [ 258.824980][T14953] lo: left promiscuous mode [ 259.186930][T14953] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.779968][T14953] vlan0: left allmulticast mode [ 259.784875][T14953] veth0_vlan: left allmulticast mode [ 259.797570][T14953] vlan0: left promiscuous mode [ 259.803827][T14953] macvtap1: left promiscuous mode [ 259.827878][T14953] veth5: left promiscuous mode [ 259.838718][T14953] veth0_macvtap: left allmulticast mode [ 259.848575][T14953] xfrm2: left promiscuous mode [ 259.931381][ T1102] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 259.952546][ T1102] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.993106][ T1102] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.013291][ T1102] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.043784][ T1102] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.073968][ T1102] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.117949][ T1102] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.143702][ T1102] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.650072][T15032] vxcan1 speed is unknown, defaulting to 1000 [ 260.665598][T15038] lo: Caught tx_queue_len zero misconfig [ 260.711113][T15040] netlink: 'syz.2.2683': attribute type 11 has an invalid length. [ 260.860391][T15047] openvswitch: netlink: IPv4 tunnel dst address is zero [ 261.183800][T15058] 8021q: adding VLAN 0 to HW filter on device bond14 [ 261.208666][T15032] hsr0 speed is unknown, defaulting to 1000 [ 261.821974][T15090] __nla_validate_parse: 12 callbacks suppressed [ 261.821993][T15090] netlink: 348 bytes leftover after parsing attributes in process `syz.4.2693'. [ 261.846243][T15096] vxcan1 speed is unknown, defaulting to 1000 [ 261.971452][T15101] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2697'. [ 262.327257][T15112] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.336476][T15112] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.503286][T15096] hsr0 speed is unknown, defaulting to 1000 [ 263.504319][T15160] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2714'. [ 263.518922][T15160] openvswitch: netlink: Key 6 has unexpected len 14 expected 2 [ 263.529278][T15158] openvswitch: netlink: Actions may not be safe on all matching packets [ 263.664341][T15168] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2718'. [ 263.768562][T15172] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2719'. [ 263.778672][T15172] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2719'. [ 263.788971][T15172] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2719'. [ 263.978020][T15193] openvswitch: netlink: Key type 16144 is out of range max 32 [ 264.208863][T15202] tipc: Enabled bearer , priority 0 [ 264.220974][T15198] syzkaller0: entered promiscuous mode [ 264.226481][T15198] syzkaller0: entered allmulticast mode [ 264.313205][T15198] tipc: Resetting bearer [ 264.333415][T15195] tipc: Resetting bearer [ 264.342579][T15212] netlink: 356 bytes leftover after parsing attributes in process `syz.2.2733'. [ 264.371911][T15195] tipc: Disabling bearer [ 264.381708][T15212] validate_nla: 5 callbacks suppressed [ 264.381720][T15212] netlink: 'syz.2.2733': attribute type 10 has an invalid length. [ 264.403270][T15212] bridge_slave_1: left allmulticast mode [ 264.410032][T15212] bridge_slave_1: left promiscuous mode [ 264.415927][T15212] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.426631][T15212] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 264.485618][T15222] netlink: 'syz.1.2735': attribute type 1 has an invalid length. [ 264.512886][T15222] xt_limit: Overflow, try lower: 271964/0 [ 265.112072][T15221] netlink: 'syz.0.2732': attribute type 11 has an invalid length. [ 265.120839][T15221] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2732'. [ 265.141984][T15229] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2732'. [ 265.154682][T15229] netlink: 'syz.0.2732': attribute type 11 has an invalid length. [ 265.302226][T15240] netlink: 'syz.2.2739': attribute type 1 has an invalid length. [ 265.334252][T15240] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 265.421640][T15240] netlink: 'syz.2.2739': attribute type 1 has an invalid length. [ 265.440267][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 265.460072][T15240] netlink: 'syz.2.2739': attribute type 1 has an invalid length. [ 265.470064][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 265.487769][T15240] netlink: 'syz.2.2739': attribute type 2 has an invalid length. [ 265.532823][T15240] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 265.942757][T15276] netlink: 'syz.3.2749': attribute type 1 has an invalid length. [ 266.416790][T15300] netlink: 'syz.4.2755': attribute type 15 has an invalid length. [ 266.730023][T15326] netlink: 'syz.3.2758': attribute type 62 has an invalid length. [ 266.915544][T15314] syzkaller1: entered promiscuous mode [ 266.927087][T15314] syzkaller1: entered allmulticast mode [ 267.012422][T15341] __nla_validate_parse: 18 callbacks suppressed [ 267.012440][T15341] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2762'. [ 267.042985][T15342] IPVS: set_ctl: invalid protocol: 12 0.0.0.0:0 [ 267.101891][T15348] tipc: Enabled bearer , priority 0 [ 267.142520][T15339] mac80211_hwsim hwsim30 syzkaller0: entered promiscuous mode [ 267.174880][T15339] mac80211_hwsim hwsim30 syzkaller0: entered allmulticast mode [ 267.186367][T15339] tipc: Resetting bearer [ 267.210263][T15350] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2764'. [ 267.265758][T15339] tipc: Resetting bearer [ 267.381465][ T1102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 267.410441][ T1102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 267.446471][T15365] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.503050][T15370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2771'. [ 267.521799][T15370] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 267.544593][T15370] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 267.557908][T15370] gretap4: entered promiscuous mode [ 267.563784][T15370] gretap4: entered allmulticast mode [ 267.679069][T15384] netlink: 159784 bytes leftover after parsing attributes in process `syz.2.2775'. [ 268.130522][ T12] tipc: Resetting bearer [ 268.203090][T15423] sctp: [Deprecated]: syz.2.2788 (pid 15423) Use of struct sctp_assoc_value in delayed_ack socket option. [ 268.203090][T15423] Use struct sctp_sack_info instead [ 268.222352][T15422] sctp: [Deprecated]: syz.2.2788 (pid 15422) Use of struct sctp_assoc_value in delayed_ack socket option. [ 268.222352][T15422] Use struct sctp_sack_info instead [ 268.475772][T15438] netlink: 'syz.1.2793': attribute type 21 has an invalid length. [ 268.485261][T15438] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2793'. [ 268.518794][T15440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2794'. [ 268.544025][T15440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2794'. [ 268.855535][T15456] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2797'. [ 269.291256][T15445] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2794'. [ 269.399300][T15459] validate_nla: 6 callbacks suppressed [ 269.399319][T15459] netlink: 'syz.3.2798': attribute type 1 has an invalid length. [ 269.449657][T15464] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2799'. [ 269.595359][T15467] vxcan1 speed is unknown, defaulting to 1000 [ 269.736381][T15486] netlink: 'syz.0.2806': attribute type 12 has an invalid length. [ 269.768911][T15486] netlink: 'syz.0.2806': attribute type 29 has an invalid length. [ 269.867848][T15467] hsr0 speed is unknown, defaulting to 1000 [ 270.516667][T15518] hsr_slave_0 (unregistering): left promiscuous mode [ 270.876622][T15547] veth0: entered promiscuous mode [ 270.977911][T15553] veth0: left promiscuous mode [ 271.095078][T15564] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 271.225180][T15574] vxcan1 speed is unknown, defaulting to 1000 [ 271.486574][T15583] netlink: 'syz.3.2837': attribute type 7 has an invalid length. [ 271.545214][T15587] netlink: 'syz.2.2839': attribute type 30 has an invalid length. [ 271.566276][T15587] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 271.582597][T15587] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 271.689548][T15591] netlink: 'syz.4.2841': attribute type 12 has an invalid length. [ 271.750150][ T5866] Bluetooth: hci4: link tx timeout [ 271.755835][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.766492][ T5866] Bluetooth: hci4: link tx timeout [ 271.772611][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.781087][ T5866] Bluetooth: hci4: link tx timeout [ 271.786219][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.794633][ T5866] Bluetooth: hci4: link tx timeout [ 271.800185][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.808467][ T5866] Bluetooth: hci4: link tx timeout [ 271.813597][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.829874][ T5866] Bluetooth: hci4: link tx timeout [ 271.835122][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.843261][ T5866] Bluetooth: hci4: link tx timeout [ 271.848562][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.859579][T15601] netlink: 'syz.0.2842': attribute type 1 has an invalid length. [ 271.872190][ T5866] Bluetooth: hci4: link tx timeout [ 271.891653][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.899461][ T5866] Bluetooth: hci4: link tx timeout [ 271.904594][ T5866] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 271.915183][T15574] hsr0 speed is unknown, defaulting to 1000 [ 272.060409][T15601] 8021q: adding VLAN 0 to HW filter on device bond16 [ 272.085946][T15608] __nla_validate_parse: 10 callbacks suppressed [ 272.085964][T15608] netlink: 1036 bytes leftover after parsing attributes in process `syz.4.2845'. [ 272.108749][T15608] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 272.213572][T15616] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2848'. [ 272.233444][T15616] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2848'. [ 272.275695][T15618] netlink: 'syz.3.2849': attribute type 1 has an invalid length. [ 272.286535][T15616] netlink: 31 bytes leftover after parsing attributes in process `syz.0.2848'. [ 272.302840][T15616] netlink: 'syz.0.2848': attribute type 2 has an invalid length. [ 272.312216][T15616] netlink: 31 bytes leftover after parsing attributes in process `syz.0.2848'. [ 272.478721][T15632] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2852'. [ 272.511907][T15632] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2852'. [ 272.528452][T15636] netlink: 'syz.3.2849': attribute type 1 has an invalid length. [ 272.573682][T15623] bond4: (slave geneve4): making interface the new active one [ 272.586136][T15623] bond4: (slave geneve4): Enslaving as an active interface with an up link [ 272.626839][ T1102] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 272.667877][ T1102] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 272.678640][ T64] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 272.713143][ T64] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 272.882984][T15651] openvswitch: netlink: IP tunnel dst address not specified [ 272.921377][T15651] sit0: entered promiscuous mode [ 272.961316][T15651] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2856'. [ 273.272331][T15676] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 273.283307][T15678] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2864'. [ 273.384061][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.384172][T15678] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2864'. [ 273.404299][ T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.425275][T15673] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 273.435515][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.446251][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.623173][T15693] mac80211_hwsim hwsim12 syzkaller0: Caught tx_queue_len zero misconfig [ 273.714944][T15694] veth1_macvtap: left promiscuous mode [ 273.726261][T15694] team0: Device veth1_macvtap failed to register rx_handler [ 273.799930][ T5866] Bluetooth: hci4: command 0x0405 tx timeout [ 274.239059][T15725] syzkaller1: entered promiscuous mode [ 274.246153][T15725] syzkaller1: entered allmulticast mode [ 274.607910][T15754] erspan0: entered allmulticast mode [ 274.684355][T15763] validate_nla: 4 callbacks suppressed [ 274.684374][T15763] netlink: 'syz.1.2892': attribute type 9 has an invalid length. [ 274.759154][T15769] tipc: Resetting bearer [ 274.784623][T15769] mac80211_hwsim hwsim12 syzkaller0: left promiscuous mode [ 274.947675][T15778] vxcan1 speed is unknown, defaulting to 1000 [ 275.228411][T15778] hsr0 speed is unknown, defaulting to 1000 [ 276.258727][T15839] pim6reg: entered allmulticast mode [ 276.670594][ T5866] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 276.681694][ T5866] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 276.691065][ T5866] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 276.699772][ T5866] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 276.708376][ T5866] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 276.766386][T15851] vxcan1 speed is unknown, defaulting to 1000 [ 276.938127][T15867] tipc: Enabling of bearer rejected, already enabled [ 277.338429][T15851] hsr0 speed is unknown, defaulting to 1000 [ 277.403990][T15891] __nla_validate_parse: 21 callbacks suppressed [ 277.404006][T15891] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2931'. [ 277.602031][T15901] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2933'. [ 277.895435][T15881] lec:lec_vcc_attach: copy from user failed for 28 bytes [ 277.996340][T15925] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2938'. [ 278.008412][T15921] tipc: Enabled bearer , priority 0 [ 278.042189][T15928] nbd: socks must be embedded in a SOCK_ITEM attr [ 278.053721][T15921] syzkaller0: entered promiscuous mode [ 278.068954][T15925] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2938'. [ 278.073210][T15921] syzkaller0: entered allmulticast mode [ 278.091693][T15851] chnl_net:caif_netlink_parms(): no params data found [ 278.293243][T15920] tipc: Resetting bearer [ 278.328919][T15920] tipc: Disabling bearer [ 278.342443][T15936] netlink: 512 bytes leftover after parsing attributes in process `syz.2.2942'. [ 278.355297][T15938] netlink: 'syz.0.2944': attribute type 11 has an invalid length. [ 278.511595][T15948] openvswitch: netlink: Tunnel attr 303 out of range max 16 [ 278.523618][T15948] netlink: 'syz.1.2947': attribute type 4 has an invalid length. [ 278.594841][T15851] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.603818][T15851] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.614245][T15851] bridge_slave_0: entered allmulticast mode [ 278.622473][T15851] bridge_slave_0: entered promiscuous mode [ 278.631307][T15851] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.639207][T15851] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.647760][T15851] bridge_slave_1: entered allmulticast mode [ 278.655021][T15851] bridge_slave_1: entered promiscuous mode [ 278.692807][T15851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.704572][T15851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 278.738771][T15851] team0: Port device team_slave_0 added [ 278.746509][T15851] team0: Port device team_slave_1 added [ 278.757359][ T5186] Bluetooth: hci4: command tx timeout [ 278.779987][T15851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 278.788621][T15851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 278.815637][T15851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 278.830676][T15851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 278.837838][T15851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 278.864122][T15851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 278.915636][T15851] hsr_slave_0: entered promiscuous mode [ 278.923564][T15851] hsr_slave_1: entered promiscuous mode [ 278.929854][T15851] debugfs: 'hsr0' already exists in 'hsr' [ 278.935598][T15851] Cannot create hsr debugfs directory [ 279.054611][T15851] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.066345][T15851] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 279.131498][T15851] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.142402][T15851] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 279.212902][T15851] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.227829][T15851] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 279.302359][T15851] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.313602][T15851] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 279.445250][T15851] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 279.455771][T15851] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 279.465287][T15851] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 279.475562][T15851] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 279.552122][T15851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.576663][T15851] 8021q: adding VLAN 0 to HW filter on device team0 [ 279.591334][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.598511][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.618877][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.625976][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.813514][T15851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 279.860148][T15851] veth0_vlan: entered promiscuous mode [ 279.873950][T15851] veth1_vlan: entered promiscuous mode [ 279.906622][T15851] veth0_macvtap: entered promiscuous mode [ 279.915905][T15851] veth1_macvtap: entered promiscuous mode [ 279.936254][T15851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 279.953007][T15851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 279.968361][T15315] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.978551][ T1102] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.991637][ T1102] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.001207][ T1102] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.071746][ T1102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 280.081111][ T1102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 280.115241][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 280.124392][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 280.837448][ T5186] Bluetooth: hci4: command tx timeout [ 282.917423][ T5186] Bluetooth: hci4: command tx timeout [ 284.997819][ T5186] Bluetooth: hci4: command tx timeout [ 312.037171][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 337.718648][T15972] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 337.746036][T15971] netlink: 'syz.1.2949': attribute type 1 has an invalid length. [ 337.909429][T15971] netlink: 'syz.1.2949': attribute type 1 has an invalid length. [ 337.941682][T15971] netlink: 'syz.1.2949': attribute type 1 has an invalid length. [ 338.309158][T16009] netlink: 'syz.1.2960': attribute type 18 has an invalid length. [ 338.720986][T16023] tipc: Enabled bearer , priority 0 [ 338.768207][T16023] syzkaller0: entered promiscuous mode [ 338.773722][T16023] syzkaller0: entered allmulticast mode [ 338.932797][T16029] tipc: Resetting bearer [ 338.960252][T16033] xt_socket: unknown flags 0x50 [ 338.968110][T16022] tipc: Resetting bearer [ 339.058689][T16022] tipc: Disabling bearer [ 339.168450][ T5866] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 339.184758][ T5866] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 339.195502][ T5866] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 339.209854][ T5866] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 339.219640][ T5866] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 339.306741][T16045] siw: device registration error -23 [ 339.366118][T16049] openvswitch: netlink: Unknown key attributes 2 [ 339.424496][T16049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2971'. [ 339.444090][T16054] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2971'. [ 339.669721][T16040] vxcan1 speed is unknown, defaulting to 1000 [ 339.699129][T16069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2976'. [ 339.758008][T16072] GUP no longer grows the stack in syz.1.2979 (16072): 200000006000-200000008000 (200000005000) [ 339.816968][T16072] CPU: 0 UID: 0 PID: 16072 Comm: syz.1.2979 Not tainted syzkaller #0 PREEMPT(full) [ 339.816997][T16072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 339.817008][T16072] Call Trace: [ 339.817017][T16072] [ 339.817026][T16072] dump_stack_lvl+0x189/0x250 [ 339.817063][T16072] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.817085][T16072] ? __pfx__printk+0x10/0x10 [ 339.817106][T16072] ? find_vma+0xe7/0x160 [ 339.817145][T16072] __get_user_pages+0x24d0/0x2ce0 [ 339.817163][T16072] ? __lock_acquire+0xab9/0xd20 [ 339.817216][T16072] ? __gup_longterm_locked+0xc68/0x1660 [ 339.817245][T16072] __gup_longterm_locked+0xde9/0x1660 [ 339.817281][T16072] ? sanity_check_pinned_pages+0x123a/0x1300 [ 339.817313][T16072] gup_fast_fallback+0x1e6a/0x2010 [ 339.817362][T16072] ? __pfx_gup_fast_fallback+0x10/0x10 [ 339.817387][T16072] ? __lock_acquire+0xab9/0xd20 [ 339.817416][T16072] ? pin_user_pages_fast+0x4d/0xb0 [ 339.817439][T16072] iov_iter_extract_pages+0x35a/0x5e0 [ 339.817468][T16072] extract_iter_to_sg+0xe46/0x24e0 [ 339.817500][T16072] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 339.817518][T16072] ? __local_bh_enable_ip+0x12d/0x1c0 [ 339.817536][T16072] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.817554][T16072] ? __local_bh_enable_ip+0x12d/0x1c0 [ 339.817570][T16072] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 339.817594][T16072] ? __asan_memset+0x22/0x50 [ 339.817618][T16072] hash_sendmsg+0x4f4/0x11d0 [ 339.817662][T16072] ? __pfx_hash_sendmsg+0x10/0x10 [ 339.817686][T16072] __sock_sendmsg+0x219/0x270 [ 339.817716][T16072] ____sys_sendmsg+0x52d/0x830 [ 339.817745][T16072] ? __pfx_____sys_sendmsg+0x10/0x10 [ 339.817778][T16072] ? import_iovec+0x74/0xa0 [ 339.817801][T16072] ___sys_sendmsg+0x21f/0x2a0 [ 339.817826][T16072] ? __pfx____sys_sendmsg+0x10/0x10 [ 339.817887][T16072] ? __fget_files+0x2a/0x420 [ 339.817903][T16072] ? __fget_files+0x3a0/0x420 [ 339.817931][T16072] __sys_sendmmsg+0x227/0x430 [ 339.817959][T16072] ? __pfx___sys_sendmmsg+0x10/0x10 [ 339.817978][T16072] ? do_futex+0x395/0x420 [ 339.818009][T16072] ? fd_install+0x97/0x540 [ 339.818061][T16072] ? rcu_is_watching+0x15/0xb0 [ 339.818088][T16072] __x64_sys_sendmmsg+0xa0/0xc0 [ 339.818112][T16072] do_syscall_64+0xfa/0x3b0 [ 339.818130][T16072] ? lockdep_hardirqs_on+0x9c/0x150 [ 339.818148][T16072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.818167][T16072] ? clear_bhb_loop+0x60/0xb0 [ 339.818190][T16072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.818206][T16072] RIP: 0033:0x7f5ecb18ec29 [ 339.818223][T16072] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 339.818239][T16072] RSP: 002b:00007f5ecbfe9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 339.818258][T16072] RAX: ffffffffffffffda RBX: 00007f5ecb3d5fa0 RCX: 00007f5ecb18ec29 [ 339.818272][T16072] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000006 [ 339.818283][T16072] RBP: 00007f5ecb211e41 R08: 0000000000000000 R09: 0000000000000000 [ 339.818295][T16072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 339.818306][T16072] R13: 00007f5ecb3d6038 R14: 00007f5ecb3d5fa0 R15: 00007fff21816258 [ 339.818338][T16072] [ 340.164206][ T1102] wlan1: Trigger new scan to find an IBSS to join [ 340.251961][T16040] hsr0 speed is unknown, defaulting to 1000 [ 340.313694][T16083] netlink: 'syz.4.2984': attribute type 11 has an invalid length. [ 340.343433][T16084] netlink: 'syz.4.2984': attribute type 11 has an invalid length. [ 340.705136][T16109] tipc: Enabling of bearer rejected, failed to enable media [ 340.721498][T16040] chnl_net:caif_netlink_parms(): no params data found [ 340.902636][T15315] bridge_slave_0: left allmulticast mode [ 340.911583][T16115] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2989'. [ 340.912199][T15315] bridge_slave_0: left promiscuous mode [ 340.932963][T15315] bridge0: port 1(bridge_slave_0) entered disabled state [ 341.188733][T16132] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2995'. [ 341.198462][T16132] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2995'. [ 341.216471][T16132] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2995'. [ 341.261126][T15315] bond2 (unregistering): (slave gretap1): Releasing active interface [ 341.317678][ T5866] Bluetooth: hci2: command tx timeout [ 341.332566][T15315] dvmrp0 (unregistering): left allmulticast mode [ 341.364435][T15315] bond0 (unregistering): (slave geneve1): Releasing backup interface [ 341.416067][T15315] bridge0 (unregistering): left allmulticast mode [ 341.805687][T15315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 341.816701][T15315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 341.826060][T15315] bond0 (unregistering): Released all slaves [ 341.844091][T15315] bond1 (unregistering): Released all slaves [ 341.969864][T15315] bond2 (unregistering): Released all slaves [ 341.985073][T15315] bond3 (unregistering): Released all slaves [ 341.999633][T15315] bond4 (unregistering): (slave bond5): Releasing backup interface [ 342.012233][T15315] bond4 (unregistering): Released all slaves [ 342.139832][T15315] bond5 (unregistering): Released all slaves [ 342.152415][T15315] bond6 (unregistering): Released all slaves [ 342.274400][T15315] bond7 (unregistering): Released all slaves [ 342.293220][T15315] bond8 (unregistering): Released all slaves [ 342.414907][T15315] bond9 (unregistering): Released all slaves [ 342.541497][T15315] bond10 (unregistering): (slave veth5): Releasing active interface [ 342.550816][T15315] bond10 (unregistering): Released all slaves [ 342.566221][T15315] bond11 (unregistering): Released all slaves [ 342.581089][T15315] bond12 (unregistering): Released all slaves [ 342.594267][T15315] bond13 (unregistering): Released all slaves [ 342.729618][T15315] bond14 (unregistering): Released all slaves [ 342.745534][T15315] bond15 (unregistering): Released all slaves [ 342.873177][T15315] bond16 (unregistering): Released all slaves [ 343.142016][T16040] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.155399][T16040] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.183087][T16040] bridge_slave_0: entered allmulticast mode [ 343.204772][T16040] bridge_slave_0: entered promiscuous mode [ 343.232041][T15315] tipc: Disabling bearer [ 343.241521][T15315] tipc: Left network mode [ 343.248334][T16147] netlink: 'syz.2.2998': attribute type 10 has an invalid length. [ 343.251047][T16040] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.274917][T16040] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.299706][T16040] bridge_slave_1: entered allmulticast mode [ 343.338683][T16040] bridge_slave_1: entered promiscuous mode [ 343.349100][T16158] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3001'. [ 343.398781][ T5866] Bluetooth: hci2: command tx timeout [ 343.583235][T16040] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.640721][T16040] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.825774][T16173] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 343.880413][T16040] team0: Port device team_slave_0 added [ 343.886214][ T36] wlan1: Trigger new scan to find an IBSS to join [ 343.893678][T16186] netlink: 'syz.3.3007': attribute type 4 has an invalid length. [ 343.976431][T16182] netlink: 'syz.3.3007': attribute type 4 has an invalid length. [ 344.050802][T16040] team0: Port device team_slave_1 added [ 344.236628][T16040] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.252863][T16040] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 344.299478][T16040] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.324397][T16040] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.367008][T16040] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 344.417440][T16040] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.464597][ T8453] IPVS: starting estimator thread 0... [ 344.567446][T16206] IPVS: using max 33 ests per chain, 79200 per kthread [ 344.633041][T16040] hsr_slave_0: entered promiscuous mode [ 344.654480][T16212] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3016'. [ 344.659638][T16040] hsr_slave_1: entered promiscuous mode [ 344.673655][T16210] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3015'. [ 344.673972][T16040] debugfs: 'hsr0' already exists in 'hsr' [ 344.698862][T16040] Cannot create hsr debugfs directory [ 344.701994][T16210] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3015'. [ 344.714954][T16210] netlink: 'syz.3.3015': attribute type 2 has an invalid length. [ 344.726023][T16210] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3015'. [ 344.814218][T16212] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 344.842943][T16215] netlink: 260 bytes leftover after parsing attributes in process `syz.4.3016'. [ 345.109348][T16234] netlink: 'syz.2.3022': attribute type 2 has an invalid length. [ 345.327907][T16233] tap0: tun_chr_ioctl cmd 2148553947 [ 345.481697][ T5866] Bluetooth: hci2: command tx timeout [ 345.534864][T16252] macvtap1: entered promiscuous mode [ 345.562261][T16252] macvtap1: entered allmulticast mode [ 345.576203][T16252] bond_slave_0: entered promiscuous mode [ 345.581982][T16252] bond_slave_1: entered promiscuous mode [ 345.588882][T16252] bond0: entered allmulticast mode [ 345.594087][T16252] bond_slave_0: entered allmulticast mode [ 345.600654][T16252] bond_slave_1: entered allmulticast mode [ 345.612496][T16252] bond0: entered promiscuous mode [ 345.621100][T16252] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 345.629825][T16252] team0: Device macvtap1 failed to register rx_handler [ 345.649696][ T5951] hid (null): unknown global tag 0xe [ 345.658197][ T5951] hid (null): nested delimiters [ 345.667490][T16252] bond0: left allmulticast mode [ 345.680412][T16260] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3031'. [ 345.697118][T16252] bond_slave_0: left allmulticast mode [ 345.736602][T16252] bond_slave_1: left allmulticast mode [ 345.752882][T16252] bond0: left promiscuous mode [ 345.780849][T16252] bond_slave_0: left promiscuous mode [ 345.786467][T16252] bond_slave_1: left promiscuous mode [ 345.881428][T15315] hsr_slave_1: left promiscuous mode [ 346.128395][T15315] pim6reg (unregistering): left allmulticast mode [ 346.137095][T16282] IPv4: Oversized IP packet from 127.202.26.0 [ 346.628523][T15315] team0 (unregistering): Port device team_slave_1 removed [ 346.688545][T15315] team0 (unregistering): Port device team_slave_0 removed [ 346.826785][ T5951] hid-generic 0005:0D45:1012.0002: unknown global tag 0xe [ 346.837536][ T5951] hid-generic 0005:0D45:1012.0002: item 0 2 1 14 parsing failed [ 346.841229][ T36] wlan1: Trigger new scan to find an IBSS to join [ 346.852582][ T5951] hid-generic 0005:0D45:1012.0002: probe with driver hid-generic failed with error -22 [ 347.374855][T15315] IPVS: stop unused estimator thread 0... [ 347.558128][ T5866] Bluetooth: hci2: command tx timeout [ 347.740083][T16040] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 347.772467][T16040] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 347.793149][ T12] wlan1: Creating new IBSS network, BSSID 26:76:d8:8e:4f:a2 [ 347.823339][T16040] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 347.860664][T16040] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 347.889397][T16326] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3046'. [ 347.902672][T16326] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3046'. [ 347.941616][T16331] netlink: 'syz.3.3049': attribute type 1 has an invalid length. [ 347.953125][T16328] only policy match revision 0 supported [ 347.953145][T16328] unable to load match [ 348.036589][T16331] 8021q: adding VLAN 0 to HW filter on device bond1 [ 348.375092][T16040] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.448589][T16040] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.488441][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.495660][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.578108][ T1102] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.585286][ T1102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 348.881933][T16387] netlink: 'syz.4.3061': attribute type 1 has an invalid length. [ 348.978064][T16397] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.004985][T16397] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3063'. [ 349.022086][T16387] 8021q: adding VLAN 0 to HW filter on device bond6 [ 349.075662][T16398] bond6: (slave gretap1): making interface the new active one [ 349.093151][T16398] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 349.106383][T16397] 8021q: VLANs not supported on ip_vti0 [ 349.171753][T16040] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 349.265117][T16409] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.309187][T16413] netlink: 596 bytes leftover after parsing attributes in process `syz.1.3069'. [ 349.340454][T16040] veth0_vlan: entered promiscuous mode [ 349.371359][T16040] veth1_vlan: entered promiscuous mode [ 349.465689][T16418] 8021q: adding VLAN 0 to HW filter on device bond7 [ 349.533423][T16423] 8021q: adding VLAN 0 to HW filter on device bond7 [ 349.544274][T16423] bond7: (slave vxcan1): The slave device specified does not support setting the MAC address [ 349.558596][T16423] bond7: (slave vxcan1): Error -95 calling set_mac_address [ 349.672729][T16040] veth0_macvtap: entered promiscuous mode [ 349.701841][T16040] veth1_macvtap: entered promiscuous mode [ 349.782651][T16040] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 349.873368][T16040] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 350.155041][ T1102] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.175753][ T1102] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.204994][T16444] tipc: Enabling of bearer rejected, already enabled [ 350.219043][ T1102] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.243388][ T1102] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.265394][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.285432][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.330553][T16444] __nla_validate_parse: 1 callbacks suppressed [ 350.330571][T16444] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3079'. [ 350.358821][T16444] netlink: 'syz.2.3079': attribute type 1 has an invalid length. [ 350.366665][T16444] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 350.374331][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.407749][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.445871][T16448] netlink: 788 bytes leftover after parsing attributes in process `syz.2.3080'. [ 350.992722][T16459] tipc: Enabled bearer , priority 0 [ 351.023240][T16459] syzkaller0: entered promiscuous mode [ 351.035967][T16459] syzkaller0: entered allmulticast mode [ 351.180321][T16468] tipc: Resetting bearer [ 351.212294][T16467] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 351.222752][T16465] blkio.reset_stats is deprecated [ 351.243021][T16470] netlink: 'syz.3.3087': attribute type 1 has an invalid length. [ 351.256590][T16470] netlink: 'syz.3.3087': attribute type 2 has an invalid length. [ 351.274357][T16465] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3086'. [ 351.314164][T16456] tipc: Resetting bearer [ 351.367990][T16456] tipc: Disabling bearer [ 351.761729][T16486] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3093'. [ 351.851075][ T5186] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 351.861516][ T5186] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 351.873864][ T5186] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 351.908542][ T5186] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 351.921205][ T5186] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 352.013473][T16491] vxcan1 speed is unknown, defaulting to 1000 [ 352.475265][T16491] hsr0 speed is unknown, defaulting to 1000 [ 352.566531][T16529] netlink: 'syz.2.3106': attribute type 4 has an invalid length. [ 352.585870][T16534] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3108'. [ 352.632112][T16531] syzkaller1: entered promiscuous mode [ 352.638283][T16531] syzkaller1: entered allmulticast mode [ 353.079021][T16559] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3115'. [ 353.186697][T16491] chnl_net:caif_netlink_parms(): no params data found [ 353.218575][T16564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3116'. [ 353.274270][T16570] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3116'. [ 353.838002][T16491] bridge0: port 1(bridge_slave_0) entered blocking state [ 353.859095][T16491] bridge0: port 1(bridge_slave_0) entered disabled state [ 353.914378][T16491] bridge_slave_0: entered allmulticast mode [ 353.934811][T16491] bridge_slave_0: entered promiscuous mode [ 353.957839][ T5186] Bluetooth: hci1: command tx timeout [ 353.959090][T16491] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.010513][T16491] bridge0: port 2(bridge_slave_1) entered disabled state [ 354.031138][T16491] bridge_slave_1: entered allmulticast mode [ 354.058985][T16491] bridge_slave_1: entered promiscuous mode [ 354.174384][T16491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 354.245469][T16491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 354.313097][T16624] netlink: 'syz.1.3131': attribute type 1 has an invalid length. [ 354.365281][T16629] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3131'. [ 354.433058][T16491] team0: Port device team_slave_0 added [ 354.483627][T16491] team0: Port device team_slave_1 added [ 354.703555][T16491] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 354.728296][T16491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 354.786749][T16491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 354.836322][T16491] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 354.845888][T16491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 354.874116][T16491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 354.910539][T16645] mac80211_hwsim hwsim38 wlan1: entered allmulticast mode [ 354.976574][T16657] netlink: 'syz.2.3141': attribute type 30 has an invalid length. [ 355.065794][T16660] openvswitch: netlink: IPv4 tun info is not correct [ 355.074690][T16491] hsr_slave_0: entered promiscuous mode [ 355.094484][T16491] hsr_slave_1: entered promiscuous mode [ 355.104817][T16491] debugfs: 'hsr0' already exists in 'hsr' [ 355.115577][T16491] Cannot create hsr debugfs directory [ 355.543675][T16678] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3146'. [ 355.606708][T16677] netlink: 'syz.1.3147': attribute type 21 has an invalid length. [ 355.624070][T16677] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3147'. [ 355.633317][T16682] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3148'. [ 356.038639][ T5186] Bluetooth: hci1: command tx timeout [ 356.046139][T16491] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 356.084989][T16692] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3150'. [ 356.101014][T16491] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 356.168636][T16491] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 356.218274][T16491] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 356.280754][T16703] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3153'. [ 356.535320][T16728] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 356.577716][T16728] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 356.591523][T16730] netlink: 'syz.1.3159': attribute type 4 has an invalid length. [ 356.594236][T16728] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 356.613236][T16491] 8021q: adding VLAN 0 to HW filter on device bond0 [ 356.652376][T16491] 8021q: adding VLAN 0 to HW filter on device team0 [ 356.676278][T15315] bridge0: port 1(bridge_slave_0) entered blocking state [ 356.683504][T15315] bridge0: port 1(bridge_slave_0) entered forwarding state [ 356.714383][T15315] bridge0: port 2(bridge_slave_1) entered blocking state [ 356.721653][T15315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 357.111294][T16747] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3163'. [ 357.182749][T16750] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3163'. [ 357.265244][T16491] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 357.685815][T15315] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.704218][T15315] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.713462][T15315] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.723892][ T48] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 357.774330][T16778] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 358.088206][T16807] netlink: 'syz.0.3177': attribute type 1 has an invalid length. [ 358.111348][T16491] veth0_vlan: entered promiscuous mode [ 358.118042][ T5186] Bluetooth: hci1: command tx timeout [ 358.143072][T16491] veth1_vlan: entered promiscuous mode [ 358.236527][T16807] netlink: 'syz.0.3177': attribute type 1 has an invalid length. [ 358.245315][T16491] veth0_macvtap: entered promiscuous mode [ 358.251619][T16807] netlink: 'syz.0.3177': attribute type 1 has an invalid length. [ 358.273718][T16491] veth1_macvtap: entered promiscuous mode [ 358.376490][T16491] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 358.403553][T16491] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 358.511437][T16823] netlink: 212384 bytes leftover after parsing attributes in process `syz.0.3183'. [ 358.529534][T15315] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.542947][T15315] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.546630][T16824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3185'. [ 358.579589][T16823] openvswitch: netlink: Message has 5 unknown bytes. [ 358.585843][T16824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3185'. [ 358.637841][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.670432][T15315] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.818179][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.831370][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 358.913543][T16839] tipc: Enabling of bearer rejected, already enabled [ 358.926312][ T143] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 358.978057][ T143] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 359.292018][T16858] vxcan1 speed is unknown, defaulting to 1000 [ 359.717197][T16876] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 360.038536][ T5866] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 360.049489][ T5866] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 360.058723][ T5866] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 360.066777][ T5866] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 360.081766][ T5866] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 360.197407][ T5866] Bluetooth: hci1: command tx timeout [ 360.622991][T16900] netlink: 'syz.4.3209': attribute type 2 has an invalid length. [ 360.644522][T16900] __nla_validate_parse: 2 callbacks suppressed [ 360.644542][T16900] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3209'. [ 360.759469][T16905] netlink: 1 bytes leftover after parsing attributes in process `syz.2.3211'. [ 360.761938][T16893] vxcan1 speed is unknown, defaulting to 1000 [ 360.790118][T16905] xt_policy: neither incoming nor outgoing policy selected [ 360.950984][T16916] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3214'. [ 360.974272][T16918] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3214'. [ 361.199984][T16926] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3218'. [ 361.213035][T16926] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3218'. [ 361.222734][T16926] netlink: 'syz.3.3218': attribute type 5 has an invalid length. [ 361.242459][T16926] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3218'. [ 361.250269][T16893] hsr0 speed is unknown, defaulting to 1000 [ 361.258507][T16890] vxcan1 speed is unknown, defaulting to 1000 [ 361.470077][T16938] nbd: must specify at least one socket [ 361.811575][T16890] hsr0 speed is unknown, defaulting to 1000 [ 362.118272][ T5866] Bluetooth: hci5: command tx timeout [ 362.193032][T16968] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3229'. [ 362.223129][T16968] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3229'. [ 362.304498][T16890] chnl_net:caif_netlink_parms(): no params data found [ 362.622949][T16890] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.638899][T16890] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.646228][T16890] bridge_slave_0: entered allmulticast mode [ 362.654725][T16890] bridge_slave_0: entered promiscuous mode [ 362.666190][T16890] bridge0: port 2(bridge_slave_1) entered blocking state [ 362.673903][T16890] bridge0: port 2(bridge_slave_1) entered disabled state [ 362.681666][T16890] bridge_slave_1: entered allmulticast mode [ 362.690344][T16890] bridge_slave_1: entered promiscuous mode [ 362.945755][T16890] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 363.078573][T16890] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 363.140033][T17020] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3239'. [ 363.480091][T16890] team0: Port device team_slave_0 added [ 363.498533][T16890] team0: Port device team_slave_1 added [ 363.609832][T16890] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 363.617820][T16890] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 363.648545][T16890] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 363.702613][T16890] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 363.735060][T16890] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 363.794083][T16890] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 363.979180][T16890] hsr_slave_0: entered promiscuous mode [ 364.009348][T16890] hsr_slave_1: entered promiscuous mode [ 364.032815][T16890] debugfs: 'hsr0' already exists in 'hsr' [ 364.050817][T16890] Cannot create hsr debugfs directory [ 364.198898][ T5866] Bluetooth: hci5: command tx timeout [ 364.756722][T16890] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 364.775111][T16890] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.889015][T17108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 364.981540][T17116] openvswitch: netlink: Message has 5 unknown bytes. [ 364.991292][T16890] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.027435][T16890] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.226604][T16890] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.272232][T16890] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.315292][T17132] openvswitch: netlink: Flow key attr not present in new flow. [ 365.421351][T16890] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.453212][T16890] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.735135][T17151] bridge_slave_0: default FDB implementation only supports local addresses [ 365.820936][T16890] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 365.853277][T16890] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 365.909288][T16890] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 365.979313][T16890] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 366.280830][ T5866] Bluetooth: hci5: command tx timeout [ 366.472297][T16890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 366.515423][T16890] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.558079][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.565390][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.595497][T17189] __nla_validate_parse: 8 callbacks suppressed [ 366.595516][T17189] netlink: 160 bytes leftover after parsing attributes in process `syz.0.3286'. [ 366.631500][T17189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3286'. [ 366.642824][T15315] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.650041][T15315] bridge0: port 2(bridge_slave_1) entered forwarding state [ 366.655820][T17195] netlink: 'syz.2.3288': attribute type 1 has an invalid length. [ 366.674872][T17193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3287'. [ 366.712404][T17193] bond0: entered promiscuous mode [ 366.717975][T17193] bond_slave_0: entered promiscuous mode [ 366.723918][T17193] bond_slave_1: entered promiscuous mode [ 366.740868][T17193] bond0: left promiscuous mode [ 366.745808][T17193] bond_slave_0: left promiscuous mode [ 366.770379][T17193] bond_slave_1: left promiscuous mode [ 366.811655][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.822032][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.899410][T17200] tipc: Started in network mode [ 366.911487][T17200] tipc: Node identity f2b18cca90d9, cluster identity 4711 [ 366.923454][T17200] tipc: Enabled bearer , priority 0 [ 366.954111][T17200] syzkaller0: entered promiscuous mode [ 366.965184][T17200] syzkaller0: entered allmulticast mode [ 367.005762][T17200] tipc: Resetting bearer [ 367.038337][T17199] tipc: Resetting bearer [ 367.147741][T17199] tipc: Disabling bearer [ 367.344093][T17216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3295'. [ 367.526106][T16890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 367.586117][T17231] netlink: 'syz.0.3300': attribute type 1 has an invalid length. [ 367.663522][T16890] veth0_vlan: entered promiscuous mode [ 367.684769][T16890] veth1_vlan: entered promiscuous mode [ 367.751955][T17234] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3301'. [ 367.763768][T17234] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3301'. [ 367.774564][T16890] veth0_macvtap: entered promiscuous mode [ 367.838139][T16890] veth1_macvtap: entered promiscuous mode [ 367.914751][T17248] netlink: 'syz.3.3304': attribute type 1 has an invalid length. [ 367.921158][T16890] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 367.983070][T17248] 8021q: adding VLAN 0 to HW filter on device bond2 [ 367.994233][T17248] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3304'. [ 368.008416][T16890] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.165127][T17248] bond2 (unregistering): Released all slaves [ 368.195886][ T48] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.205266][ T48] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.223720][ T143] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.252685][ T143] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.352734][T15315] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.366093][ T5866] Bluetooth: hci5: command tx timeout [ 368.373104][T15315] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.404956][T15315] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.413335][T15315] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.338572][T17277] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3311'. [ 369.533057][T17278] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 369.541746][T17282] netlink: 'syz.4.3313': attribute type 1 has an invalid length. [ 369.574888][T17278] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 369.718556][T17291] macvlan2: entered promiscuous mode [ 369.725676][T17291] macvlan2: entered allmulticast mode [ 369.729687][T17295] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 369.740715][T17291] bond2: (slave macvlan2): Error -98 calling set_mac_address [ 369.847822][ T5186] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 369.863327][ T5186] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 369.873394][ T5186] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 369.885729][ T5186] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 369.894511][ T5186] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 370.073415][T17302] vxcan1 speed is unknown, defaulting to 1000 [ 370.418611][T17329] IPv4: Oversized IP packet from 127.202.26.0 [ 370.494384][T17302] hsr0 speed is unknown, defaulting to 1000 [ 370.688570][T17335] netlink: 'syz.3.3322': attribute type 33 has an invalid length. [ 370.876191][T17343] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3326'. [ 370.984730][T17345] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.309084][T17345] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.332820][T17350] vxcan1 speed is unknown, defaulting to 1000 [ 371.378736][T17381] nbd: must specify at least one socket [ 371.440797][T17379] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 371.657528][T17345] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.964078][ T5866] Bluetooth: hci0: command tx timeout [ 372.289414][T17388] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.297153][T17388] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.642982][T17388] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 372.668587][T17388] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.995421][T17350] hsr0 speed is unknown, defaulting to 1000 [ 373.073177][T17345] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.094843][T17404] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3339'. [ 373.118201][ T48] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.134333][T17302] chnl_net:caif_netlink_parms(): no params data found [ 373.165137][ T48] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.196302][ T48] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.249590][T17409] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3341'. [ 373.293461][ T48] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.412770][T17415] netlink: 'syz.3.3344': attribute type 1 has an invalid length. [ 373.435736][T17417] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3345'. [ 373.519289][T17422] sctp: [Deprecated]: syz.4.3346 (pid 17422) Use of int in max_burst socket option. [ 373.519289][T17422] Use struct sctp_assoc_value instead [ 373.523078][T17415] 8021q: adding VLAN 0 to HW filter on device bond3 [ 373.635749][T17419] bond3: (slave gretap1): making interface the new active one [ 373.645446][T17419] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 373.800906][T17435] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3348'. [ 373.816196][ T36] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 373.841427][ T36] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.041451][ T5866] Bluetooth: hci0: command tx timeout [ 374.236039][T17435] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 374.253688][T17435] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 374.265974][T17435] bond0 (unregistering): Released all slaves [ 374.295745][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.357503][T17302] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.366507][T17302] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.374038][T17302] bridge_slave_0: entered allmulticast mode [ 374.382772][T17302] bridge_slave_0: entered promiscuous mode [ 374.404553][T15315] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.450392][T17302] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.460866][T17302] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.473730][T17302] bridge_slave_1: entered allmulticast mode [ 374.482236][T17302] bridge_slave_1: entered promiscuous mode [ 374.492446][T17448] vxcan1 speed is unknown, defaulting to 1000 [ 374.582944][T17302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 374.615315][T17302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.574325][T17467] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3356'. [ 375.697846][T17448] hsr0 speed is unknown, defaulting to 1000 [ 375.794910][T17464] pim6reg: entered allmulticast mode [ 375.805510][T17302] team0: Port device team_slave_0 added [ 375.873089][T17302] team0: Port device team_slave_1 added [ 376.029442][T17483] netlink: 'syz.0.3360': attribute type 1 has an invalid length. [ 376.117458][ T5866] Bluetooth: hci0: command tx timeout [ 376.181431][T17477] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.189199][T17477] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.536160][T17477] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 376.582014][T17477] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 377.061170][T17483] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 377.121746][ T64] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.161070][ T64] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.171935][T17302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 377.189778][T17302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 377.225892][T17302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 377.246560][ T64] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.280903][T17302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 377.303612][T17302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 377.375517][T17495] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3363'. [ 377.382914][T17302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 377.411614][ T64] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.457813][T17497] vlan2: entered promiscuous mode [ 377.462977][T17497] syz_tun: entered promiscuous mode [ 377.480958][T17495] netlink: 'syz.0.3363': attribute type 12 has an invalid length. [ 377.506347][T17497] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3364'. [ 377.663685][T17511] netlink: 'syz.1.3368': attribute type 4 has an invalid length. [ 377.724930][T17512] netlink: 'syz.1.3368': attribute type 4 has an invalid length. [ 377.762178][T17514] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3369'. [ 377.776384][T17302] hsr_slave_0: entered promiscuous mode [ 377.783914][T17302] hsr_slave_1: entered promiscuous mode [ 377.791656][T17302] debugfs: 'hsr0' already exists in 'hsr' [ 377.799715][T17302] Cannot create hsr debugfs directory [ 377.813186][T15315] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 377.893406][T17521] netdevsim netdevsim3 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 378.197476][ T5866] Bluetooth: hci0: command tx timeout [ 378.285716][T17302] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.298456][T17302] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.309890][T17302] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 378.439154][T17539] sctp: [Deprecated]: syz.0.3376 (pid 17539) Use of int in max_burst socket option deprecated. [ 378.439154][T17539] Use struct sctp_assoc_value instead [ 378.490633][T17302] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.501683][T17302] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.522259][T17302] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 378.625146][T17302] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.641499][T17302] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.652993][T17302] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 378.677473][T17543] tipc: Started in network mode [ 378.682729][T17543] tipc: Node identity , cluster identity 4711 [ 378.689275][T17543] tipc: Failed to obtain node identity [ 378.695126][T17543] tipc: Enabling of bearer rejected, failed to enable media [ 378.739304][T17302] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.750635][T17302] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.761852][T17302] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 378.983580][T17302] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 378.995498][T17302] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 379.025212][T17302] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 379.055691][T17302] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 379.060224][T17554] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3381'. [ 379.111214][T17562] netlink: 'syz.3.3382': attribute type 1 has an invalid length. [ 379.149922][T17562] netlink: 'syz.3.3382': attribute type 4 has an invalid length. [ 379.165023][T17565] netlink: 'syz.1.3383': attribute type 63 has an invalid length. [ 379.187580][T17562] netlink: 9422 bytes leftover after parsing attributes in process `syz.3.3382'. [ 379.364920][T17302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 379.431855][T17576] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3385'. [ 379.452747][T17577] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3386'. [ 379.480388][T17302] 8021q: adding VLAN 0 to HW filter on device team0 [ 379.508539][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.515679][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 379.576903][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.584068][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 379.590154][T17588] netlink: 'syz.3.3389': attribute type 10 has an invalid length. [ 379.653585][T17593] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.3391'. [ 379.679306][T17595] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.3391'. [ 379.736079][T17588] batman_adv: batadv0: Adding interface: team0 [ 379.765986][T17588] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 379.806250][T17588] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 379.856077][T17599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3388'. [ 380.005284][T17302] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 380.098414][T17613] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 380.154743][T17613] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3396'. [ 380.174665][T17623] netlink: 13 bytes leftover after parsing attributes in process `syz.4.3397'. [ 380.187026][T17613] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3396'. [ 380.196216][T17620] netlink: 'syz.0.3398': attribute type 1 has an invalid length. [ 380.252224][T17620] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 380.514320][T17641] netlink: 'syz.0.3402': attribute type 3 has an invalid length. [ 380.573782][T17302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 380.802698][T17302] veth0_vlan: entered promiscuous mode [ 380.824290][T17302] veth1_vlan: entered promiscuous mode [ 380.896844][T17302] veth0_macvtap: entered promiscuous mode [ 380.911206][T17302] veth1_macvtap: entered promiscuous mode [ 380.940765][T17302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.965166][T17302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.999072][ T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.014656][ T48] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.029967][ T48] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.056281][ T48] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.157671][T11701] IPVS: ip_vs_send_async error -101 [ 381.183672][ T143] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.205753][ T143] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.243955][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.261236][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.474653][T17684] only policy match revision 0 supported [ 381.474672][T17684] unable to load match [ 381.660837][T17694] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input7 [ 382.163959][T17731] bridge_slave_1: left allmulticast mode [ 382.175222][T17731] bridge_slave_1: left promiscuous mode [ 382.185947][T17731] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.249674][T17731] bridge_slave_0: left allmulticast mode [ 382.255475][T17731] bridge_slave_0: left promiscuous mode [ 382.266853][T17731] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.696636][T17764] veth3: entered allmulticast mode [ 382.836387][T17768] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 383.008055][T17776] netlink: 'syz.4.3441': attribute type 11 has an invalid length. [ 383.161859][T17785] netlink: 'syz.4.3444': attribute type 1 has an invalid length. [ 383.255498][T17785] bond1: (slave gretap1): making interface the new active one [ 383.264770][T17785] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 383.283833][T17785] netlink: 'syz.4.3444': attribute type 1 has an invalid length. [ 383.626717][T17820] netlink: 'syz.3.3454': attribute type 1 has an invalid length. [ 383.758836][T17825] bond4: (slave gretap2): making interface the new active one [ 383.768356][T17825] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 384.092988][T17841] team0: Device veth1_macvtap failed to register rx_handler [ 384.301897][T17849] vlan1: entered allmulticast mode [ 384.317487][T17849] veth0_vlan: entered allmulticast mode [ 384.354214][T17853] __nla_validate_parse: 22 callbacks suppressed [ 384.354230][T17853] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3462'. [ 384.504453][T17866] validate_nla: 1 callbacks suppressed [ 384.504470][T17866] netlink: 'syz.2.3465': attribute type 1 has an invalid length. [ 384.523972][T17863] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3464'. [ 384.554522][T17866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3465'. [ 384.634180][T17872] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3468'. [ 384.701147][T17877] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 384.734850][T17875] netlink: 'syz.1.3469': attribute type 1 has an invalid length. [ 384.790056][T17875] netlink: 'syz.1.3469': attribute type 9 has an invalid length. [ 384.798398][T17875] netlink: 'syz.1.3469': attribute type 6 has an invalid length. [ 384.806141][T17875] netlink: 'syz.1.3469': attribute type 7 has an invalid length. [ 384.840865][T17887] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3473'. [ 384.852117][T17888] netlink: 'syz.1.3469': attribute type 11 has an invalid length. [ 384.886744][T17875] netlink: 'syz.1.3469': attribute type 8 has an invalid length. [ 384.914774][T17890] netlink: 'syz.2.3474': attribute type 1 has an invalid length. [ 385.354339][T17917] tipc: Started in network mode [ 385.362428][T17917] tipc: Node identity 4ecb8df5eefa, cluster identity 4711 [ 385.382260][T17917] tipc: Enabled bearer , priority 0 [ 385.403057][T17917] syzkaller0: entered promiscuous mode [ 385.415309][T17917] syzkaller0: entered allmulticast mode [ 385.461134][T17920] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3487'. [ 385.512359][T17917] tipc: Resetting bearer [ 385.529525][T17917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3484'. [ 385.548434][T17917] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3484'. [ 385.582482][T15315] netdevsim netdevsim3 ÿÿÿÿÿÿ: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.582661][T17917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3484'. [ 385.595797][T15315] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.609850][T17917] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3484'. [ 385.624120][T15315] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.680249][T17916] tipc: Resetting bearer [ 385.720713][T17916] tipc: Disabling bearer [ 385.794685][ T1102] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.844943][T17930] openvswitch: netlink: Duplicate or invalid key (type 0). [ 385.857013][T17930] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 385.922165][T17939] netlink: 'syz.4.3489': attribute type 3 has an invalid length. [ 388.550321][T18002] vxcan1 speed is unknown, defaulting to 1000 [ 389.105582][T18033] netlink: 'syz.3.3518': attribute type 10 has an invalid length. [ 389.137519][T18030] vlan2: entered allmulticast mode [ 389.142715][T18030] mac80211_hwsim hwsim47 wlan0: entered allmulticast mode [ 389.160765][T18038] netlink: 'syz.3.3518': attribute type 10 has an invalid length. [ 389.201515][T18033] batadv0: entered promiscuous mode [ 389.206760][T18033] batadv0: entered allmulticast mode [ 389.228265][T18033] bridge0: port 3(batadv0) entered blocking state [ 389.265478][T18033] bridge0: port 3(batadv0) entered disabled state [ 389.308395][T18033] bridge0: port 3(batadv0) entered blocking state [ 389.315006][T18033] bridge0: port 3(batadv0) entered forwarding state [ 389.352616][ T1114] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 389.362718][ T1114] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 389.427831][T18047] __nla_validate_parse: 12 callbacks suppressed [ 389.427849][T18047] netlink: 380 bytes leftover after parsing attributes in process `syz.2.3523'. [ 389.700092][T18063] validate_nla: 1 callbacks suppressed [ 389.700111][T18063] netlink: 'syz.1.3507': attribute type 13 has an invalid length. [ 389.782672][T18067] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3529'. [ 389.801226][T18063] netlink: 'syz.1.3507': attribute type 17 has an invalid length. [ 389.812327][T18067] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 389.868713][T18071] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 390.161039][T18063] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 390.210056][T18002] hsr0 speed is unknown, defaulting to 1000 [ 390.227781][T18053] vxcan1 speed is unknown, defaulting to 1000 [ 390.312694][T18086] netlink: 'syz.0.3533': attribute type 1 has an invalid length. [ 390.352259][T18086] netlink: 'syz.0.3533': attribute type 1 has an invalid length. [ 390.490901][T18094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3536'. [ 390.968448][T18053] hsr0 speed is unknown, defaulting to 1000 [ 390.975671][T18110] syzkaller1: entered promiscuous mode [ 390.993303][T18110] syzkaller1: entered allmulticast mode [ 391.036465][T18110] netlink: 'syz.0.3542': attribute type 30 has an invalid length. [ 391.117521][T18110] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 391.129874][T18110] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 391.145145][T18118] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3544'. [ 391.314981][T18124] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3546'. [ 391.335357][T18127] netlink: 'syz.3.3545': attribute type 12 has an invalid length. [ 391.383061][T18127] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3545'. [ 391.392239][T18122] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 391.673737][T18133] team0: Device gtp0 is of different type [ 392.109188][T18147] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3553'. [ 393.015488][T18166] 8021q: adding VLAN 0 to HW filter on device bond5 [ 393.584770][T18184] syzkaller1: entered promiscuous mode [ 393.590710][T18184] syzkaller1: entered allmulticast mode [ 393.599530][T18184] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3563'. [ 393.609201][T18184] netlink: 'syz.4.3563': attribute type 58 has an invalid length. [ 393.617556][T18184] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3563'. [ 393.845178][T18200] IPVS: set_ctl: invalid protocol: 29 172.20.20.170:20001 [ 394.039337][T18214] netlink: 'syz.3.3575': attribute type 3 has an invalid length. [ 394.060051][T18214] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3575'. [ 394.211028][T18224] netlink: 'syz.0.3578': attribute type 11 has an invalid length. [ 394.219516][T18224] netlink: 'syz.0.3578': attribute type 11 has an invalid length. [ 394.334589][ C0] vcan0: j1939_tp_rxtimer: 0xffff88806779a800: rx timeout, send abort [ 394.666335][T18248] __nla_validate_parse: 1 callbacks suppressed [ 394.666354][T18248] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3586'. [ 394.697247][T18248] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 394.844173][ C0] vcan0: j1939_tp_rxtimer: 0xffff88806779a800: abort rx timeout. Force session deactivation [ 394.896096][T18265] xt_HMARK: spi-set and port-set can't be combined [ 395.057385][T18272] netlink: 'syz.1.3595': attribute type 1 has an invalid length. [ 395.085998][T18275] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3597'. [ 395.158632][T18286] netlink: 'syz.3.3600': attribute type 1 has an invalid length. [ 395.284205][T18286] bond6: entered promiscuous mode [ 395.290482][T18286] 8021q: adding VLAN 0 to HW filter on device bond6 [ 395.313218][T18291] netlink: 'syz.4.3601': attribute type 1 has an invalid length. [ 395.417368][T18291] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3601'. [ 395.417535][T18303] netlink: 'syz.0.3605': attribute type 21 has an invalid length. [ 395.456439][T18303] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 395.469137][T18291] netlink: 'syz.4.3601': attribute type 1 has an invalid length. [ 395.567976][T18314] netlink: 'syz.0.3605': attribute type 4 has an invalid length. [ 395.660691][T18319] lo: entered promiscuous mode [ 395.665684][T18319] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 395.803588][T18322] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3609'. [ 395.840271][T18327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3612'. [ 395.890348][T18322] wg1 speed is unknown, defaulting to 1000 [ 395.911379][T18322] wg1 speed is unknown, defaulting to 1000 [ 395.929594][T18322] wg1 speed is unknown, defaulting to 1000 [ 395.970684][T18332] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3609'. [ 396.234432][T18346] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3618'. [ 396.279531][T18322] infiniband syz0: set active [ 396.284334][T18322] infiniband syz0: added wg1 [ 396.293092][T18346] IPVS: set_ctl: invalid protocol: 52531 172.20.20.48:0 [ 396.294388][ T24] wg1 speed is unknown, defaulting to 1000 [ 396.339724][T18322] RDS/IB: syz0: added [ 396.343800][T18322] smc: adding ib device syz0 with port count 1 [ 396.351170][T18322] smc: ib device syz0 port 1 has pnetid SYZ1 (user defined) [ 396.359765][ T24] wg1 speed is unknown, defaulting to 1000 [ 396.367876][T18322] wg1 speed is unknown, defaulting to 1000 [ 396.729676][T18322] wg1 speed is unknown, defaulting to 1000 [ 396.928120][T18377] netlink: 'syz.4.3628': attribute type 1 has an invalid length. [ 396.949999][T18377] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3628'. [ 396.995120][T18377] netlink: 'syz.4.3628': attribute type 1 has an invalid length. [ 397.249041][T18322] wg1 speed is unknown, defaulting to 1000 [ 397.433259][T18322] wg1 speed is unknown, defaulting to 1000 [ 397.595695][T18322] wg1 speed is unknown, defaulting to 1000 [ 397.795284][T18398] netlink: 'syz.4.3636': attribute type 21 has an invalid length. [ 397.805570][T18394] netlink: 'syz.4.3636': attribute type 21 has an invalid length. [ 397.816162][T18397] bridge0: port 3(batadv0) entered disabled state [ 397.822939][T18397] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.830565][T18397] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.896168][T18403] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3635'. [ 397.911647][T18322] wg1 speed is unknown, defaulting to 1000 [ 398.176573][T18417] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3642'. [ 398.282787][T18413] syzkaller1: entered promiscuous mode [ 398.304497][T18413] syzkaller1: entered allmulticast mode [ 398.320840][T18420] vxcan1 speed is unknown, defaulting to 1000 [ 398.385223][T18417] tipc: Started in network mode [ 398.403700][T18417] tipc: Node identity f2079ed3854c, cluster identity 4711 [ 398.425017][T18417] tipc: Enabled bearer , priority 0 [ 398.561808][T18419] syzkaller0: entered promiscuous mode [ 398.567548][T18419] syzkaller0: entered allmulticast mode [ 398.573764][T18419] tipc: Resetting bearer [ 398.586489][T18416] tipc: Resetting bearer [ 398.607324][T18431] sock: sock_timestamping_bind_phc: sock not bind to device [ 399.437582][ T8443] tipc: Node number set to 2001444563 [ 400.469201][T18416] tipc: Disabling bearer [ 400.486084][T18431] netlink: 'syz.0.3645': attribute type 13 has an invalid length. [ 400.497368][T18437] __nla_validate_parse: 3 callbacks suppressed [ 400.497387][T18437] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3645'. [ 400.497592][T18322] wg1 speed is unknown, defaulting to 1000 [ 400.503714][T18437] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3645'. [ 400.524004][T18420] hsr0 speed is unknown, defaulting to 1000 [ 400.971675][T18322] wg1 speed is unknown, defaulting to 1000 [ 401.157122][ T5186] Bluetooth: hci4: command 0x0406 tx timeout [ 401.301164][T18420] wg1 speed is unknown, defaulting to 1000 [ 401.709084][T18322] wg1 speed is unknown, defaulting to 1000 [ 402.015427][T18480] netlink: 'syz.3.3659': attribute type 1 has an invalid length. [ 402.075264][T18482] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3659'. [ 402.192606][T18480] veth3: entered promiscuous mode [ 402.240747][T18480] bond7: (slave veth3): Enslaving as a backup interface with a down link [ 402.434863][T18497] netlink: 'syz.3.3664': attribute type 2 has an invalid length. [ 402.464583][T18497] netlink: 'syz.3.3664': attribute type 2 has an invalid length. [ 402.530513][T18500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3665'. [ 402.554529][T18502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3666'. [ 402.581487][T18502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3666'. [ 402.803048][T18506] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3667'. [ 402.829261][T18508] netlink: 404 bytes leftover after parsing attributes in process `syz.3.3669'. [ 402.865709][T18508] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3669'. [ 402.905344][T18508] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3669'. [ 403.724874][T18545] syzkaller1: entered promiscuous mode [ 403.735878][T18545] syzkaller1: entered allmulticast mode [ 404.548734][T18551] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.601197][T18560] netlink: 'syz.4.3686': attribute type 7 has an invalid length. [ 404.609411][T18560] netlink: 'syz.4.3686': attribute type 8 has an invalid length. [ 405.115613][T18593] sctp: [Deprecated]: syz.2.3693 (pid 18593) Use of struct sctp_assoc_value in delayed_ack socket option. [ 405.115613][T18593] Use struct sctp_sack_info instead [ 405.144254][T18590] tipc: Started in network mode [ 405.175174][T18590] tipc: Node identity 52f968a1e4ae, cluster identity 4711 [ 405.205339][T18590] tipc: Enabled bearer , priority 0 [ 405.404060][T18607] netlink: 'syz.2.3695': attribute type 4 has an invalid length. [ 405.405872][T18599] syzkaller0: entered promiscuous mode [ 405.428452][T18599] syzkaller0: entered allmulticast mode [ 405.434690][T18599] tipc: Resetting bearer [ 405.453743][T18612] netlink: 'syz.1.3697': attribute type 7 has an invalid length. [ 405.481033][T18607] `: renamed from bond0 (while UP) [ 405.490138][T18612] netlink: 'syz.1.3697': attribute type 8 has an invalid length. [ 405.510993][T18587] tipc: Resetting bearer [ 405.517849][T18612] __nla_validate_parse: 9 callbacks suppressed [ 405.517867][T18612] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3697'. [ 405.633207][T18621] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3699'. [ 405.647564][T18622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3699'. [ 405.782542][T18628] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3700'. [ 406.247023][ T980] tipc: Node number set to 3059181729 [ 407.788814][T18587] tipc: Disabling bearer [ 408.138870][T18646] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3705'. [ 408.229532][T18650] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3706'. [ 408.294186][T18652] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 408.352519][T18658] netlink: 'syz.3.3709': attribute type 2 has an invalid length. [ 408.376496][T18657] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 408.609897][T18672] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3711'. [ 408.840383][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 409.605609][T18720] IPVS: length: 157 != 24 [ 411.671455][T18716] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 411.701041][T18722] tipc: Enabling of bearer rejected, failed to enable media [ 411.724209][T18743] Bluetooth: MGMT ver 1.23 [ 411.865888][T18754] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3733'. [ 411.875412][T18749] netlink: 'syz.4.3732': attribute type 1 has an invalid length. [ 411.893735][T18749] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3732'. [ 411.921561][T18754] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3733'. [ 412.009159][T18759] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3734'. [ 412.022054][T18762] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3735'. [ 412.084416][T18759] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3734'. [ 412.097816][T18759] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3734'. [ 412.183701][T18769] veth0_to_bond: entered allmulticast mode [ 412.260360][T18772] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3739'. [ 412.331732][T18778] geneve2: entered promiscuous mode [ 412.339870][T18784] tipc: Can't bind to reserved service type 2 [ 412.349318][T18779] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.3741'. [ 412.419416][T18784] IPVS: stopping backup sync thread 18789 ... [ 412.430130][T18789] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0, syncid = 512, id = 0 [ 412.656057][T18787] syzkaller1: entered promiscuous mode [ 412.673546][T18787] syzkaller1: entered allmulticast mode [ 413.020438][T18815] vxcan1 speed is unknown, defaulting to 1000 [ 413.072243][T18828] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3758'. [ 413.132958][T18832] netlink: 'syz.1.3759': attribute type 1 has an invalid length. [ 413.322922][T18839] openvswitch: netlink: IPv4 frag type 255 is out of range max 2 [ 413.779378][T18857] netlink: 'syz.4.3768': attribute type 58 has an invalid length. [ 413.820189][T18862] netlink: 'syz.0.3767': attribute type 9 has an invalid length. [ 413.903241][T18815] hsr0 speed is unknown, defaulting to 1000 [ 413.920975][T18815] wg1 speed is unknown, defaulting to 1000 [ 414.792783][T18878] tipc: Enabled bearer , priority 0 [ 415.145817][T18878] syzkaller0: entered promiscuous mode [ 415.165642][T18878] syzkaller0: entered allmulticast mode [ 415.185425][T18878] tipc: Resetting bearer [ 415.471139][ T64] tipc: Resetting bearer [ 415.510870][T18876] tipc: Resetting bearer [ 415.800607][ T8446] tipc: Node number set to 2687602165 [ 416.542969][T18928] openvswitch: netlink: IPv4 tun info is not correct [ 416.794270][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055ddd400: rx timeout, send abort [ 417.294429][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055ddf800: rx timeout, send abort [ 417.303260][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055ddd400: abort rx timeout. Force session deactivation [ 417.772842][T18876] tipc: Disabling bearer [ 417.802738][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055ddf800: abort rx timeout. Force session deactivation [ 417.932136][T18939] __nla_validate_parse: 8 callbacks suppressed [ 417.932153][T18939] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3789'. [ 417.994860][T18941] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3791'. [ 418.005978][T18943] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3792'. [ 418.130479][T18950] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3794'. [ 418.186338][T18952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3796'. [ 418.200399][T18950] macvtap1: entered promiscuous mode [ 418.205989][T18950] macvtap1: entered allmulticast mode [ 418.214439][T18950] bond_slave_0: entered promiscuous mode [ 418.220177][T18950] bond_slave_1: entered promiscuous mode [ 418.235563][T18950] bond0: entered allmulticast mode [ 418.243643][T18950] bond_slave_0: entered allmulticast mode [ 418.258033][T18950] bond_slave_1: entered allmulticast mode [ 418.268623][T18950] bond0: entered promiscuous mode [ 418.293098][T18950] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 418.312089][T18950] team0: Device macvtap1 failed to register rx_handler [ 418.325060][T18950] bond0: left allmulticast mode [ 418.333236][T18950] bond_slave_0: left allmulticast mode [ 418.340129][T18950] bond_slave_1: left allmulticast mode [ 418.345764][T18950] bond0: left promiscuous mode [ 418.354635][T18950] bond_slave_0: left promiscuous mode [ 418.360174][T18950] bond_slave_1: left promiscuous mode [ 418.407675][T18956] netlink: 'syz.4.3798': attribute type 4 has an invalid length. [ 418.443552][T18972] vlan3: entered promiscuous mode [ 418.451340][T18972] bridge0: entered promiscuous mode [ 418.548978][T18974] netlink: 'syz.0.3800': attribute type 21 has an invalid length. [ 418.557494][T18974] netlink: 'syz.0.3800': attribute type 1 has an invalid length. [ 418.844669][T19002] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !ãÙdñ4QNªå¯¿$ûÌÌULÙv…D£øUDŒw [ 419.021905][T19012] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3810'. [ 419.109276][T19015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3811'. [ 419.170608][T19019] digital: digital_start_poll: Unknown protocol [ 420.052327][T19033] tap0: tun_chr_ioctl cmd 1074025676 [ 420.059802][T19033] tap0: owner set to 0 [ 420.113243][T19036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3818'. [ 420.180083][T19037] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3818'. [ 420.346264][T19048] : entered promiscuous mode [ 420.373703][T19051] netlink: 'syz.2.3824': attribute type 10 has an invalid length. [ 420.409160][T19051] batman_adv: batadv0: Adding interface: team0 [ 420.420847][T19051] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 420.455802][T19051] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 420.505109][T19054] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3825'. [ 420.685299][T19065] netlink: 'syz.0.3830': attribute type 1 has an invalid length. [ 421.297732][ T8446] IPVS: starting estimator thread 0... [ 421.404353][T19114] tipc: Enabled bearer , priority 0 [ 421.411275][T19109] IPVS: using max 30 ests per chain, 72000 per kthread [ 421.448823][T19117] netlink: 'syz.2.3850': attribute type 1 has an invalid length. [ 421.459556][T19114] syzkaller0: entered promiscuous mode [ 421.465048][T19114] syzkaller0: entered allmulticast mode [ 421.527109][T19113] tipc: Resetting bearer [ 421.628627][T19113] tipc: Disabling bearer [ 421.645769][T19126] netlink: 'syz.1.3852': attribute type 1 has an invalid length. [ 421.720991][T19122] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 421.810745][T19117] veth3: entered promiscuous mode [ 421.829426][T19117] bond0: (slave veth3): Enslaving as a backup interface with a down link [ 421.931277][T19134] netlink: 'syz.1.3855': attribute type 12 has an invalid length. [ 422.047510][ T24] IPVS: starting estimator thread 0... [ 422.163254][T19142] IPVS: using max 25 ests per chain, 60000 per kthread [ 422.473881][T19170] hsr_slave_0 (unregistering): left promiscuous mode [ 423.017772][T19191] vxcan1 speed is unknown, defaulting to 1000 [ 423.116001][T19207] __nla_validate_parse: 12 callbacks suppressed [ 423.116020][T19207] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3878'. [ 423.181683][T19207] sctp: [Deprecated]: syz.1.3878 (pid 19207) Use of int in max_burst socket option. [ 423.181683][T19207] Use struct sctp_assoc_value instead [ 423.275143][T19191] hsr0 speed is unknown, defaulting to 1000 [ 423.284214][T19191] wg1 speed is unknown, defaulting to 1000 [ 423.383759][T19214] netlink: 'syz.4.3880': attribute type 21 has an invalid length. [ 423.451629][T19216] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3881'. [ 423.462393][T19216] netlink: 'syz.1.3881': attribute type 7 has an invalid length. [ 423.511784][T19216] netlink: 'syz.1.3881': attribute type 8 has an invalid length. [ 423.555910][T19216] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3881'. [ 423.586652][T19214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3880'. [ 423.648758][T19216] team_slave_1: entered promiscuous mode [ 423.655397][T19216] team_slave_1: left promiscuous mode [ 423.705501][T19220] syzkaller1: entered promiscuous mode [ 423.740253][T19220] syzkaller1: entered allmulticast mode [ 424.220120][T19245] dvmrp0: entered allmulticast mode [ 425.105980][T19287] netlink: 'syz.4.3902': attribute type 1 has an invalid length. [ 425.179140][T19287] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 425.192925][T19287] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 425.275222][T19293] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3902'. [ 425.294191][T19293] vlan2: entered allmulticast mode [ 425.308232][T19293] bridge0: entered allmulticast mode [ 425.318240][T19299] openvswitch: netlink: Key type 1552 is out of range max 32 [ 425.332373][T19299] netlink: 'syz.1.3907': attribute type 1 has an invalid length. [ 425.341288][T19299] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3907'. [ 425.439472][T19308] netlink: 'syz.3.3908': attribute type 33 has an invalid length. [ 425.591374][T19308] (unnamed net_device) (uninitialized): option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 425.652379][T19323] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3913'. [ 425.685230][T19323] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3913'. [ 425.692266][T19321] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3914'. [ 426.410165][T19378] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3927'. [ 426.434000][T19378] netlink: 'syz.4.3927': attribute type 10 has an invalid length. [ 426.535546][T19378] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 427.962638][T19474] netlink: 'syz.1.3960': attribute type 1 has an invalid length. [ 427.971867][T19474] netlink: 'syz.1.3960': attribute type 10 has an invalid length. [ 427.984769][T19474] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 427.997885][T19474] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.339315][T19501] __nla_validate_parse: 10 callbacks suppressed [ 428.339333][T19501] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3966'. [ 428.399375][T19501] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3966'. [ 428.439039][T19505] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3968'. [ 428.535614][T19515] netlink: 'syz.1.3972': attribute type 1 has an invalid length. [ 428.607297][T19515] 8021q: adding VLAN 0 to HW filter on device bond1 [ 428.687001][T19515] vlan3: entered allmulticast mode [ 428.692194][T19515] bond1: entered allmulticast mode [ 428.771469][T19532] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3978'. [ 428.773381][T19534] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3976'. [ 428.792890][T19534] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3976'. [ 429.049619][T19547] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3982'. [ 429.289858][T19561] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3986'. [ 429.303958][T19561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3986'. [ 429.328193][T19561] netlink: 'syz.3.3986': attribute type 20 has an invalid length. [ 429.339183][T19561] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3986'. [ 429.355195][T19561] netlink: 'syz.3.3986': attribute type 20 has an invalid length. [ 429.567454][T19576] (unnamed net_device) (uninitialized): down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 429.750631][T19594] netlink: 'syz.4.4000': attribute type 8 has an invalid length. [ 429.807145][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 430.933512][ T5866] Bluetooth: hci0: link tx timeout [ 430.940929][ T5866] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 430.956732][T19626] tipc: Started in network mode [ 430.963933][T19626] tipc: Node identity ac14140f, cluster identity 4711 [ 430.972105][T19626] tipc: New replicast peer: 255.255.255.255 [ 430.979550][T19626] tipc: Enabled bearer , priority 10 [ 431.013730][T19623] netlink: 'syz.0.4006': attribute type 1 has an invalid length. [ 431.049822][T19623] 8021q: adding VLAN 0 to HW filter on device bond1 [ 431.681061][T19665] Unsupported ieee802154 address type: 0 [ 431.706079][T19666] siw: device registration error -23 [ 432.097755][ T8443] tipc: Node number set to 2886997007 [ 432.261799][T19691] netlink: 'syz.2.4030': attribute type 1 has an invalid length. [ 433.020367][ T5186] Bluetooth: hci0: command 0x0406 tx timeout [ 433.460833][T19721] __nla_validate_parse: 11 callbacks suppressed [ 433.460851][T19721] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4040'. [ 433.490242][T19723] netlink: 'syz.0.4041': attribute type 10 has an invalid length. [ 433.551386][T19725] batadv_slave_1: entered promiscuous mode [ 433.568415][T19728] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 433.580568][T19725] batman_adv: batadv0: Adding interface: macsec2 [ 433.629137][T19725] batman_adv: batadv0: The MTU of interface macsec2 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 433.694376][T19745] netlink: 'syz.3.4042': attribute type 10 has an invalid length. [ 433.714228][T19745] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4042'. [ 433.757766][T19725] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 433.805606][T19725] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 433.826369][T19725] batman_adv: batadv0: Interface activated: macsec2 [ 433.836242][T19723] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 433.860373][T19745] dummy0: entered promiscuous mode [ 433.910693][T19745] bridge0: port 4(dummy0) entered blocking state [ 433.918304][T19745] bridge0: port 4(dummy0) entered disabled state [ 433.930463][T19745] dummy0: entered allmulticast mode [ 433.961526][T19759] netlink: 'syz.2.4048': attribute type 10 has an invalid length. [ 433.973274][T19759] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.981107][T19759] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.004108][T19759] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.011409][T19759] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.019017][T19759] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.026224][T19759] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.048560][T19759] `: (slave bridge0): Enslaving as an active interface with an up link [ 434.088468][T19761] netlink: 'syz.3.4049': attribute type 3 has an invalid length. [ 434.109225][T19761] netlink: 498 bytes leftover after parsing attributes in process `syz.3.4049'. [ 434.153124][T19762] netlink: 'syz.3.4049': attribute type 3 has an invalid length. [ 434.163235][T19762] netlink: 498 bytes leftover after parsing attributes in process `syz.3.4049'. [ 434.174882][T19764] tipc: Enabled bearer , priority 0 [ 434.224741][T19764] sctp: [Deprecated]: syz.0.4050 (pid 19764) Use of int in maxseg socket option. [ 434.224741][T19764] Use struct sctp_assoc_value instead [ 434.300384][T19763] tipc: Disabling bearer [ 434.391591][T19780] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4055'. [ 434.468094][T19785] pimreg3: entered allmulticast mode [ 434.825713][T19810] netlink: 'syz.0.4064': attribute type 1 has an invalid length. [ 434.882474][T19802] can: request_module (can-proto-0) failed. [ 434.888684][T19810] netlink: 'syz.0.4064': attribute type 4 has an invalid length. [ 434.888706][T19810] netlink: 9422 bytes leftover after parsing attributes in process `syz.0.4064'. [ 435.434858][T19845] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4074'. [ 435.515412][T19854] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4077'. [ 435.569440][T19848] syzkaller0: entered promiscuous mode [ 435.574949][T19848] syzkaller0: entered allmulticast mode [ 435.610082][T19858] vxcan1 speed is unknown, defaulting to 1000 [ 436.053893][T19878] openvswitch: netlink: IPv6 tunnel dst address is zero [ 436.093119][T19881] tipc: Enabling of bearer rejected, failed to enable media [ 436.130960][T19858] hsr0 speed is unknown, defaulting to 1000 [ 436.139478][T19858] wg1 speed is unknown, defaulting to 1000 [ 436.216249][T19886] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4084'. [ 436.300538][T19885] netlink: 'syz.1.4086': attribute type 1 has an invalid length. [ 436.309509][T19885] netlink: 'syz.1.4086': attribute type 3 has an invalid length. [ 436.327033][T19885] netlink: 216 bytes leftover after parsing attributes in process `syz.1.4086'. [ 436.336099][T19885] NCSI netlink: No device for ifindex 813332851 [ 436.766392][T19907] netlink: 'syz.0.4091': attribute type 20 has an invalid length. [ 436.797994][T19913] batadv_slave_0: entered promiscuous mode [ 436.804210][ T1157] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.902236][ T1157] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.922637][ T1157] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 436.962592][T19912] batadv_slave_0: left promiscuous mode [ 437.332818][T19933] netlink: 'syz.2.4098': attribute type 1 has an invalid length. [ 438.483090][T19993] __nla_validate_parse: 10 callbacks suppressed [ 438.483109][T19993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4120'. [ 438.508205][T19993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4120'. [ 438.599583][T19999] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 438.632158][T20006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4123'. [ 438.710769][T20006] veth5: entered allmulticast mode [ 438.753477][ T48] tipc: Subscription rejected, illegal request [ 438.779036][T20012] validate_nla: 2 callbacks suppressed [ 438.779055][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.793718][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.822625][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.838185][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.849876][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.872564][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.897765][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.920422][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 438.946718][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 439.000309][T20023] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4127'. [ 439.012110][T20012] netlink: 'syz.2.4125': attribute type 33 has an invalid length. [ 439.042639][T20023] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4127'. [ 439.077984][T20023] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4127'. [ 439.209671][T20029] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4129'. [ 439.679435][T20052] A link change request failed with some changes committed already. Interface ` may have been left with an inconsistent configuration, please check. [ 439.731613][T20058] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4139'. [ 439.852999][T20061] vlan3: entered allmulticast mode [ 439.858971][T20061] bond0: entered allmulticast mode [ 439.864111][T20061] bond_slave_0: entered allmulticast mode [ 439.872149][ T1157] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 439.888410][T20061] bond_slave_1: entered allmulticast mode [ 439.998016][T20066] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4142'. [ 440.321863][T20089] ipvlan2: entered promiscuous mode [ 440.344278][T20093] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4147'. [ 440.707468][T20108] tipc: Enabled bearer , priority 0 [ 440.730370][T20108] syzkaller0: entered promiscuous mode [ 440.735880][T20108] syzkaller0: entered allmulticast mode [ 440.824882][T20119] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 440.960793][T20119] tipc: Resetting bearer [ 440.996301][T20107] tipc: Resetting bearer [ 441.058245][T20107] tipc: Disabling bearer [ 441.321107][T20144] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 441.355618][T20144] batadv0: entered allmulticast mode [ 441.364730][T20144] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 441.394619][T20144] batadv0: entered promiscuous mode [ 441.428255][T20144] bond0: (slave batadv0): Releasing backup interface [ 441.440882][T20144] bridge0: port 3(batadv0) entered blocking state [ 441.456947][T20144] bridge0: port 3(batadv0) entered disabled state [ 441.570642][ T36] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 441.580614][ T36] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 442.180979][T20194] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 442.676744][T20224] netlink: 'syz.2.4187': attribute type 11 has an invalid length. [ 442.735844][T20228] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 443.386319][T20269] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 443.588509][T20275] tipc: Enabled bearer , priority 0 [ 443.596027][T20275] syzkaller0: entered promiscuous mode [ 443.615018][T20275] syzkaller0: entered allmulticast mode [ 443.682914][T20284] __nla_validate_parse: 13 callbacks suppressed [ 443.682932][T20284] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4208'. [ 443.722075][T20275] tipc: Resetting bearer [ 443.758825][T20274] tipc: Resetting bearer [ 443.811965][T20274] tipc: Disabling bearer [ 443.892135][T20297] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4210'. [ 444.139413][T20312] validate_nla: 32 callbacks suppressed [ 444.139431][T20312] netlink: 'syz.0.4215': attribute type 1 has an invalid length. [ 444.171009][T20313] openvswitch: netlink: Actions may not be safe on all matching packets [ 444.180338][T20312] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.4215'. [ 444.285737][T20317] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4215'. [ 444.348762][T20323] netlink: 'syz.3.4221': attribute type 1 has an invalid length. [ 444.365859][T20323] netlink: 'syz.3.4221': attribute type 1 has an invalid length. [ 444.544224][T20334] netlink: 'syz.3.4224': attribute type 29 has an invalid length. [ 444.578003][T20336] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4225'. [ 444.615491][T20336] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4225'. [ 444.730619][T20345] tipc: Enabled bearer , priority 0 [ 444.792842][T20345] tipc: Disabling bearer [ 444.817605][T20352] netlink: 'syz.0.4231': attribute type 1 has an invalid length. [ 444.825967][T20352] netlink: 'syz.0.4231': attribute type 2 has an invalid length. [ 444.834029][T20350] netlink: 'syz.3.4228': attribute type 29 has an invalid length. [ 444.845820][T20350] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4228'. [ 444.870547][T20359] netlink: 'syz.0.4231': attribute type 1 has an invalid length. [ 444.870738][T20357] netlink: 'syz.3.4228': attribute type 29 has an invalid length. [ 444.888216][T20359] netlink: 'syz.0.4231': attribute type 2 has an invalid length. [ 444.907225][T20357] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4228'. [ 444.945699][T20363] netlink: 244 bytes leftover after parsing attributes in process `syz.1.4232'. [ 445.027335][T20357] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4228'. [ 445.661335][T20405] batadv_slave_1: Device is already in use. [ 446.294977][T20443] vlan3: entered allmulticast mode [ 446.300910][T20443] bond0: entered allmulticast mode [ 446.306202][T20443] bond_slave_0: entered allmulticast mode [ 446.312762][T20443] bond_slave_1: entered allmulticast mode [ 446.559074][T20465] nftables ruleset with unbound set [ 446.856390][T20451] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 446.904373][ T36] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.917061][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 446.926060][ T36] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.936194][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 446.968454][ T36] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.996583][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 447.152378][T20491] gre0: entered promiscuous mode [ 447.191389][T20490] bridge0: port 3(batadv0) entered disabled state [ 447.218848][T20490] bridge_slave_0: left allmulticast mode [ 447.228836][T20490] bridge_slave_0: left promiscuous mode [ 447.245333][T20490] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.303102][T20490] bridge_slave_1: left allmulticast mode [ 447.315677][T20490] bridge_slave_1: left promiscuous mode [ 447.342822][T20490] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.374603][T20490] bond0: (slave bond_slave_0): Releasing backup interface [ 447.403728][T20490] bond_slave_0: left allmulticast mode [ 447.464501][T20490] bond0: (slave bond_slave_1): Releasing backup interface [ 447.513146][T20490] bond_slave_1: left allmulticast mode [ 447.552461][T20490] team0: Port device team_slave_0 removed [ 447.589534][T20490] team0: Port device team_slave_1 removed [ 447.596728][T20490] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 447.615738][T20490] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 447.637593][T20490] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 447.646327][T20490] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 447.702969][T20502] bond0: entered promiscuous mode [ 447.739062][T20502] bond0: left promiscuous mode [ 448.354808][T20543] team0: Device ipvlan1 failed to register rx_handler [ 448.603201][T20553] vxcan1 speed is unknown, defaulting to 1000 [ 448.710094][T20565] __nla_validate_parse: 16 callbacks suppressed [ 448.710114][T20565] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4291'. [ 448.913510][T20564] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.920946][T20564] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.204299][T20577] validate_nla: 9 callbacks suppressed [ 449.204317][T20577] netlink: 'syz.0.4294': attribute type 1 has an invalid length. [ 449.231215][T20564] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.269092][T20564] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 449.270637][T20578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4294'. [ 449.436740][T20564] geneve2: left promiscuous mode [ 449.446538][T20564] veth3: left promiscuous mode [ 449.476690][ T8441] wg1 speed is unknown, defaulting to 1000 [ 449.497235][ T8441] syz0: Port: 1 Link DOWN [ 449.544790][T20553] hsr0 speed is unknown, defaulting to 1000 [ 449.576586][T19345] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.602960][T19345] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.620466][ T8441] wg1 speed is unknown, defaulting to 1000 [ 449.620750][T20582] vlan1: entered allmulticast mode [ 449.652653][T20582] veth0_vlan: entered allmulticast mode [ 449.659285][T19345] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.687017][T19345] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.695971][ T1157] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 449.710014][T20553] wg1 speed is unknown, defaulting to 1000 [ 449.775046][ T1157] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 449.801743][ T1157] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 449.910808][T20598] tipc: Enabled bearer , priority 0 [ 449.948522][T20598] syzkaller0: entered promiscuous mode [ 449.954477][T20598] syzkaller0: entered allmulticast mode [ 450.105527][T20613] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4303'. [ 450.144422][T20598] tipc: Resetting bearer [ 450.162709][T20595] tipc: Resetting bearer [ 450.248570][T20595] tipc: Disabling bearer [ 450.277847][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.407660][T20615] tipc: Enabled bearer , priority 0 [ 450.442102][T20619] syzkaller0: entered promiscuous mode [ 450.465601][T20619] syzkaller0: entered allmulticast mode [ 450.489504][T20615] netlink: 'syz.0.4304': attribute type 2 has an invalid length. [ 450.498300][T20615] netlink: 1184 bytes leftover after parsing attributes in process `syz.0.4304'. [ 450.532533][T20630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4307'. [ 450.556109][T20615] tipc: Resetting bearer [ 450.590797][T20614] tipc: Resetting bearer [ 450.657977][T20614] tipc: Disabling bearer [ 450.863363][T20641] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 451.495975][T20671] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4315'. [ 451.575638][T20671] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4315'. [ 451.735949][T20671] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4315'. [ 451.867982][T20677] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4316'. [ 451.919216][T20677] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4316'. [ 452.217820][T20699] IPVS: set_ctl: invalid protocol: 43 172.30.0.2:20000 [ 452.231070][T20697] vxcan1 speed is unknown, defaulting to 1000 [ 452.291561][T20690] sit0: entered promiscuous mode [ 452.296716][T20690] sit0: entered allmulticast mode [ 452.439836][T20707] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (18446744073709551613) [ 452.599869][T20714] syzkaller1: entered promiscuous mode [ 452.607340][T20714] syzkaller1: entered allmulticast mode [ 452.706537][T20721] tipc: Enabling of bearer rejected, failed to enable media [ 452.908502][T20697] hsr0 speed is unknown, defaulting to 1000 [ 452.944814][T20697] wg1 speed is unknown, defaulting to 1000 [ 453.024816][T20731] tipc: Enabled bearer , priority 0 [ 453.133800][T20731] syzkaller0: entered promiscuous mode [ 453.152595][T20731] syzkaller0: entered allmulticast mode [ 453.166727][T20741] veth0_to_bridge: entered promiscuous mode [ 453.192732][ T1102] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.241685][T20740] veth0_to_bridge: left promiscuous mode [ 453.266656][ T1102] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.304675][ T1102] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.334241][ T1102] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.551565][T20760] netlink: 'syz.4.4343': attribute type 1 has an invalid length. [ 453.689296][T20763] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 453.703966][T20763] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 453.751586][T20765] gretap2: entered promiscuous mode [ 453.775264][T20765] bond4: (slave gretap2): making interface the new active one [ 453.812858][T20765] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 453.833893][T20728] tipc: Resetting bearer [ 453.854449][T20728] tipc: Disabling bearer [ 453.943488][T20780] xt_l2tp: invalid flags combination: 8 [ 454.071440][T20788] netlink: 'syz.4.4348': attribute type 1 has an invalid length. [ 454.105205][T20788] __nla_validate_parse: 12 callbacks suppressed [ 454.105222][T20788] netlink: 172 bytes leftover after parsing attributes in process `syz.4.4348'. [ 454.260685][T20787] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 454.441734][T20799] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4353'. [ 454.528886][T20807] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4354'. [ 454.962783][T20819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4359'. [ 455.085117][T20823] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4361'. [ 455.134235][T20825] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 455.155208][T20825] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4362'. [ 455.183283][T20825] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4362'. [ 455.226021][T20829] IPv6: Can't replace route, no match found [ 455.238180][T20823] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4361'. [ 455.456086][T20841] pim6reg1: entered promiscuous mode [ 455.477893][T20841] pim6reg1: entered allmulticast mode [ 455.483929][ T30] audit: type=1800 audit(1758394979.050:5): pid=20844 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4367" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=1280 res=0 errno=0 [ 455.921787][T20873] netlink: 'syz.4.4374': attribute type 87 has an invalid length. [ 455.965199][T20873] netlink: 'syz.4.4374': attribute type 87 has an invalid length. [ 456.192793][T20893] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4377'. [ 456.205610][T20891] netlink: 'syz.3.4380': attribute type 33 has an invalid length. [ 456.395652][T20887] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4379'. [ 456.556012][T20907] netlink: 'syz.3.4384': attribute type 5 has an invalid length. [ 456.633529][T20907] geneve2: entered promiscuous mode [ 456.655941][T20907] geneve2: entered allmulticast mode [ 456.727845][ T36] netdevsim netdevsim3 ÿÿÿÿÿÿ: set [1, 1] type 2 family 0 port 256 - 0 [ 456.738977][ T36] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 456.751726][ T36] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 456.789855][ T1102] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 458.155075][T20970] sctp: [Deprecated]: syz.0.4398 (pid 20970) Use of struct sctp_assoc_value in delayed_ack socket option. [ 458.155075][T20970] Use struct sctp_sack_info instead [ 458.422884][T20944] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 458.458982][T20944] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 458.817393][T20944] batman_adv: batadv0: Interface deactivated: macsec2 [ 459.035758][T19339] netdevsim netdevsim3 ÿÿÿÿÿÿ: unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.075081][T19339] netdevsim netdevsim3 ÿÿÿÿÿÿ: unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.099756][T19339] netdevsim netdevsim3 ÿÿÿÿÿÿ: unset [1, 1] type 2 family 0 port 256 - 0 [ 459.184081][T19339] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.214019][T19339] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.258400][T19339] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 459.303303][T20974] __nla_validate_parse: 3 callbacks suppressed [ 459.303321][T20974] netlink: 5636 bytes leftover after parsing attributes in process `syz.4.4400'. [ 459.343127][T19339] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.372572][T19339] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.404182][T19339] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 459.480823][T19339] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.500460][T19339] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.515862][T19339] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 459.817304][T21014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4409'. [ 459.852082][T21014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4409'. [ 459.941115][T21023] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4409'. [ 460.511411][T21022] tipc: Enabled bearer , priority 0 [ 460.648629][T21022] tipc: Disabling bearer [ 460.750536][T21035] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4414'. [ 460.834728][T21047] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4417'. [ 461.140226][T21060] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4420'. [ 461.153623][T21061] netlink: 'syz.2.4423': attribute type 1 has an invalid length. [ 461.202220][T21061] 8021q: adding VLAN 0 to HW filter on device bond1 [ 461.290530][T21078] netlink: 112 bytes leftover after parsing attributes in process `syz.2.4426'. [ 461.335372][T21081] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4427'. [ 461.351905][T21081] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4427'. [ 461.453936][T21089] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 461.608662][T21095] netlink: 'syz.1.4431': attribute type 1 has an invalid length. [ 461.754510][T21103] veth1_to_bond: entered allmulticast mode [ 461.794734][T21105] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.978839][T21103] veth1_to_bond (unregistering): left allmulticast mode [ 462.440532][T21137] tipc: Enabled bearer , priority 0 [ 462.534948][T21137] syzkaller0: entered promiscuous mode [ 462.558510][T21137] syzkaller0: entered allmulticast mode [ 462.573858][T21137] tipc: Resetting bearer [ 462.679481][ T5866] Bluetooth: hci1: command tx timeout [ 462.778428][ T12] tipc: Resetting bearer [ 462.799713][T21136] tipc: Resetting bearer [ 463.054465][T21183] sctp: [Deprecated]: syz.4.4458 (pid 21183) Use of struct sctp_assoc_value in delayed_ack socket option. [ 463.054465][T21183] Use struct sctp_sack_info instead [ 464.757910][ T5866] Bluetooth: hci1: command tx timeout [ 465.145127][T21136] tipc: Disabling bearer [ 465.173430][T21181] tipc: Enabled bearer , priority 0 [ 465.181794][T21184] syzkaller0: entered promiscuous mode [ 465.197635][T21184] syzkaller0: entered allmulticast mode [ 465.270466][T21195] netlink: 'syz.3.4459': attribute type 1 has an invalid length. [ 465.279406][T21195] netlink: 'syz.3.4459': attribute type 1 has an invalid length. [ 465.331208][T21192] tipc: Resetting bearer [ 465.389905][T21192] tipc: Disabling bearer [ 465.404931][T21204] __nla_validate_parse: 14 callbacks suppressed [ 465.404948][T21204] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4462'. [ 465.540527][T21214] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4465'. [ 465.559782][T21213] tipc: Enabling of bearer rejected, failed to enable media [ 465.578311][T21213] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4464'. [ 465.603845][T21218] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 465.825290][T21234] netlink: 14 bytes leftover after parsing attributes in process `syz.2.4469'. [ 466.158114][T21234] ` (unregistering): (slave bond_slave_0): Releasing backup interface [ 466.172901][T21234] ` (unregistering): (slave bond_slave_1): Releasing backup interface [ 466.183970][T21234] ` (unregistering): (slave bridge0): Releasing backup interface [ 466.194220][T21234] ` (unregistering): Released all slaves [ 466.219001][T21245] ip6gre1: entered allmulticast mode [ 466.367417][T21255] openvswitch: netlink: VXLAN extension 47 out of range max 1 [ 466.449151][T21259] tipc: Enabled bearer , priority 0 [ 466.456549][T21259] syzkaller0: entered promiscuous mode [ 466.462596][T21259] syzkaller0: entered allmulticast mode [ 466.472133][T21259] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 466.543559][T21259] tipc: Resetting bearer [ 466.668528][T21273] tipc: Resetting bearer [ 466.713818][T21273] tipc: Disabling bearer [ 466.945577][T21279] vxcan1 speed is unknown, defaulting to 1000 [ 467.100176][T21283] tipc: Enabled bearer , priority 0 [ 467.114751][T21285] syzkaller0: entered promiscuous mode [ 467.127468][T21285] syzkaller0: entered allmulticast mode [ 467.207025][T21282] tipc: Resetting bearer [ 467.275466][T21293] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4488'. [ 467.286472][T21282] tipc: Disabling bearer [ 467.310628][T21293] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4488'. [ 467.337183][T21293] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4488'. [ 467.641424][T21279] hsr0 speed is unknown, defaulting to 1000 [ 467.678192][T21279] wg1 speed is unknown, defaulting to 1000 [ 467.854853][T21317] netlink: 576 bytes leftover after parsing attributes in process `syz.4.4495'. [ 467.980110][T21321] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.4497'. [ 468.540306][T21338] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 468.549961][T21338] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4501'. [ 468.833673][T21354] netlink: 'syz.3.4504': attribute type 1 has an invalid length. [ 469.198387][T21354] bond9: entered promiscuous mode [ 469.204013][T21354] 8021q: adding VLAN 0 to HW filter on device bond9 [ 469.245668][T21359] bond9: (slave bridge3): making interface the new active one [ 469.257604][T21359] bridge3: entered promiscuous mode [ 469.264234][T21359] bond9: (slave bridge3): Enslaving as an active interface with an up link [ 469.450754][T21385] lo: left promiscuous mode [ 469.554189][T21385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 469.583190][T21385] 8021q: adding VLAN 0 to HW filter on device team0 [ 469.633694][T21385] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 470.269530][T21427] tipc: Enabled bearer , priority 0 [ 470.298055][T21427] syzkaller0: entered promiscuous mode [ 470.303561][T21427] syzkaller0: entered allmulticast mode [ 470.319263][T21427] tipc: Resetting bearer [ 470.341720][T21425] tipc: Resetting bearer [ 470.402824][T21425] tipc: Disabling bearer [ 470.433448][T21436] netlink: 'syz.0.4523': attribute type 4 has an invalid length. [ 470.607996][T21442] __nla_validate_parse: 4 callbacks suppressed [ 470.608016][T21442] netlink: 380 bytes leftover after parsing attributes in process `syz.1.4525'. [ 470.894383][ T36] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 470.947823][T21471] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4534'. [ 471.151948][T21485] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4539'. [ 471.379666][T21500] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4542'. [ 471.561204][T21509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4544'. [ 471.672129][T21513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4546'. [ 471.761752][T21519] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4548'. [ 471.768842][T21518] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4547'. [ 471.776598][T21517] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input8 [ 471.896234][T21519] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4548'. [ 471.920199][T21526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4548'. [ 472.277266][T21544] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 472.998719][T21585] netlink: 'syz.1.4566': attribute type 10 has an invalid length. [ 473.073546][T21585] bridge0: entered allmulticast mode [ 473.099867][T21585] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 473.186212][T21595] syzkaller1: entered promiscuous mode [ 473.191862][T21595] syzkaller1: entered allmulticast mode [ 473.212738][T21596] netlink: 'syz.2.4568': attribute type 178 has an invalid length. [ 473.674671][T21628] dvmrp0: left allmulticast mode [ 473.842446][T21637] dummy0: left allmulticast mode [ 473.848805][T21637] bridge0: port 4(dummy0) entered disabled state [ 473.859972][T21637] batman_adv: batadv0: Adding interface: dummy0 [ 473.866747][T21637] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 473.896537][T21637] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 474.055738][T21645] netlink: 'syz.3.4583': attribute type 19 has an invalid length. [ 474.075377][T21646] (unnamed net_device) (uninitialized): ARP target 1.0.0.0 is already present [ 474.085414][T21646] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (1) [ 474.308314][T21655] (unnamed net_device) (uninitialized): option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 474.973080][T21684] tipc: Enabled bearer , priority 0 [ 475.003926][T21684] tipc: Resetting bearer [ 475.032076][T21682] tipc: Disabling bearer [ 475.089857][T21701] netlink: 'syz.1.4600': attribute type 21 has an invalid length. [ 475.099603][T21701] netlink: 'syz.1.4600': attribute type 22 has an invalid length. [ 475.108314][T21701] netlink: 'syz.1.4600': attribute type 23 has an invalid length. [ 475.116326][T21701] netlink: 'syz.1.4600': attribute type 25 has an invalid length. [ 475.125386][T21701] netlink: 'syz.1.4600': attribute type 26 has an invalid length. [ 475.665351][T21729] __nla_validate_parse: 13 callbacks suppressed [ 475.665370][T21729] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4607'. [ 475.835279][T21737] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4612'. [ 475.964537][T21746] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4613'. [ 476.308514][T21769] netlink: 'syz.3.4621': attribute type 10 has an invalid length. [ 476.464211][T21776] syzkaller1: entered promiscuous mode [ 476.481617][T21776] syzkaller1: entered allmulticast mode [ 476.829132][T21803] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4634'. [ 476.860514][T21803] openvswitch: netlink: Unknown nsh attribute 0 [ 476.897416][T21803] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.966411][T21813] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4636'. [ 476.985027][T21813] hsr_slave_0: left promiscuous mode [ 476.995326][T21813] hsr_slave_1: left promiscuous mode [ 477.055629][T21818] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.424939][T21832] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4642'. [ 477.444733][T21832] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.485162][T21832] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.609784][T21842] netlink: 'syz.1.4643': attribute type 7 has an invalid length. [ 477.957079][ T5871] Bluetooth: hci1: command 0x0406 tx timeout [ 477.963298][ T5882] Bluetooth: hci2: command 0x0406 tx timeout [ 478.029200][ T5878] IPVS: starting estimator thread 0... [ 478.034503][T21863] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4650'. [ 478.122118][T21869] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4652'. [ 478.127701][T21867] IPVS: using max 28 ests per chain, 67200 per kthread [ 478.253378][T21881] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4657'. [ 478.262079][T21879] netlink: 580 bytes leftover after parsing attributes in process `syz.1.4656'. [ 478.475658][T21898] netlink: 'syz.0.4662': attribute type 1 has an invalid length. [ 478.492970][T21898] netlink: 'syz.0.4662': attribute type 1 has an invalid length. [ 478.795178][T21914] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 479.469558][T21957] validate_nla: 3 callbacks suppressed [ 479.469576][T21957] netlink: 'syz.2.4682': attribute type 1 has an invalid length. [ 479.710808][T21974] xt_HMARK: spi-set and port-set can't be combined [ 479.733241][T21977] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 479.900649][T19339] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 479.931228][ T54] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 479.943012][T19339] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 480.247645][ T5878] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 480.319027][ T5878] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! Connection to 10.128.1.189 closed by remote host. [ 481.719130][ T1102] bridge0: port 3(batadv0) entered disabled state [ 481.727667][ T1102] bridge_slave_1: left allmulticast mode [ 481.733337][ T1102] bridge_slave_1: left promiscuous mode [ 481.739558][ T1102] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.750731][ T1102] bridge_slave_0: left allmulticast mode [ 481.756391][ T1102] bridge_slave_0: left promiscuous mode [ 481.763249][ T1102] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.944306][ T1102] bond3 (unregistering): (slave gretap1): Releasing active interface [ 481.969306][ T1102] bond4 (unregistering): (slave gretap2): Releasing active interface [ 482.251440][ T1102] bond9 (unregistering): (slave bridge3): Releasing backup interface [ 482.261253][ T1102] bridge3 (unregistering): left promiscuous mode [ 482.478923][ T1102] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 482.488231][ T1102] bond_slave_0: left allmulticast mode [ 482.494725][ T1102] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 482.504017][ T1102] bond_slave_1: left allmulticast mode [ 482.510724][ T1102] bond0 (unregistering): Released all slaves [ 482.643471][ T1102] bond1 (unregistering): Released all slaves [ 482.656261][ T1102] bond2 (unregistering): Released all slaves [ 482.794647][ T1102] bond3 (unregistering): Released all slaves [ 482.808965][ T1102] bond4 (unregistering): Released all slaves [ 482.938067][ T1102] bond5 (unregistering): Released all slaves [ 483.069853][ T1102] bond6 (unregistering): Released all slaves [ 483.088116][ T1102] bond7 (unregistering): (slave veth3): Releasing backup interface [ 483.097700][ T1102] bond7 (unregistering): Released all slaves [ 483.112309][ T1102] bond8 (unregistering): Released all slaves [ 483.246115][ T1102] bond9 (unregistering): Released all slaves [ 483.405806][ T1102] tipc: Left network mode [ 483.821139][ T1102] hsr_slave_0: left promiscuous mode [ 483.832935][ T1102] hsr_slave_1: left promiscuous mode [ 483.841959][ T1102] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 483.850896][ T1102] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 483.858959][ T1102] batman_adv: batadv0: Removing interface: team0 [ 483.865945][ T1102] batman_adv: batadv0: Removing interface: macsec2 [ 483.873574][ T1102] batman_adv: batadv0: Removing interface: dummy0 [ 483.895526][ T1102] pimreg3 (unregistering): left allmulticast mode [ 483.964043][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 484.272078][ T1102] team0 (unregistering): Port device team_slave_1 removed [ 484.321984][ T1102] team0 (unregistering): Port device team_slave_0 removed [ 485.030687][ T1102] IPVS: stop unused estimator thread 0...