last executing test programs: 6m52.835415477s ago: executing program 2 (id=3441): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000300)="4800000014001d1009074beafd0d8c560a84606080ffe020590000a2bc5603ca00000f7f8907000020008d42188fedc22e47ad8f75edc6d100000101ff0000000309ff5b00000000", 0x48}], 0x1) 6m52.679780302s ago: executing program 2 (id=3444): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWSET={0x15c, 0x9, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DESC={0x108, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_DESC_CONCAT={0xfc, 0x2, 0x0, 0x1, [{0xfffffffffffffe7c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xd4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x800}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x47001874}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff7fff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1b29}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3849}]}]}]}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x9c, 0x6, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT={0x3c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x6f}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x4}]}, @NFTA_RULE_ID={0x0, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT={0x24, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x884c}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x80f3}, @NFTA_RULE_COMPAT_FLAGS={0x8}]}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x101, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x64, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0x7}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffc}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_TYPE={0x0, 0x7, 'route\x00'}]}, @NFT_MSG_DELTABLE={0x30, 0x2, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_TABLE_USERDATA={0x19, 0x6, "ae97e1ce74c087c5d1aab14ad9afdfb00b2126d864"}]}, @NFT_MSG_DELCHAIN={0xa4, 0x5, 0xa, 0xc00, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffe}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_COUNTERS={0x64, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xfffffffffffffff9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x54f}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x2}]}, @NFTA_CHAIN_POLICY={0x8}]}, @NFT_MSG_DELTABLE={0x68, 0x2, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_TABLE_FLAGS={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x3e0}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) 6m52.316710196s ago: executing program 2 (id=3451): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x58}}, 0x0) 6m52.166925652s ago: executing program 2 (id=3456): r0 = socket(0x2a, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000380)={'ip6tnl0\x00', 0x0}) 6m51.975078637s ago: executing program 2 (id=3461): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@ipv6_newaddr={0x48, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {}, [@IFA_LOCAL={0x14, 0xb, @dev}, @IFA_ADDRESS={0x14, 0x1, @mcast2}, @IFA_RT_PRIORITY={0x8}]}, 0x48}}, 0x0) 6m51.657074387s ago: executing program 2 (id=3469): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x14, 0x25, 0x1, 0x70bd2d, 0x2ddfdbfc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 6m36.621798865s ago: executing program 32 (id=3469): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x14, 0x25, 0x1, 0x70bd2d, 0x2ddfdbfc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 1m50.042088233s ago: executing program 3 (id=10611): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x19, 0x4, 0x4, 0x4}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000100)={r1, r2}, 0xc) 1m49.835976117s ago: executing program 3 (id=10617): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)={0x28, r2, 0x1, 0x70bd29, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x28}}, 0x0) 1m49.648083007s ago: executing program 3 (id=10622): ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000800000000000000000000000000000002"]) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 1m49.58330732s ago: executing program 3 (id=10624): unshare(0x20000400) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000000)=ANY=[], 0x4) 1m49.41099526s ago: executing program 3 (id=10629): r0 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000034000)={0x5, {{0xa, 0x4e21, 0xffffff00, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000300)={0x2, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) 1m49.265205207s ago: executing program 3 (id=10634): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000240)='pmap_register\x00', r1, 0x0, 0xf69}, 0x18) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 1m34.200238116s ago: executing program 33 (id=10634): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000240)='pmap_register\x00', r1, 0x0, 0xf69}, 0x18) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 1m17.678936907s ago: executing program 0 (id=11237): socket$kcm(0x2, 0xa, 0x73) socket$kcm(0x2, 0xa, 0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1m17.204299811s ago: executing program 0 (id=11246): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x8, 'macsec0\x00', {'wlan1\x00'}}) r0 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x2c) 1m17.059009568s ago: executing program 0 (id=11250): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2e8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000078000000030a01030000000000000000050000000900010073797a300000000008000540000000001c0008800c00024000000000000000000c00014000000000000000000900030073797a3200000000280004800800024000000000140003007465616d5f736c6176655f3000000000080001"], 0xd4}}, 0x0) 1m16.862074183s ago: executing program 0 (id=11254): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x4a, 0x800000, 0x8, 0x5, 0x80, 0x81}) write$bt_hci(r0, &(0x7f0000000080)=ANY=[], 0x6) 1m16.722939472s ago: executing program 0 (id=11256): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000080)={0x0, 0x1, 0x7, 0x9}) 1m16.60988451s ago: executing program 0 (id=11258): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) unshare(0x28000600) unshare(0x24020400) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 1m1.533624464s ago: executing program 34 (id=11258): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) unshare(0x28000600) unshare(0x24020400) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 10.35741197s ago: executing program 5 (id=12422): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000000000001850000007500000095"], 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c9f7b9a6fffff00000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 10.233008986s ago: executing program 5 (id=12426): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000f8"], 0x0, 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={&(0x7f0000000180), &(0x7f0000000440)=""/179, &(0x7f0000000500), &(0x7f00000006c0), 0x3, r0}, 0x38) 10.10015623s ago: executing program 5 (id=12429): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x49, &(0x7f00000000c0)}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[], 0x6) 9.926667343s ago: executing program 5 (id=12433): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='pids.max\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='-0'], 0x9) 9.676174335s ago: executing program 5 (id=12439): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) bind$alg(r0, &(0x7f00000005c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(generic-gcm-aesni)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) 8.189543909s ago: executing program 5 (id=12467): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000000)={0x38, r1, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'nicvf0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2400c890) 4.799738969s ago: executing program 7 (id=12517): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 4.686877051s ago: executing program 7 (id=12519): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) 4.492991939s ago: executing program 7 (id=12521): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, r1, 0x0) 3.806370809s ago: executing program 7 (id=12525): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x3e) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c"], 0x30}}, 0x0) 3.701340057s ago: executing program 1 (id=12526): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 2.678820091s ago: executing program 1 (id=12531): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, 0x3c, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="2e0000003e000511d25a8069966394090224fc602f6e354008", 0x19}], 0x1, 0x0, 0x0, 0x39c}, 0x44000) r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="c00e00007200911fdabcf8b30771a54a07"], 0xfe33) 2.536590577s ago: executing program 4 (id=12534): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x3c, r0, 0x1, 0x0, 0xfffffffe, {{0x2}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x48080}, 0x20004056) 1.380973514s ago: executing program 6 (id=12536): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000011000500000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000014001a"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x44048010) 745.208679ms ago: executing program 1 (id=12537): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000940), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000340)={0x38, r1, 0x1, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0xfffffffd}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x4}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x186}]}]}, 0x38}}, 0x0) 732.435348ms ago: executing program 6 (id=12538): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0xff}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={r1, 0x9, 0x2}, &(0x7f0000000140)=0x8) 712.630982ms ago: executing program 7 (id=12539): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0xe6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x48}}, 0x0) 687.385514ms ago: executing program 4 (id=12540): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001480)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002040)=ANY=[@ANYBLOB='@\r\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000000000000000010000000600060000000000c40c0880e400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000180ff0000000000000000000000000000000000000000000000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c0800030000000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e0003008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0600050000000000d002098058000080060001000200000008000200ac1e00010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300000000007c000080060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200000000000500030000000000dc000080060001000a0000001400020000000000000000000000ffffac1414aa05000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1e0001050003000000000094000080060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000200000008000200e00000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000200000008000200ffffffff050003000000000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff020000000000000000000000000001050003000000000064000080080003000000000008000a000100000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a5499400008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002000000000000000000000000000000d807008000030980f4000080060001000a00000014000200000000000000000000000000000000000500030000000000060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200ac1e00010500030000000000060001000200000008000200e000000105000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000a00000014000200fc01000000000000000000000000000005000300000000004c000080060001000200000008000200ac1414bb0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414bb05000300000000000c010080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fc0100000000000000000000000000000500030000000000940000800600010002000000080002000000000005000300000000000600010002000000080002000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200e00000020500030000000000060001000200000008000200ac1414000500030000000000060001000200000008000200ac14140005000300000000001c000080060001000200000008000200ffffffff0500030000000000080003000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39221d0004000a0000000000000000000000000000000000ffffac1e0001000000001c04098094000080060001000a0000001400020000000000000000000000ffffac1414bb0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200ff0100000000000000000000000000010500030000000000060001000a00000014000200fe880000000000000000000000000001050003000000000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414bb0500030000000000060001000a0000001400020000000000000000000000ffffe00000020500030000000000ac000080060001000200000008000200000000000500030000000000060001000a00000014000200fe80000000000000000000000000000005000300000000000600010002000000080002007f0000010500030000000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200e0000001050003000000000064000080060001000a00000014000200fc0100000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414000500030000000000f4000080060001000200000008000200000000000500030000000000060001000a00000014000200200100000000000000000000000000000500030000000000060001000a00000014000200fc0200000000000000000000000000000500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac1414aa0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414000500030000000000060001000a00000014000200200100000000000000000000000000020500030000000000a0000080060001000a00000014000200fc0000000000000000000000000000000500030000000000060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8800000000000000000000000000010500030000000000060001000a00000014000200fe8000000000000000000000000000aa0500030000000000060001000200000008000200ac14140005000300000000007c000080060001000200000008000200ac1414aa0500030000000000060001000a00000014000200fe8000000000000000000000000000000500030000000000060001000200000008000200e00000010500030000000000060001000a00000014000200fe8000000000000000000000000000bb050003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b2400020055fbc2635cc801d67c589cc98f3cf65074dffe0886750dec83be49fbf628e1dc240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e0c0000800800030000000000060006000000000008000100", @ANYRES32=r2, @ANYBLOB="24000300000000000000000000000000000000000000000000000000000000000000000024000300a05ca84f6c9c8e3853e2fd7a7cae0fb20fa152600cb00845174f08076f8d7843080007"], 0xd40}}, 0x0) 547.770167ms ago: executing program 6 (id=12541): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x6011, r1, 0x0) 547.168296ms ago: executing program 4 (id=12542): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) 533.445835ms ago: executing program 1 (id=12543): r0 = epoll_create1(0x80000) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000004c0)={0x60002001}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000580)={0x40000005}) 381.509496ms ago: executing program 4 (id=12544): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) 380.235133ms ago: executing program 6 (id=12545): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x2c, r0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @default=0x9b4}], @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xc}]]}, 0x2c}}, 0x0) 338.935767ms ago: executing program 1 (id=12546): socket(0xa, 0x3, 0x3a) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x94b, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000100)={@local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00\'$', 0x38, 0x3a, 0xff, @rand_addr=' \x01\x00', @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x500, {0x6, 0x6, ':yE', 0x2, 0x3a, 0x0, @dev={0xfe, 0x80, '\x00', 0x1e}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, [], "8029335287b7a081"}}}}}}}, 0x0) 276.706525ms ago: executing program 7 (id=12547): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x10000, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x48) 270.845402ms ago: executing program 6 (id=12548): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001040)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000300)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x1, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb, r1}, 0x20) 239.999584ms ago: executing program 4 (id=12549): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x20000008}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 143.618656ms ago: executing program 1 (id=12550): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd1, &(0x7f0000000000)=0x5f5e0ff, 0x4) 102.446693ms ago: executing program 6 (id=12551): syz_open_procfs$namespace(0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r0, 0x0, 0x4, &(0x7f0000000040)="440910", 0x3) 0s ago: executing program 4 (id=12552): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@local, 0x0, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000380)={@initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}, 0x800, 0x1, 0x1, 0xb, 0x0, 0x100}, 0x20) kernel console output (not intermixed with test programs): .057088][T18169] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 324.404393][T18187] netlink: 'syz.3.5784': attribute type 1 has an invalid length. [ 324.487990][T18193] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5787'. [ 324.631849][T18200] netlink: 'syz.3.5789': attribute type 21 has an invalid length. [ 324.705691][ T30] audit: type=1107 audit(1757679132.164:4): pid=18202 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 325.130650][T18226] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 325.231468][T18231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5804'. [ 325.650327][T18253] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5816'. [ 325.690770][T18253] hsr_slave_0: left promiscuous mode [ 325.754811][T18253] hsr_slave_1: left promiscuous mode [ 326.372182][T18292] netlink: 'syz.3.5836': attribute type 25 has an invalid length. [ 326.642809][T18307] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5843'. [ 326.657458][T18307] netlink: 'syz.0.5843': attribute type 1 has an invalid length. [ 327.037268][T18331] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.197173][T18340] __nla_validate_parse: 2 callbacks suppressed [ 327.197193][T18340] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5860'. [ 327.236751][T18340] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5860'. [ 327.290911][T18342] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5861'. [ 327.441247][T18351] netlink: 'syz.5.5866': attribute type 3 has an invalid length. [ 327.491468][T18356] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5868'. [ 327.514471][T18356] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5868'. [ 328.099445][T18389] syz_tun: refused to change device tx_queue_len [ 328.430947][T18406] bridge6: the hash_elasticity option has been deprecated and is always 16 [ 328.463895][T18406] bridge6: entered allmulticast mode [ 329.483757][T18450] netlink: 'syz.0.5914': attribute type 1 has an invalid length. [ 329.531244][T18450] netlink: 'syz.0.5914': attribute type 1 has an invalid length. [ 329.600259][T18456] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 330.061785][T18482] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5931'. [ 330.291285][T18489] delete_channel: no stack [ 330.464074][T18498] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5939'. [ 331.955130][T18563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5970'. [ 332.264176][T18580] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5979'. [ 332.431051][T18591] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5983'. [ 332.587266][T18597] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 332.607014][T18597] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 332.941449][T18617] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5996'. [ 333.326711][T18631] netlink: 'syz.1.6003': attribute type 5 has an invalid length. [ 333.385767][T18635] netlink: 'syz.5.6004': attribute type 1 has an invalid length. [ 333.568895][T18643] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 333.671989][T18647] netlink: 'syz.3.6011': attribute type 11 has an invalid length. [ 334.109138][T18670] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.6022'. [ 334.981731][T18718] netlink: 'syz.0.6046': attribute type 1 has an invalid length. [ 335.576423][T18750] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 335.583705][T18750] IPv6: NLM_F_CREATE should be set when creating new route [ 335.590996][T18750] IPv6: NLM_F_CREATE should be set when creating new route [ 335.954099][T18771] _ÐZ`Ô€@S!: entered promiscuous mode [ 335.960730][T18775] netlink: 136 bytes leftover after parsing attributes in process `syz.0.6073'. [ 336.304460][T18790] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6082'. [ 336.439865][T18797] bridge6: entered allmulticast mode [ 336.875846][T18823] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6099'. [ 337.169431][T18842] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6108'. [ 337.288880][T18847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6110'. [ 337.342894][T18847] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6110'. [ 337.966683][T18885] netlink: 'syz.1.6129': attribute type 10 has an invalid length. [ 338.040389][T18891] netlink: 'syz.0.6132': attribute type 1 has an invalid length. [ 338.067605][T18885] team0: Device veth0_macvtap failed to register rx_handler [ 338.067938][T18891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6132'. [ 338.096655][T18891] netlink: 45 bytes leftover after parsing attributes in process `syz.0.6132'. [ 338.436273][T18911] netlink: 'syz.4.6142': attribute type 2 has an invalid length. [ 338.665369][T18925] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6149'. [ 338.680388][T18924] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6147'. [ 339.076690][T18947] sctp: [Deprecated]: syz.4.6160 (pid 18947) Use of struct sctp_assoc_value in delayed_ack socket option. [ 339.076690][T18947] Use struct sctp_sack_info instead [ 339.664135][T18978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6175'. [ 339.708216][T18981] netlink: 'syz.1.6177': attribute type 3 has an invalid length. [ 339.744031][T18981] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.6177'. [ 339.876393][T18990] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.6181'. [ 340.133506][T19001] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6186'. [ 341.123992][T19061] Unsupported ieee802154 address type: 0 [ 341.732404][T19095] openvswitch: netlink: IP tunnel dst address not specified [ 342.794382][T19157] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.881388][T19163] __nla_validate_parse: 5 callbacks suppressed [ 342.881407][T19163] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6263'. [ 342.992269][T19170] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6266'. [ 343.146228][T19177] netlink: 284 bytes leftover after parsing attributes in process `syz.3.6269'. [ 343.750297][T19213] ieee802154 phy1 wpan1: encryption failed: -90 [ 343.891933][T19219] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 344.094144][T19231] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6297'. [ 344.436821][T19251] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6306'. [ 344.802506][T19273] netlink: 88 bytes leftover after parsing attributes in process `syz.4.6318'. [ 345.007636][T19283] openvswitch: netlink: Message has 4 unknown bytes. [ 345.030303][T19283] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 345.397470][T19305] netlink: 'syz.0.6333': attribute type 1 has an invalid length. [ 345.903680][T19335] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6348'. [ 346.059883][T19342] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6353'. [ 346.131558][T19342] IPv6: Can't replace route, no match found [ 346.309158][T19352] delete_channel: no stack [ 346.790037][T19383] ieee802154 phy1 wpan1: encryption failed: -22 [ 346.888564][T19389] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 347.714223][T19429] ieee802154 phy1 wpan1: encryption failed: -22 [ 347.854066][T19436] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6398'. [ 347.863055][T19436] tc_dump_action: action bad kind [ 348.161330][T19452] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6407'. [ 348.508689][T19468] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6413'. [ 348.551409][T19468] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 348.602518][T19473] netlink: 'syz.4.6416': attribute type 1 has an invalid length. [ 349.042438][T19494] netlink: 2 bytes leftover after parsing attributes in process `syz.1.6427'. [ 349.591291][T19523] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.592113][T19519] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6439'. [ 349.664953][T19519] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 350.368973][T19564] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6461'. [ 351.259184][T19618] openvswitch: netlink: Key type 29 is not supported [ 351.752536][T19641] netlink: 'syz.4.6500': attribute type 1 has an invalid length. [ 351.765353][T19641] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 352.226291][T19665] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6512'. [ 352.318396][T19672] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6516'. [ 353.524706][T19738] netlink: 'syz.5.6548': attribute type 3 has an invalid length. [ 353.543011][T19738] netlink: 199836 bytes leftover after parsing attributes in process `syz.5.6548'. [ 353.940502][T19759] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 354.326156][T19782] netlink: 'syz.3.6570': attribute type 9 has an invalid length. [ 354.354182][T19782] netlink: 'syz.3.6570': attribute type 7 has an invalid length. [ 354.362422][T19782] netlink: 'syz.3.6570': attribute type 8 has an invalid length. [ 354.663735][T19799] netlink: 248 bytes leftover after parsing attributes in process `syz.5.6576'. [ 354.894434][T19812] netlink: 136 bytes leftover after parsing attributes in process `syz.1.6583'. [ 355.172100][T19827] netlink: 'syz.1.6589': attribute type 1 has an invalid length. [ 355.406842][T19840] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6593'. [ 355.701781][T19855] ieee802154 phy1 wpan1: encryption failed: -22 [ 355.725336][T19856] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6601'. [ 355.991291][T19872] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 356.464298][T19897] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6617'. [ 356.483294][T19898] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6618'. [ 356.630592][T19906] netlink: 'syz.1.6623': attribute type 1 has an invalid length. [ 358.094201][T19984] netlink: 5636 bytes leftover after parsing attributes in process `syz.3.6656'. [ 358.351060][T19994] netlink: 'syz.3.6660': attribute type 7 has an invalid length. [ 358.386693][T19994] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6660'. [ 358.492624][T19998] netlink: 'syz.0.6662': attribute type 2 has an invalid length. [ 358.828296][T20013] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6668'. [ 358.859478][T20013] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6668'. [ 358.902233][T20017] openvswitch: netlink: Flow key attribute not present in set flow. [ 358.927795][T20013] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 358.960235][T20013] gretap2: entered promiscuous mode [ 359.009862][T20013] gretap2: entered allmulticast mode [ 359.454268][T20042] netlink: 'syz.0.6680': attribute type 8 has an invalid length. [ 359.544069][T20046] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6682'. [ 359.774131][T20058] netlink: 'syz.3.6686': attribute type 8 has an invalid length. [ 359.926694][T20068] netlink: 'syz.4.6690': attribute type 4 has an invalid length. [ 359.997680][T20071] netlink: 'syz.1.6691': attribute type 1 has an invalid length. [ 360.004667][T20063] veth5: entered promiscuous mode [ 360.012988][T20071] netlink: 232 bytes leftover after parsing attributes in process `syz.1.6691'. [ 360.146864][T20076] netlink: 'syz.0.6693': attribute type 282 has an invalid length. [ 360.468025][T20089] netlink: 'syz.1.6699': attribute type 1 has an invalid length. [ 360.843566][T20103] dummy0: entered allmulticast mode [ 360.868532][T20102] dummy0: left allmulticast mode [ 361.200118][T20118] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6709'. [ 361.483143][T20125] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6713'. [ 362.609804][T20174] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6734'. [ 362.631198][T20175] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.6732'. [ 362.667851][T20175] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 362.716870][T20175] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 363.293739][T20202] netlink: 'syz.4.6747': attribute type 21 has an invalid length. [ 363.325234][T20202] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6747'. [ 363.686065][T20220] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6755'. [ 363.782992][T20224] vlan0: entered promiscuous mode [ 363.896200][T20230] netlink: 'syz.0.6760': attribute type 1 has an invalid length. [ 363.954622][T20230] netlink: 15 bytes leftover after parsing attributes in process `syz.0.6760'. [ 364.024142][T20236] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 364.133304][T20238] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 364.254569][T20244] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6767'. [ 364.500900][T20253] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6770'. [ 365.550896][T20298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6789'. [ 365.694186][T20307] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6793'. [ 365.725971][T20307] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6793'. [ 365.772145][T20307] geneve2: entered promiscuous mode [ 365.967739][T20316] netlink: 'syz.1.6797': attribute type 1 has an invalid length. [ 366.256707][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.291408][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.316704][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.364186][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.463628][T20336] netlink: 'syz.1.6806': attribute type 5 has an invalid length. [ 366.517886][T20336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6806'. [ 366.672657][T20344] ieee802154 phy1 wpan1: encryption failed: -22 [ 366.947791][T20354] netlink: 'syz.5.6815': attribute type 41 has an invalid length. [ 367.752505][T20384] netlink: 'syz.4.6830': attribute type 5 has an invalid length. [ 367.925140][T20394] netlink: 'syz.1.6835': attribute type 3 has an invalid length. [ 369.197867][T20455] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6862'. [ 369.446707][T20461] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6867'. [ 369.489721][T20461] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6867'. [ 370.203514][T20498] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6882'. [ 370.244719][T20498] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6882'. [ 370.288537][T20498] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6882'. [ 370.563964][T20513] netlink: 'syz.5.6888': attribute type 10 has an invalid length. [ 370.643652][T20513] mac80211_hwsim hwsim20 wlan1: entered promiscuous mode [ 370.662569][T20513] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 371.781972][T20572] netlink: 176 bytes leftover after parsing attributes in process `syz.0.6917'. [ 371.881888][T20576] netlink: 'syz.1.6919': attribute type 32 has an invalid length. [ 372.065425][T20585] netlink: 'syz.4.6923': attribute type 4 has an invalid length. [ 372.924149][T20624] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6939'. [ 372.953393][T20624] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6939'. [ 373.696818][T20665] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6956'. [ 374.299358][T20695] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6969'. [ 374.348659][T20689] netlink: set zone limit has 4 unknown bytes [ 374.597410][T20705] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6973'. [ 374.872175][T20716] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6978'. [ 375.797601][T20753] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6991'. [ 375.853976][T20753] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6991'. [ 376.193250][T20773] netlink: 'syz.0.6998': attribute type 7 has an invalid length. [ 376.216955][T20775] netlink: 'syz.4.7000': attribute type 21 has an invalid length. [ 376.244076][T20773] netlink: 'syz.0.6998': attribute type 8 has an invalid length. [ 376.254324][T20775] netlink: 128 bytes leftover after parsing attributes in process `syz.4.7000'. [ 376.293891][T20773] netlink: 'syz.0.6998': attribute type 13 has an invalid length. [ 376.302039][T20775] netlink: 'syz.4.7000': attribute type 5 has an invalid length. [ 376.367898][T20779] netlink: 'syz.1.7003': attribute type 3 has an invalid length. [ 376.370553][T20775] netlink: 3 bytes leftover after parsing attributes in process `syz.4.7000'. [ 376.398791][T20782] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7002'. [ 376.532968][T20786] IPv6: sit3: Disabled Multicast RS [ 376.575647][T20786] sit3: entered allmulticast mode [ 376.661921][T20790] netlink: 'syz.3.7006': attribute type 11 has an invalid length. [ 376.694061][T20790] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7006'. [ 377.522251][T20832] sctp: [Deprecated]: syz.5.7025 (pid 20832) Use of int in maxseg socket option. [ 377.522251][T20832] Use struct sctp_assoc_value instead [ 378.101305][T20860] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 378.252765][T20870] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551612) [ 378.263628][T20870] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647 [ 378.857867][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.027120][T20906] netlink: 248 bytes leftover after parsing attributes in process `syz.4.7060'. [ 379.260668][T20911] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 379.659092][T20931] netlink: zone id is out of range [ 380.166048][T20956] netlink: 'syz.1.7082': attribute type 30 has an invalid length. [ 380.222008][T20956] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 380.313964][T20956] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 380.913345][T20991] __nla_validate_parse: 1 callbacks suppressed [ 380.913365][T20991] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7097'. [ 380.945775][T20996] netlink: 'syz.4.7098': attribute type 12 has an invalid length. [ 380.994137][T20996] netlink: 9472 bytes leftover after parsing attributes in process `syz.4.7098'. [ 381.402292][T21007] netlink: 'syz.5.7104': attribute type 11 has an invalid length. [ 381.448259][T21011] netlink: 'syz.4.7105': attribute type 31 has an invalid length. [ 381.454253][T21007] netlink: 'syz.5.7104': attribute type 4 has an invalid length. [ 381.489932][T21007] netlink: 224 bytes leftover after parsing attributes in process `syz.5.7104'. [ 381.685048][T21020] veth1_macvtap: left promiscuous mode [ 381.714710][T21020] macsec0: entered allmulticast mode [ 381.753538][T21024] openvswitch: netlink: Unknown key attributes 2 [ 381.898412][T21027] netlink: 'syz.1.7113': attribute type 2 has an invalid length. [ 382.177804][T21043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7120'. [ 382.479487][T21058] tipc: Enabling of bearer rejected, failed to enable media [ 383.237180][T21089] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 384.308341][T21141] netlink: 212364 bytes leftover after parsing attributes in process `syz.5.7160'. [ 384.334205][T21141] openvswitch: netlink: Message has 5 unknown bytes. [ 384.595737][T21158] netlink: 'syz.3.7166': attribute type 10 has an invalid length. [ 384.616866][T21158] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7166'. [ 384.703749][T21158] dummy0: entered promiscuous mode [ 384.723643][T21158] bridge0: port 2(dummy0) entered blocking state [ 384.754597][T21158] bridge0: port 2(dummy0) entered disabled state [ 384.761463][T21163] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7167'. [ 384.774421][T21158] dummy0: entered allmulticast mode [ 384.792681][T21158] bridge0: port 2(dummy0) entered blocking state [ 384.799239][T21158] bridge0: port 2(dummy0) entered listening state [ 384.841920][T21166] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 385.467341][T21198] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7182'. [ 385.698969][T21211] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.7187'. [ 385.825271][T21219] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7191'. [ 387.373490][T21296] Bluetooth: MGMT ver 1.23 [ 387.450974][T21301] netlink: 277 bytes leftover after parsing attributes in process `syz.3.7222'. [ 387.955236][T21326] sctp: [Deprecated]: syz.3.7233 (pid 21326) Use of int in max_burst socket option. [ 387.955236][T21326] Use struct sctp_assoc_value instead [ 388.192032][ T12] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.207154][T21332] Zero length message leads to an empty skb [ 388.229816][ T12] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.274717][ T74] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.303422][ T74] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.964103][T21373] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7250'. [ 388.973017][T21373] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7250'. [ 389.017657][T21373] netlink: 'syz.5.7250': attribute type 18 has an invalid length. [ 389.585186][T21405] ieee802154 phy1 wpan1: encryption failed: -22 [ 390.077889][T21433] openvswitch: netlink: IPv6 tunnel dst address is zero [ 390.484682][T21454] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (1815685925) [ 390.499127][T21458] Bluetooth: MGMT ver 1.23 [ 390.544051][T21454] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 391.352995][T21499] netlink: 'syz.0.7302': attribute type 21 has an invalid length. [ 391.401701][T21499] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7302'. [ 391.872478][T21530] netlink: 'syz.5.7314': attribute type 1 has an invalid length. [ 392.935893][T21582] tipc: Enabling of bearer rejected, failed to enable media [ 393.082798][T21590] xt_limit: Overflow, try lower: 271964/0 [ 393.842608][T21631] tipc: Enabling of bearer rejected, media not registered [ 394.017056][T21642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7358'. [ 394.059895][T21642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7358'. [ 394.096959][T21642] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7358'. [ 394.296635][T21654] netlink: 'syz.4.7364': attribute type 2 has an invalid length. [ 394.330673][T21654] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7364'. [ 394.972345][T21681] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7375'. [ 394.998653][T21681] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7375'. [ 395.049227][T21681] macvlan2: entered promiscuous mode [ 395.619112][ T5869] Bluetooth: hci5: link tx timeout [ 395.625528][ T5869] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 396.070313][T21723] openvswitch: netlink: IPv4 frag type 255 is out of range max 2 [ 396.141318][T21725] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7391'. [ 396.144931][T21727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7392'. [ 396.170799][T21727] openvswitch: netlink: Unknown nsh attribute 0 [ 396.189819][T21727] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 396.200906][T21725] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7391'. [ 396.249597][T21725] netlink: 'syz.1.7391': attribute type 5 has an invalid length. [ 396.273842][T21725] netlink: 'syz.1.7391': attribute type 6 has an invalid length. [ 397.645733][ T5869] Bluetooth: hci5: command 0x0406 tx timeout [ 397.865551][T21816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7426'. [ 398.884941][T21874] sock: sock_set_timeout: `syz.3.7443' (pid 21874) tries to set negative timeout [ 399.315380][T21894] __nla_validate_parse: 2 callbacks suppressed [ 399.315400][T21894] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7452'. [ 399.527378][T21906] xt_socket: unknown flags 0xfc [ 399.931390][T21927] Bluetooth: MGMT ver 1.23 [ 399.964992][ C1] bridge0: port 2(dummy0) entered learning state [ 399.982692][T21930] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (255) [ 400.601689][T21965] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 400.857820][T21981] netlink: 'syz.1.7488': attribute type 3 has an invalid length. [ 402.446809][T22056] bridge0: port 3(team0) entered disabled state [ 402.454723][T22056] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 402.564448][T22063] netlink: 'syz.3.7518': attribute type 27 has an invalid length. [ 402.824045][T22077] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7524'. [ 402.850051][T22077] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7524'. [ 402.906530][T22080] netlink: 260 bytes leftover after parsing attributes in process `syz.5.7525'. [ 402.928276][T22080] netlink: 260 bytes leftover after parsing attributes in process `syz.5.7525'. [ 403.229170][T22103] netlink: 96 bytes leftover after parsing attributes in process `syz.0.7534'. [ 403.299420][T22103] vlan3: entered allmulticast mode [ 403.338208][T22103] gretap0: entered allmulticast mode [ 403.454117][T22114] netlink: 'syz.1.7539': attribute type 23 has an invalid length. [ 404.162089][T22158] netlink: 'syz.5.7555': attribute type 1 has an invalid length. [ 404.607360][T22180] Bluetooth: MGMT ver 1.23 [ 405.067209][T22206] netlink: 14679 bytes leftover after parsing attributes in process `syz.3.7571'. [ 405.085171][T22209] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 405.574327][T22237] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7586'. [ 406.279572][T22277] netlink: 'syz.4.7602': attribute type 1 has an invalid length. [ 406.295488][T22277] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7602'. [ 406.751083][T22300] : entered promiscuous mode [ 407.332035][T22333] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 407.920672][T22370] xt_l2tp: unknown flags: 51 [ 407.930548][T22369] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7640'. [ 407.947382][T22369] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7640'. [ 409.010285][T22428] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7663'. [ 409.340853][T22445] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7670'. [ 409.438434][T22445] netlink: 'syz.3.7670': attribute type 2 has an invalid length. [ 409.467183][T22445] netlink: 'syz.3.7670': attribute type 1 has an invalid length. [ 409.492831][T22445] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7670'. [ 411.456999][T22546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7711'. [ 411.819689][T22567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7719'. [ 411.850576][T22567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7719'. [ 411.878241][T22567] netlink: 'syz.3.7719': attribute type 11 has an invalid length. [ 413.250443][T22614] vxcan1 speed is unknown, defaulting to 1000 [ 413.934138][T22651] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7750'. [ 414.151145][T22658] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7753'. [ 414.159917][T22614] wg1 speed is unknown, defaulting to 1000 [ 414.624502][T22680] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 414.654808][ T6005] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 414.926149][T22691] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7765'. [ 415.306869][T22708] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7771'. [ 415.324117][ C1] bridge0: port 2(dummy0) entered forwarding state [ 415.330725][ C1] bridge0: topology change detected, propagating [ 415.644053][ T6005] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 415.724506][T22725] netlink: 'syz.0.7778': attribute type 322 has an invalid length. [ 416.083984][T22740] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7784'. [ 416.105984][T22740] block nbd0: not configured, cannot reconfigure [ 416.403763][T22755] netlink: 'syz.3.7789': attribute type 30 has an invalid length. [ 416.441214][T22760] netlink: 256 bytes leftover after parsing attributes in process `syz.1.7790'. [ 416.478324][T22760] netlink: 48 bytes leftover after parsing attributes in process `syz.1.7790'. [ 417.055568][T22783] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7798'. [ 417.088627][T22783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7798'. [ 417.126091][T22783] netlink: 'syz.4.7798': attribute type 13 has an invalid length. [ 417.171306][T22789] tipc: Failed to obtain node identity [ 417.199039][T22789] tipc: Enabling of bearer rejected, failed to enable media [ 417.434275][T22797] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7804'. [ 417.690102][T22812] netlink: 17 bytes leftover after parsing attributes in process `syz.3.7809'. [ 418.528663][T22849] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7824'. [ 418.766234][T22859] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7828'. [ 419.405635][T22891] netlink: zone id is out of range [ 419.410802][T22891] netlink: zone id is out of range [ 419.441744][T22891] netlink: zone id is out of range [ 419.450722][T22891] netlink: zone id is out of range [ 419.462673][T22891] netlink: zone id is out of range [ 419.483554][T22891] netlink: zone id is out of range [ 419.493691][T22891] netlink: zone id is out of range [ 419.511333][T22891] netlink: zone id is out of range [ 419.524408][T22891] netlink: zone id is out of range [ 419.894445][T22916] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7852'. [ 419.944117][T22916] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7852'. [ 420.714310][T22959] xt_socket: unknown flags 0xd0 [ 420.812563][T22966] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7870'. [ 421.511226][T23004] __nla_validate_parse: 2 callbacks suppressed [ 421.511248][T23004] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7885'. [ 421.798783][T23017] net_ratelimit: 2 callbacks suppressed [ 421.798801][T23017] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 421.886766][T23020] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7892'. [ 422.033376][T23025] vxcan1 speed is unknown, defaulting to 1000 [ 422.860338][T23025] wg1 speed is unknown, defaulting to 1000 [ 423.596497][T23080] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7911'. [ 423.684989][T23080] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 423.933982][T23092] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7916'. [ 424.533475][T23113] sctp: [Deprecated]: syz.3.7923 (pid 23113) Use of int in max_burst socket option. [ 424.533475][T23113] Use struct sctp_assoc_value instead [ 424.771171][T23128] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 425.530752][T23162] RDS: rds_bind could not find a transport for fe80::2a, load rds_tcp or rds_rdma? [ 425.759377][T23182] netlink: 92 bytes leftover after parsing attributes in process `syz.3.7952'. [ 425.790022][T23182] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7952'. [ 426.484676][T23221] tipc: Started in network mode [ 426.489592][T23221] tipc: Node identity 4, cluster identity 4711 [ 426.545466][T23221] tipc: Node number set to 4 [ 426.764068][T23237] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7973'. [ 427.309292][T23270] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 427.507763][T23283] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7992'. [ 427.567753][T23283] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 427.604025][T23283] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 427.841514][T23300] tipc: Enabling of bearer rejected, failed to enable media [ 428.128498][T23319] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8002'. [ 428.161502][T23319] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8002'. [ 428.573573][T23344] vlan2: entered promiscuous mode [ 428.585552][T23344] syz_tun: entered promiscuous mode [ 430.583602][T23453] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8068'. [ 430.785556][T23449] syz.3.8066 (23449) used greatest stack depth: 15832 bytes left [ 430.824275][T23463] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8072'. [ 431.305060][T23493] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8088'. [ 431.364302][T23498] tipc: Started in network mode [ 431.376521][T23498] tipc: Node identity ff020000000000000000000000000001, cluster identity 4711 [ 431.409695][T23498] tipc: Enabling of bearer rejected, failed to enable media [ 431.539459][T23505] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8094'. [ 431.554777][T23507] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2621 [ 431.577044][T23509] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8096'. [ 431.603475][T23509] netlink: 'syz.1.8096': attribute type 3 has an invalid length. [ 431.678840][T23512] netlink: 'syz.0.8098': attribute type 16 has an invalid length. [ 431.699916][T23512] netlink: 'syz.0.8098': attribute type 3 has an invalid length. [ 431.704398][T23515] netlink: 'syz.3.8099': attribute type 29 has an invalid length. [ 431.712631][T23512] netlink: 64066 bytes leftover after parsing attributes in process `syz.0.8098'. [ 432.142533][T23541] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 432.853051][T23577] netlink: 468 bytes leftover after parsing attributes in process `syz.5.8129'. [ 432.867683][T23579] netlink: 592 bytes leftover after parsing attributes in process `syz.0.8130'. [ 433.068828][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.084978][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.104260][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.131603][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.147734][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.185279][T23589] netlink: 'syz.3.8135': attribute type 29 has an invalid length. [ 433.608042][T23612] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 433.937436][T23630] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8156'. [ 433.973989][T23630] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8156'. [ 434.038693][T23638] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8159'. [ 434.054056][T23638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8159'. [ 434.203948][ T5869] Bluetooth: hci5: command 0x0406 tx timeout [ 434.286177][T23652] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8165'. [ 435.668646][T23729] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 436.199656][T23759] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 436.416365][T23771] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8223'. [ 437.151054][T23809] IPVS: Unknown mcast interface: bridge_slave_0 [ 437.323550][T23819] vlan2: entered promiscuous mode [ 437.338378][T23819] bridge0: entered promiscuous mode [ 437.379434][T23823] validate_nla: 32 callbacks suppressed [ 437.379570][T23823] netlink: 'syz.3.8248': attribute type 28 has an invalid length. [ 438.178957][T23848] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8259'. [ 438.312749][T23854] netlink: 'syz.4.8262': attribute type 3 has an invalid length. [ 439.055570][T23886] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 439.062361][T23886] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 439.704829][T23916] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8291'. [ 439.965603][T23929] netlink: 19 bytes leftover after parsing attributes in process `syz.0.8296'. [ 440.060860][T23932] macsec1: entered promiscuous mode [ 440.084831][T23932] team0: entered promiscuous mode [ 440.099745][T23935] tc_dump_action: action bad kind [ 440.288470][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.366508][T23950] nbd: couldn't find device at index 536870912 [ 440.442991][T23954] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8308'. [ 440.477187][T23954] netlink: 36 bytes leftover after parsing attributes in process `syz.5.8308'. [ 440.917813][T23978] tipc: Invalid UDP bearer configuration [ 440.917869][T23978] tipc: Enabling of bearer rejected, failed to enable media [ 441.103162][T23989] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8325'. [ 441.743208][T24031] sock: sock_timestamping_bind_phc: sock not bind to device [ 442.004056][T24046] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8350'. [ 442.210689][T24058] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 442.307854][T24064] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8360'. [ 442.910203][T24095] netlink: 'syz.4.8375': attribute type 1 has an invalid length. [ 442.945749][T24095] netlink: 244 bytes leftover after parsing attributes in process `syz.4.8375'. [ 443.280186][T24112] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8384'. [ 443.589372][T24129] TCP: TCP_TX_DELAY enabled [ 443.791868][T24134] 8021q: adding VLAN 0 to HW filter on device bond2 [ 443.803396][T24134] bond2: entered promiscuous mode [ 443.823140][T24134] team0: Port device bond2 added [ 443.853245][T24147] netlink: 'syz.3.8400': attribute type 1 has an invalid length. [ 443.877555][T24147] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8400'. [ 444.055342][T24158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8405'. [ 444.306688][T24170] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8413'. [ 444.579669][T24190] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.8421'. [ 444.782514][T24201] netlink: 13 bytes leftover after parsing attributes in process `syz.5.8426'. [ 444.926091][T24210] netlink: 19 bytes leftover after parsing attributes in process `syz.5.8430'. [ 444.962617][T24210] netlink: 'syz.5.8430': attribute type 3 has an invalid length. [ 446.713526][T24314] netlink: 'syz.3.8481': attribute type 5 has an invalid length. [ 447.321232][T24353] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8500'. [ 447.338373][T24353] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8500'. [ 447.349621][T24353] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8500'. [ 447.491781][T24363] netlink: 'syz.5.8505': attribute type 2 has an invalid length. [ 447.529831][T24363] ave_0: entered promiscuous mode [ 448.614675][T24411] erspan0: entered promiscuous mode [ 448.620362][T24411] macsec1: entered promiscuous mode [ 448.640022][T24411] erspan0: left promiscuous mode [ 449.012024][T24433] __nla_validate_parse: 1 callbacks suppressed [ 449.012045][T24433] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8538'. [ 449.581449][T24466] netlink: 'syz.1.8555': attribute type 10 has an invalid length. [ 449.611171][T24466] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.619567][T24466] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.655718][T24475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8555'. [ 449.692111][T24471] netlink: 'syz.4.8557': attribute type 1 has an invalid length. [ 449.716991][T24475] team0: left allmulticast mode [ 449.733933][T24475] team_slave_0: left allmulticast mode [ 449.751244][T24475] team_slave_1: left allmulticast mode [ 449.776788][T24475] bridge0: port 3(team0) entered disabled state [ 449.821736][T24475] bridge_slave_1: left allmulticast mode [ 449.827676][T24475] bridge_slave_1: left promiscuous mode [ 449.833474][T24475] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.904252][T24475] bridge_slave_0: left allmulticast mode [ 449.927292][T24475] bridge_slave_0: left promiscuous mode [ 449.943323][T24475] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.975763][T24544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8592'. [ 450.994755][T24544] IPVS: Error joining to the multicast group [ 451.130741][T24552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8595'. [ 451.150646][T24552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8595'. [ 451.673665][T24584] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8610'. [ 452.090251][T24597] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8618'. [ 453.279130][T24652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8643'. [ 453.959104][T24692] ipvlan0: entered promiscuous mode [ 453.988512][T24690] nbd: must specify a size in bytes for the device [ 454.207053][T24704] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 454.244661][T24709] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8674'. [ 454.705384][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.739484][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.748220][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.769274][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.794368][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.825850][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.852188][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.880378][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.904543][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 454.922956][T24736] netlink: 'syz.0.8687': attribute type 29 has an invalid length. [ 455.017466][T24755] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8696'. [ 455.027451][T24753] netlink: 209836 bytes leftover after parsing attributes in process `syz.4.8695'. [ 455.031455][T24755] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 455.067395][T24755] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 455.219943][T24764] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8700'. [ 455.369391][T24774] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 456.404553][T24823] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8729'. [ 456.470179][T24823] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8729'. [ 456.647156][T24832] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 457.116993][T24865] xt_time: unknown flags 0xf4 [ 458.071291][T24923] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8776'. [ 458.276407][T24939] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8783'. [ 458.384903][T24945] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8785'. [ 458.519007][T24951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8790'. [ 459.545340][T25019] bridge0: port 2(dummy0) entered disabled state [ 459.574478][T25019] bridge0: port 2(dummy0) entered blocking state [ 459.580986][T25019] bridge0: port 2(dummy0) entered listening state [ 459.603912][T25020] __nla_validate_parse: 3 callbacks suppressed [ 459.603931][T25020] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8821'. [ 459.611428][T25019] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 459.679905][T25020] dummy0: left allmulticast mode [ 459.696707][T25023] netlink: 56 bytes leftover after parsing attributes in process `syz.4.8823'. [ 459.706120][T25020] bridge0: port 2(dummy0) entered disabled state [ 459.720817][ T30] audit: type=1804 audit(1757679267.154:5): pid=25024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.8824" name="/newroot/1785/cgroup.controllers" dev="tmpfs" ino=8961 res=1 errno=0 [ 459.765359][T25020] bridge_slave_0: left allmulticast mode [ 459.772938][ T30] audit: type=1800 audit(1757679267.174:6): pid=25024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8824" name="cgroup.controllers" dev="tmpfs" ino=8961 res=0 errno=0 [ 459.794477][T25020] bridge_slave_0: left promiscuous mode [ 459.801566][T25020] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.810987][ T5869] Bluetooth: hci5: command 0x0406 tx timeout [ 459.862872][T25020] bond0: (slave bridge0): Releasing backup interface [ 459.899297][T25027] validate_nla: 28 callbacks suppressed [ 459.899324][T25027] netlink: 'syz.5.8826': attribute type 3 has an invalid length. [ 459.918529][T25027] netlink: 666 bytes leftover after parsing attributes in process `syz.5.8826'. [ 459.939987][T25034] tipc: Enabling of bearer rejected, failed to enable media [ 460.007826][T25036] netlink: 240 bytes leftover after parsing attributes in process `syz.1.8830'. [ 460.593435][T25070] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8848'. [ 460.625966][T25070] openvswitch: netlink: nsh attribute has 2338 unknown bytes. [ 460.650465][T25070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.607558][T25129] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8876'. [ 462.188211][T25162] netlink: 364 bytes leftover after parsing attributes in process `syz.5.8892'. [ 462.219390][T25162] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 463.081800][T25198] netlink: 460 bytes leftover after parsing attributes in process `syz.3.8909'. [ 463.273869][T25204] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 463.296596][T25203] xt_HMARK: spi-set and port-set can't be combined [ 463.304888][T25206] tipc: Started in network mode [ 463.323968][T25206] tipc: Node identity , cluster identity 4711 [ 463.335188][T25206] tipc: Failed to obtain node identity [ 463.340707][T25206] tipc: Enabling of bearer rejected, failed to enable media [ 463.670790][T25227] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8922'. [ 464.533720][T25267] netem: change failed [ 464.710306][T25273] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 464.717628][T25273] IPv6: NLM_F_CREATE should be set when creating new route [ 464.724939][T25273] IPv6: NLM_F_CREATE should be set when creating new route [ 464.732159][T25273] IPv6: NLM_F_CREATE should be set when creating new route [ 465.008012][T25285] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.584151][T25320] sctp: [Deprecated]: syz.0.8966 (pid 25320) Use of int in max_burst socket option deprecated. [ 465.584151][T25320] Use struct sctp_assoc_value instead [ 465.693077][T25327] netlink: 'syz.5.8970': attribute type 10 has an invalid length. [ 465.720927][T25327] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8970'. [ 465.870060][T25336] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 466.430508][T25369] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 466.494965][ T49] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 466.503023][ T49] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 466.524166][ T1209] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 466.684452][T25384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8999'. [ 466.827796][T25389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9001'. [ 466.851773][T25389] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9001'. [ 466.855017][ T6019] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 466.870095][T25389] netlink: 'syz.1.9001': attribute type 12 has an invalid length. [ 466.887820][T25389] netlink: 'syz.1.9001': attribute type 14 has an invalid length. [ 466.925904][T25392] vxcan1 speed is unknown, defaulting to 1000 [ 466.974397][ T6019] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 467.576330][T25392] wg1 speed is unknown, defaulting to 1000 [ 467.859676][T25431] tipc: Started in network mode [ 467.869874][T25431] tipc: Node identity fec0ffffffffffff0000000000000001, cluster identity 4711 [ 467.879588][T25431] tipc: Enabling of bearer rejected, failed to enable media [ 467.933212][T25433] xt_limit: Overflow, try lower: 604147548/4200216962 [ 468.037133][T25438] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9024'. [ 468.469094][T25453] netlink: 'syz.0.9032': attribute type 16 has an invalid length. [ 468.511590][T25453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9032'. [ 468.804352][T25472] sctp: [Deprecated]: syz.5.9037 (pid 25472) Use of int in max_burst socket option deprecated. [ 468.804352][T25472] Use struct sctp_assoc_value instead [ 468.863711][T25476] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9043'. [ 469.108459][T25487] tipc: Enabling of bearer rejected, failed to enable media [ 469.174266][T25490] netlink: 52 bytes leftover after parsing attributes in process `syz.0.9049'. [ 469.193590][T25490] IPVS: Unknown mcast interface: vetN1_macvtap [ 469.521623][T25507] vlan1: entered allmulticast mode [ 469.548820][T25507] bond0: entered allmulticast mode [ 469.581472][T25511] netlink: 'syz.0.9059': attribute type 2 has an invalid length. [ 469.812107][T25524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 469.870967][T25527] netlink: 36 bytes leftover after parsing attributes in process `syz.5.9067'. [ 470.095987][T25539] netlink: 92 bytes leftover after parsing attributes in process `syz.5.9072'. [ 470.523973][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 470.583270][ T6019] IPVS: starting estimator thread 0... [ 470.714292][T25566] IPVS: using max 31 ests per chain, 74400 per kthread [ 471.674815][T25623] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.9111'. [ 471.927476][T25639] netlink: 260 bytes leftover after parsing attributes in process `syz.4.9118'. [ 471.940232][T25639] netlink: 260 bytes leftover after parsing attributes in process `syz.4.9118'. [ 471.988985][T25644] netlink: 44 bytes leftover after parsing attributes in process `syz.5.9120'. [ 473.324884][ T5876] Bluetooth: hci5: command 0x0406 tx timeout [ 473.695413][T25739] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9166'. [ 474.920496][T25784] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9187'. [ 475.512687][T25819] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9203'. [ 475.553231][T25819] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9203'. [ 475.572842][T25819] tipc: Invalid UDP bearer configuration [ 475.572903][T25819] tipc: Enabling of bearer rejected, failed to enable media [ 475.587836][T25826] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9206'. [ 475.761457][T25834] raw_sendmsg: syz.1.9210 forgot to set AF_INET. Fix it! [ 477.260635][T25916] netlink: 128 bytes leftover after parsing attributes in process `syz.3.9249'. [ 478.414030][T25976] tipc: Cannot configure node identity twice [ 478.683982][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 478.922236][T26009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9295'. [ 479.073493][T26019] netlink: 'syz.0.9301': attribute type 3 has an invalid length. [ 479.104069][T26019] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9301'. [ 479.621907][T26050] netlink: 47 bytes leftover after parsing attributes in process `syz.1.9315'. [ 480.014165][T26075] netlink: 'syz.4.9327': attribute type 1 has an invalid length. [ 480.129450][T26081] RDS: rds_bind could not find a transport for 100:806:aaaa:aaaa:aaaa::, load rds_tcp or rds_rdma? [ 481.070304][T26122] 8021q: adding VLAN 0 to HW filter on device team0 [ 481.091863][T26122] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 481.609930][T26140] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 481.793070][T26154] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9365'. [ 481.847320][T26154] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9365'. [ 481.892529][T26154] tipc: Invalid UDP bearer configuration [ 481.892589][T26154] tipc: Enabling of bearer rejected, failed to enable media [ 482.096155][T26172] netlink: 'syz.4.9373': attribute type 10 has an invalid length. [ 482.405086][T26191] netlink: 'syz.1.9380': attribute type 1 has an invalid length. [ 482.412994][T26191] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.465298][T26193] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9383'. [ 482.587612][T26199] netlink: 60 bytes leftover after parsing attributes in process `syz.5.9384'. [ 482.608879][T26199] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 483.339666][T26243] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9406'. [ 483.670221][T26265] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9417'. [ 483.679660][T26265] netlink: 19 bytes leftover after parsing attributes in process `syz.1.9417'. [ 483.691932][T26265] netlink: 'syz.1.9417': attribute type 6 has an invalid length. [ 483.717193][T26265] netlink: 'syz.1.9417': attribute type 4 has an invalid length. [ 483.844013][T26273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9421'. [ 484.422612][T26305] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9438'. [ 485.373343][T26362] tipc: Started in network mode [ 485.394517][T26362] tipc: Node identity aaaaaaaaaa1f, cluster identity 4711 [ 485.420253][T26362] tipc: Enabled bearer , priority 10 [ 485.866902][T26393] netlink: 67 bytes leftover after parsing attributes in process `syz.4.9482'. [ 486.116844][T26409] gretap0: entered promiscuous mode [ 486.122285][T26409] vlan3: entered promiscuous mode [ 486.536109][ T6019] tipc: Node number set to 11905706 [ 486.833583][T26453] bridge0: port 1(syz_tun) entered blocking state [ 486.854064][T26453] bridge0: port 1(syz_tun) entered disabled state [ 486.872482][T26453] syz_tun: entered allmulticast mode [ 486.883646][T26453] syz_tun: entered promiscuous mode [ 486.957757][T26459] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9514'. [ 487.026440][T26463] netlink: 20 bytes leftover after parsing attributes in process `syz.5.9516'. [ 487.709958][T26502] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.789351][T26508] netlink: 'syz.1.9536': attribute type 1 has an invalid length. [ 490.759547][T26657] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9601'. [ 490.780783][T26657] netlink: zone id is out of range [ 490.794562][T26657] netlink: zone id is out of range [ 490.799718][T26657] netlink: zone id is out of range [ 490.831612][T26657] netlink: get zone limit has 8 unknown bytes [ 491.128637][T26674] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9611'. [ 491.164157][T26676] netlink: 336 bytes leftover after parsing attributes in process `syz.4.9612'. [ 491.935329][T26710] bond3: entered promiscuous mode [ 491.964983][T26710] 8021q: adding VLAN 0 to HW filter on device bond3 [ 492.406053][T26741] netlink: 168 bytes leftover after parsing attributes in process `syz.4.9643'. [ 493.080439][T26780] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9659'. [ 493.164212][T26780] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 493.199424][T26784] gtp1: entered promiscuous mode [ 493.204829][T26784] gtp1: entered allmulticast mode [ 493.361497][T26792] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9665'. [ 493.861907][T26809] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9672'. [ 494.957761][T26861] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9696'. [ 494.983929][T26861] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9696'. [ 494.996437][T26861] netlink: 'syz.5.9696': attribute type 12 has an invalid length. [ 495.265362][T26875] netlink: 'syz.5.9702': attribute type 1 has an invalid length. [ 495.323952][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 495.393251][T26881] netlink: 100 bytes leftover after parsing attributes in process `syz.0.9704'. [ 496.132078][T26921] __nla_validate_parse: 1 callbacks suppressed [ 496.132097][T26921] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9724'. [ 496.279465][T26928] veth0_to_bond: entered allmulticast mode [ 497.234062][T26978] netlink: 216 bytes leftover after parsing attributes in process `syz.1.9750'. [ 497.256243][T26980] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9752'. [ 497.276689][T26978] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9750'. [ 497.299561][T26978] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9750'. [ 497.403923][ T5869] Bluetooth: hci5: command 0x0406 tx timeout [ 498.096669][T27033] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9776'. [ 498.249582][T27043] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9781'. [ 498.397795][T27051] netlink: 'syz.3.9786': attribute type 5 has an invalid length. [ 498.699858][T27074] netlink: 'syz.1.9797': attribute type 42 has an invalid length. [ 498.807251][T27080] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9801'. [ 498.838163][T27080] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9801'. [ 498.854129][T27080] tipc: Cannot configure node identity twice [ 498.860229][T27080] tipc: Cannot configure node identity twice [ 499.189505][T27103] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9811'. [ 499.649013][T27133] tipc: Enabled bearer , priority 18 [ 500.765410][ T6019] tipc: Node number set to 4278321153 [ 501.523686][T27251] __nla_validate_parse: 2 callbacks suppressed [ 501.523706][T27251] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9882'. [ 501.576932][T27251] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9882'. [ 501.625107][T27256] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9884'. [ 501.648439][T27256] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9884'. [ 501.848259][T27266] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.175508][T27278] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9896'. [ 502.185498][T27283] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9899'. [ 502.212999][T27278] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9896'. [ 502.332089][T27288] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9901'. [ 502.661932][T27312] netlink: 56 bytes leftover after parsing attributes in process `syz.5.9913'. [ 502.835811][T27324] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9917'. [ 502.974164][T27330] netlink: 'syz.4.9921': attribute type 1 has an invalid length. [ 503.040429][T27334] netlink: 'syz.3.9923': attribute type 6 has an invalid length. [ 503.332063][T27352] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 503.749855][T27381] veth1_macvtap: left promiscuous mode [ 504.666040][T27424] netlink: 'syz.3.9968': attribute type 1 has an invalid length. [ 505.836701][ T6019] IPVS: starting estimator thread 0... [ 505.993923][T27494] IPVS: using max 33 ests per chain, 79200 per kthread [ 506.273483][T27522] netlink: 'syz.4.10015': attribute type 15 has an invalid length. [ 506.435932][T27532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 506.542920][T27539] __nla_validate_parse: 10 callbacks suppressed [ 506.542941][T27539] netlink: 5636 bytes leftover after parsing attributes in process `syz.0.10024'. [ 506.674879][T27547] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10028'. [ 507.108961][T27574] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10043'. [ 507.149247][T27579] netlink: 'syz.1.10042': attribute type 8 has an invalid length. [ 507.434692][T27594] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.10051'. [ 507.735284][T27615] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10060'. [ 507.849459][T27622] netlink: 32 bytes leftover after parsing attributes in process `syz.5.10063'. [ 508.334125][T27657] netlink: 68 bytes leftover after parsing attributes in process `syz.4.10081'. [ 509.502587][T27723] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10113'. [ 509.648917][T27733] netlink: 'syz.1.10119': attribute type 142 has an invalid length. [ 509.706771][T27735] macvtap1: entered promiscuous mode [ 509.736045][T27735] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 509.822644][T27735] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 509.895127][T27743] netlink: 240 bytes leftover after parsing attributes in process `syz.5.10124'. [ 511.039092][T27806] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 511.063613][T27809] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10153'. [ 511.582857][T27838] __nla_validate_parse: 2 callbacks suppressed [ 511.582877][T27838] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10167'. [ 511.886377][T27854] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10175'. [ 512.082966][T27862] tipc: New replicast peer: 172.20.20.187 [ 512.118223][T27862] tipc: Enabled bearer , priority 6 [ 512.314500][T27868] atomic_op ffff88807d4ca198 conn xmit_atomic 0000000000000000 [ 513.489549][T27945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10220'. [ 513.599584][T27953] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.10224'. [ 514.433513][ T30] audit: type=1800 audit(1757679321.884:7): pid=27994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.10243" name="blkio.bfq.time_recursive" dev="tmpfs" ino=6475 res=0 errno=0 [ 514.491858][ T30] audit: type=1800 audit(1757679321.914:8): pid=27994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.10243" name="blkio.bfq.time_recursive" dev="tmpfs" ino=6475 res=0 errno=0 [ 514.891266][T28021] netlink: 56 bytes leftover after parsing attributes in process `syz.3.10257'. [ 515.231507][T28042] vxcan1 speed is unknown, defaulting to 1000 [ 515.599474][T28063] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 515.818829][T28073] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10282'. [ 515.852653][T28073] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10282'. [ 516.064068][T28083] netlink: 56 bytes leftover after parsing attributes in process `syz.1.10287'. [ 516.330672][T28093] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 516.444508][T28095] netlink: 'syz.3.10293': attribute type 1 has an invalid length. [ 516.512211][T28097] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10294'. [ 516.550100][T28097] smc: net device bond0 applied user defined pnetid SYZ [ 516.835902][T28112] netlink: 44 bytes leftover after parsing attributes in process `syz.0.10300'. [ 517.638170][T28140] netlink: 128 bytes leftover after parsing attributes in process `syz.3.10312'. [ 518.147845][T28162] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10323'. [ 518.157723][T28162] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10323'. [ 518.830244][T28204] netlink: 256 bytes leftover after parsing attributes in process `syz.0.10342'. [ 518.865771][T28205] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10344'. [ 519.073452][T28223] udevd[28223]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 519.081345][T28220] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10348'. [ 519.107569][T28215] udevd[28215]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 519.108376][T28220] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10348'. [ 519.418758][T28239] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10358'. [ 519.431508][T28239] netlink: 28 bytes leftover after parsing attributes in process `syz.5.10358'. [ 519.441676][T28239] netlink: 'syz.5.10358': attribute type 6 has an invalid length. [ 519.980680][ T30] audit: type=1804 audit(1757679327.434:9): pid=28275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.10374" name="/newroot/2108/cgroup.controllers" dev="tmpfs" ino=10582 res=1 errno=0 [ 520.034429][ T30] audit: type=1800 audit(1757679327.464:10): pid=28275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.10374" name="cgroup.controllers" dev="tmpfs" ino=10582 res=0 errno=0 [ 520.103642][ T30] audit: type=1800 audit(1757679327.464:11): pid=28275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.10374" name="cgroup.controllers" dev="tmpfs" ino=10582 res=0 errno=0 [ 520.270983][T28298] sctp: [Deprecated]: syz.3.10379 (pid 28298) Use of struct sctp_assoc_value in delayed_ack socket option. [ 520.270983][T28298] Use struct sctp_sack_info instead [ 521.034395][T28331] tun0: tun_chr_ioctl cmd 1074025672 [ 521.039862][T28331] tun0: ignored: set checksum disabled [ 521.837912][T28374] batadv1: entered promiscuous mode [ 521.843170][T28374] batadv1: entered allmulticast mode [ 521.925569][T28379] __nla_validate_parse: 3 callbacks suppressed [ 521.925587][T28379] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10416'. [ 521.965183][T28379] macsec1: entered promiscuous mode [ 522.276581][T28393] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10419'. [ 522.548722][T28407] netlink: 'syz.1.10428': attribute type 1 has an invalid length. [ 522.570700][T28407] netlink: 232 bytes leftover after parsing attributes in process `syz.1.10428'. [ 522.582199][T28407] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10428'. [ 522.726343][T28420] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10432'. [ 522.869386][T28223] block nbd64: NBD_DISCONNECT [ 523.157908][T28215] udevd[28215]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 524.351747][T28485] macsec2: entered allmulticast mode [ 524.377313][T28485] ip6gretap0: entered allmulticast mode [ 524.400680][T28485] ip6gretap0: left allmulticast mode [ 524.982466][T28508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10473'. [ 525.237439][T28518] ip6gretap0: entered promiscuous mode [ 525.254062][T28518] macsec0: entered allmulticast mode [ 525.259439][T28518] ip6gretap0: entered allmulticast mode [ 525.278158][T28518] ip6gretap0: left allmulticast mode [ 525.294451][T28518] ip6gretap0: left promiscuous mode [ 525.313104][T28526] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10481'. [ 525.376342][T28525] 8021q: adding VLAN 0 to HW filter on device bond3 [ 525.387836][T28525] bond3: entered allmulticast mode [ 525.395857][T28525] bond0: (slave bond3): Enslaving as an active interface with an up link [ 525.431354][T28526] bond6: entered promiscuous mode [ 525.437218][T28526] 8021q: adding VLAN 0 to HW filter on device bond6 [ 525.960364][T28526] bond6 (unregistering): Released all slaves [ 526.089155][T28551] netlink: 'syz.3.10492': attribute type 1 has an invalid length. [ 526.109327][T28551] netlink: 'syz.3.10492': attribute type 1 has an invalid length. [ 526.138579][T28551] netlink: 216 bytes leftover after parsing attributes in process `syz.3.10492'. [ 526.167521][T28553] netlink: 'syz.0.10493': attribute type 14 has an invalid length. [ 526.355089][T28561] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10497'. [ 526.379104][T28561] netlink: 84 bytes leftover after parsing attributes in process `syz.5.10497'. [ 526.499414][T28567] netem: invalid attributes len -16 [ 526.526450][T28567] netem: change failed [ 526.942486][T28587] netlink: 'syz.0.10509': attribute type 1 has an invalid length. [ 526.959842][T28587] __nla_validate_parse: 1 callbacks suppressed [ 526.959861][T28587] netlink: 172 bytes leftover after parsing attributes in process `syz.0.10509'. [ 527.075339][T28593] netlink: 648 bytes leftover after parsing attributes in process `syz.5.10512'. [ 527.324575][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 527.540793][T28608] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 527.798836][T28618] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 528.047953][T28633] bridge0: port 3(batadv2) entered blocking state [ 528.057411][T28633] bridge0: port 3(batadv2) entered disabled state [ 528.067587][T28633] batadv2: entered allmulticast mode [ 528.078266][T28633] batadv2: entered promiscuous mode [ 528.089407][T28635] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 528.327232][T28651] netlink: 44 bytes leftover after parsing attributes in process `syz.3.10540'. [ 528.354001][T28651] netem: unknown loss type 12 [ 528.359252][T28651] netem: change failed [ 528.421908][T28656] netlink: 96 bytes leftover after parsing attributes in process `syz.0.10541'. [ 528.495849][T28660] netlink: 'syz.3.10545': attribute type 1 has an invalid length. [ 528.526407][T28660] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 528.549402][ T153] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 528.559064][ T153] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 528.827284][T28679] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10554'. [ 529.008825][T28687] netlink: 'syz.0.10557': attribute type 4 has an invalid length. [ 529.084518][T28689] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10558'. [ 529.104370][T28689] netlink: 32 bytes leftover after parsing attributes in process `syz.5.10558'. [ 529.160238][T28689] gretap1: entered promiscuous mode [ 529.417176][T28704] openvswitch: netlink: IPv4 tunnel dst address is zero [ 531.635966][T28799] netlink: 'syz.0.10608': attribute type 58 has an invalid length. [ 531.673464][T28799] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10608'. [ 533.579082][T28913] netlink: 'syz.0.10658': attribute type 1 has an invalid length. [ 533.753323][T28923] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10660'. [ 533.770373][T28923] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10660'. [ 533.882969][T28928] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 533.898012][T28928] syzkaller1: linktype set to 6 [ 535.257424][T29002] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10686'. [ 535.480738][T29014] tipc: Resetting bearer [ 535.499304][T29014] 8021q: adding VLAN 0 to HW filter on device team0 [ 535.510767][T29014] tipc: Resetting bearer [ 535.520140][T29014] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 536.023950][T29038] netlink: 'syz.4.10701': attribute type 1 has an invalid length. [ 536.038768][T29038] netlink: 160 bytes leftover after parsing attributes in process `syz.4.10701'. [ 536.073916][T29038] netlink: 'syz.4.10701': attribute type 1 has an invalid length. [ 536.082251][T29038] netlink: 'syz.4.10701': attribute type 2 has an invalid length. [ 536.265575][T29050] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.10704'. [ 536.607678][T29067] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10711'. [ 537.204327][T29099] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10725'. [ 537.652368][T29128] netlink: 'syz.0.10735': attribute type 11 has an invalid length. [ 537.683038][T29128] netlink: 36 bytes leftover after parsing attributes in process `syz.0.10735'. [ 538.032483][T29146] netlink: 'syz.4.10742': attribute type 3 has an invalid length. [ 538.446828][T29168] netlink: 27 bytes leftover after parsing attributes in process `syz.0.10750'. [ 539.557169][ T5876] block nbd1: Receive control failed (result -32) [ 539.602964][T29185] nbd1: detected capacity change from 0 to 127 [ 539.619675][T29194] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10760'. [ 539.670310][T29197] block nbd1: Dead connection, failed to find a fallback [ 539.687034][T29197] block nbd1: shutting down sockets [ 539.692806][T29197] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.704552][T29197] Buffer I/O error on dev nbd1, logical block 0, async page read [ 539.712557][T29197] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.722377][T29197] Buffer I/O error on dev nbd1, logical block 1, async page read [ 539.730843][T29197] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.748611][T29197] Buffer I/O error on dev nbd1, logical block 2, async page read [ 539.777182][T29197] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.807237][T29197] Buffer I/O error on dev nbd1, logical block 3, async page read [ 539.828203][T29197] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.874657][T29197] Buffer I/O error on dev nbd1, logical block 0, async page read [ 539.882802][T29197] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.929784][T29197] Buffer I/O error on dev nbd1, logical block 1, async page read [ 539.954702][T29197] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 539.983952][T29197] Buffer I/O error on dev nbd1, logical block 2, async page read [ 539.991880][T29197] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 540.026163][T29197] Buffer I/O error on dev nbd1, logical block 3, async page read [ 540.064180][T29197] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 540.086562][T29197] Buffer I/O error on dev nbd1, logical block 0, async page read [ 540.109594][T29197] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 540.139187][T29197] Buffer I/O error on dev nbd1, logical block 1, async page read [ 540.169190][T29197] ldm_validate_partition_table(): Disk read failed. [ 540.183042][T29197] Dev nbd1: unable to read RDB block 0 [ 540.191380][T29197] nbd1: unable to read partition table [ 540.220587][T29197] ldm_validate_partition_table(): Disk read failed. [ 540.236020][T29197] Dev nbd1: unable to read RDB block 0 [ 540.243676][T29197] nbd1: unable to read partition table [ 540.751463][T29258] netlink: 332 bytes leftover after parsing attributes in process `syz.0.10787'. [ 540.956949][T29270] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10792'. [ 540.967058][T29270] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10792'. [ 541.114548][T29277] netlink: 203516 bytes leftover after parsing attributes in process `syz.5.10794'. [ 541.153822][T29277] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 541.173343][T29277] openvswitch: netlink: Duplicate key (type 0). [ 541.286713][T29285] netlink: 'syz.0.10800': attribute type 1 has an invalid length. [ 541.343014][T29289] netlink: 277 bytes leftover after parsing attributes in process `syz.4.10802'. [ 542.000487][T29322] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10817'. [ 542.039736][T29328] netlink: 20 bytes leftover after parsing attributes in process `syz.5.10820'. [ 542.062856][T29322] netlink: 'syz.4.10817': attribute type 14 has an invalid length. [ 542.084171][T29322] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10817'. [ 542.583238][T29359] netlink: 'syz.5.10833': attribute type 83 has an invalid length. [ 542.702878][T29363] netlink: 'syz.0.10836': attribute type 6 has an invalid length. [ 542.712858][T29363] netlink: 'syz.0.10836': attribute type 6 has an invalid length. [ 542.715056][T29362] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10835'. [ 542.948478][ T74] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.976964][ T74] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.998667][ T74] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 543.017926][ T74] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 543.288035][T29389] netlink: 'syz.0.10849': attribute type 1 has an invalid length. [ 543.297479][T29389] netlink: 'syz.0.10849': attribute type 4 has an invalid length. [ 543.346965][T29392] netlink: 'syz.4.10850': attribute type 1 has an invalid length. [ 543.923132][T29421] netlink: 'syz.1.10863': attribute type 6 has an invalid length. [ 544.258747][T29440] netlink: 'syz.5.10872': attribute type 9 has an invalid length. [ 544.503322][ T30] audit: type=1800 audit(1757679351.954:12): pid=29457 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.10880" name="memory.events" dev="tmpfs" ino=11152 res=0 errno=0 [ 544.547074][ T30] audit: type=1804 audit(1757679351.964:13): pid=29457 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.10880" name="/newroot/2221/memory.events" dev="tmpfs" ino=11152 res=1 errno=0 [ 544.667919][T29463] __nla_validate_parse: 6 callbacks suppressed [ 544.667939][T29463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10883'. [ 544.711227][T29463] gretap0: entered promiscuous mode [ 544.901047][T29477] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.10889'. [ 544.922484][T29479] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10891'. [ 545.178251][T29494] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10897'. [ 545.833051][T29517] batadv_slave_1: entered promiscuous mode [ 545.850125][T29517] batman_adv: batadv0: Adding interface: macsec1 [ 545.859366][T29517] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 545.886139][T29517] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 545.897704][T29517] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 545.923988][T29517] batman_adv: batadv0: Interface activated: macsec1 [ 545.975444][T29525] veth0: entered promiscuous mode [ 545.980900][T29525] veth0: left promiscuous mode [ 546.066248][T29529] tipc: New replicast peer: 255.255.255.255 [ 546.074438][T29529] tipc: Enabled bearer , priority 6 [ 546.344725][T29545] netlink: 20 bytes leftover after parsing attributes in process `syz.5.10921'. [ 546.354022][T29543] sctp: [Deprecated]: syz.0.10920 (pid 29543) Use of struct sctp_assoc_value in delayed_ack socket option. [ 546.354022][T29543] Use struct sctp_sack_info instead [ 546.793057][T29576] sctp: [Deprecated]: syz.4.10934 (pid 29576) Use of int in max_burst socket option. [ 546.793057][T29576] Use struct sctp_assoc_value instead [ 546.979783][T29585] netlink: 164548 bytes leftover after parsing attributes in process `syz.5.10937'. [ 547.172225][T29595] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10943'. [ 547.226349][T29599] netlink: 'syz.5.10945': attribute type 1 has an invalid length. [ 547.253802][T29599] netlink: 'syz.5.10945': attribute type 2 has an invalid length. [ 547.270196][T29599] netlink: 'syz.5.10945': attribute type 1 has an invalid length. [ 547.282842][T29599] netlink: 1156 bytes leftover after parsing attributes in process `syz.5.10945'. [ 547.828559][T29628] sctp: [Deprecated]: syz.1.10958 (pid 29628) Use of int in maxseg socket option. [ 547.828559][T29628] Use struct sctp_assoc_value instead [ 547.985363][T29635] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 548.001406][T29635] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 548.010242][T29635] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 548.019850][T29635] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 548.031096][T29635] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 548.101803][T29633] vxcan1 speed is unknown, defaulting to 1000 [ 548.498027][T29633] wg1 speed is unknown, defaulting to 1000 [ 548.670564][T29659] netlink: 65039 bytes leftover after parsing attributes in process `syz.5.10970'. [ 548.674482][T29662] netlink: 'syz.4.10971': attribute type 1 has an invalid length. [ 548.781932][T29665] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10973'. [ 548.911542][T29633] chnl_net:caif_netlink_parms(): no params data found [ 549.096865][T29633] bridge0: port 1(bridge_slave_0) entered blocking state [ 549.113987][T29633] bridge0: port 1(bridge_slave_0) entered disabled state [ 549.121300][T29633] bridge_slave_0: entered allmulticast mode [ 549.156739][T29633] bridge_slave_0: entered promiscuous mode [ 549.188667][T29683] vlan4: entered promiscuous mode [ 549.196149][T29683] bond0: entered promiscuous mode [ 549.201224][T29683] bond_slave_0: entered promiscuous mode [ 549.211964][T29683] bond_slave_1: entered promiscuous mode [ 549.225147][T29633] bridge0: port 2(bridge_slave_1) entered blocking state [ 549.249466][T29633] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.263204][T29633] bridge_slave_1: entered allmulticast mode [ 549.283101][T29633] bridge_slave_1: entered promiscuous mode [ 549.429565][T29633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 549.457807][T29633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 549.580830][T29633] team0: Port device team_slave_0 added [ 549.605543][T29633] team0: Port device team_slave_1 added [ 549.690871][T29705] netlink: 'syz.1.10990': attribute type 1 has an invalid length. [ 549.739334][T29633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 549.755520][T29633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 549.834077][T29633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 549.856160][T29633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 549.863136][T29633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 549.964457][T29633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 550.041617][ T6019] vxcan1 speed is unknown, defaulting to 1000 [ 550.124511][ T5876] Bluetooth: hci6: command tx timeout [ 550.241745][T29633] hsr_slave_0: entered promiscuous mode [ 550.269508][T29633] hsr_slave_1: entered promiscuous mode [ 550.292720][T29633] debugfs: 'hsr0' already exists in 'hsr' [ 550.309129][T29633] Cannot create hsr debugfs directory [ 550.514238][T29734] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11002'. [ 550.927961][T29756] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11013'. [ 551.055464][T29633] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 551.114855][T29633] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 551.152440][T29633] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 551.215370][T29633] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 551.313446][T29773] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11019'. [ 551.324200][T29770] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 551.596430][T29633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.613130][T29788] netlink: 32 bytes leftover after parsing attributes in process `syz.0.11025'. [ 551.624048][T29788] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 551.714955][T29633] 8021q: adding VLAN 0 to HW filter on device team0 [ 551.759471][ T5975] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.766685][ T5975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 551.843740][ T5975] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.850942][ T5975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 551.977348][T29799] nbd2: detected capacity change from 0 to 549764202496 [ 551.981480][T29633] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 551.997511][ T5876] block nbd2: Receive control failed (result -32) [ 552.007931][T29197] block nbd2: Dead connection, failed to find a fallback [ 552.015493][T29197] block nbd2: shutting down sockets [ 552.020821][T29197] blk_print_req_error: 138 callbacks suppressed [ 552.020837][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.038953][T29197] buffer_io_error: 138 callbacks suppressed [ 552.038969][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.053384][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.062697][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.070781][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.083879][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.091825][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.133660][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.174122][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.183221][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.205813][ T5876] Bluetooth: hci6: command tx timeout [ 552.225485][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.236847][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.245730][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.258547][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.267255][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.293062][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.314281][T29197] ldm_validate_partition_table(): Disk read failed. [ 552.321089][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.357533][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.414179][T29197] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 552.442926][T29197] Buffer I/O error on dev nbd2, logical block 0, async page read [ 552.482444][T29824] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11039'. [ 552.492528][T29197] Dev nbd2: unable to read RDB block 0 [ 552.514155][T29197] nbd2: unable to read partition table [ 552.544791][T29197] ldm_validate_partition_table(): Disk read failed. [ 552.571756][T29197] Dev nbd2: unable to read RDB block 0 [ 552.580247][T29633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 552.624968][T29197] nbd2: unable to read partition table [ 553.035255][T29849] netlink: del zone limit has 4 unknown bytes [ 553.277730][T29633] veth0_vlan: entered promiscuous mode [ 553.321771][T29633] veth1_vlan: entered promiscuous mode [ 553.409737][T29633] veth0_macvtap: entered promiscuous mode [ 553.425363][T29865] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11056'. [ 553.447607][T29633] veth1_macvtap: entered promiscuous mode [ 553.505649][T29633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 553.555511][T29633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 553.593449][ T1165] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.669687][ T1165] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.689940][ T1165] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.812378][ T1165] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.127211][ T5975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.155120][ T5975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.234701][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.248696][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.284237][ T5876] Bluetooth: hci6: command tx timeout [ 554.751134][T29904] bond0: (slave wlan1): Releasing backup interface [ 555.313258][T29926] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 555.396889][T29926] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 555.842726][T29935] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11086'. [ 556.224741][T29944] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 556.364230][ T5876] Bluetooth: hci6: command tx timeout [ 556.510435][T29957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11095'. [ 556.542268][T29957] netlink: 120 bytes leftover after parsing attributes in process `syz.4.11095'. [ 556.561967][T29957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11095'. [ 557.169338][T29985] netlink: 32 bytes leftover after parsing attributes in process `syz.6.11109'. [ 557.423356][T29996] netlink: 232 bytes leftover after parsing attributes in process `syz.1.11113'. [ 557.546900][T30004] tipc: Resetting bearer [ 557.872244][T30018] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11124'. [ 557.885774][T30019] netlink: 20 bytes leftover after parsing attributes in process `syz.5.11125'. [ 558.386319][T30045] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2621 [ 558.444282][ T5876] Bluetooth: hci6: command tx timeout [ 558.604549][T30055] netlink: 'syz.6.11141': attribute type 15 has an invalid length. [ 559.267418][T30087] netlink: 'syz.4.11156': attribute type 64 has an invalid length. [ 559.975572][T30123] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11173'. [ 560.017233][T30123] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 560.540903][T30147] vlan2: entered promiscuous mode [ 560.776725][T30154] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.11188'. [ 561.783267][T30180] (unnamed net_device) (uninitialized): ARP target 9.0.0.0 is already present [ 561.814163][T30180] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (9) [ 562.258999][T30195] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11206'. [ 562.486841][T30199] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11208'. [ 562.615532][T30207] vcan0: tx address claim with dlc 0 [ 563.025168][T30223] block nbd3: server does not support multiple connections per device. [ 563.037135][T30223] block nbd3: shutting down sockets [ 563.244921][T30235] netlink: 92 bytes leftover after parsing attributes in process `syz.4.11224'. [ 564.004944][T30259] netlink: 165 bytes leftover after parsing attributes in process `syz.4.11236'. [ 564.079655][T30263] macsec2: entered promiscuous mode [ 564.089143][T30263] macsec0: entered promiscuous mode [ 564.099641][T30263] macsec2: entered allmulticast mode [ 564.118144][T30263] macsec0: entered allmulticast mode [ 564.126968][T30263] veth1_macvtap: entered allmulticast mode [ 565.496295][T30317] netlink: 76 bytes leftover after parsing attributes in process `syz.4.11263'. [ 566.784023][T30364] erspan0: entered promiscuous mode [ 566.807675][T30364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11286'. [ 567.161853][T30376] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input5 [ 567.959265][T30412] tun0: tun_chr_ioctl cmd 1074025673 [ 568.518793][T30435] netlink: 'syz.4.11320': attribute type 1 has an invalid length. [ 568.551275][T30435] netlink: 92 bytes leftover after parsing attributes in process `syz.4.11320'. [ 568.629616][T30440] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11321'. [ 570.014845][T30482] netlink: 'syz.6.11340': attribute type 1 has an invalid length. [ 570.023310][T30482] netlink: 17 bytes leftover after parsing attributes in process `syz.6.11340'. [ 570.277862][T30491] netlink: 188 bytes leftover after parsing attributes in process `syz.6.11344'. [ 571.568552][T30541] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11368'. [ 572.668127][T30588] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11387'. [ 573.269432][T30613] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11399'. [ 573.285162][T30613] netlink: 120 bytes leftover after parsing attributes in process `syz.1.11399'. [ 573.301086][T30613] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11399'. [ 573.433578][T30623] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11404'. [ 573.743318][T30640] __nla_validate_parse: 1 callbacks suppressed [ 573.743337][T30640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11412'. [ 573.872654][T30648] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11415'. [ 575.538609][T30716] syzkaller1: tun_chr_ioctl cmd 2148553947 [ 575.608939][T30722] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11452'. [ 576.082059][T30750] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11466'. [ 576.093448][T30750] netlink: 'syz.4.11466': attribute type 29 has an invalid length. [ 576.112061][T30750] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11466'. [ 576.318715][T30763] netlink: 92 bytes leftover after parsing attributes in process `syz.4.11473'. [ 576.350209][T30764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11472'. [ 579.040893][T30864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11517'. [ 579.145790][T30864] bond0 (unregistering): (slave bond3): Releasing backup interface [ 579.160379][T30864] bond3: left allmulticast mode [ 579.198576][T30864] bond0 (unregistering): Released all slaves [ 580.865400][T30944] netlink: 44 bytes leftover after parsing attributes in process `syz.4.11554'. [ 580.898422][T30944] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11554'. [ 580.915470][T29635] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 580.925611][T29635] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 580.934652][T29635] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 580.944544][T29635] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 580.957885][T29635] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 580.968856][T30943] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11553'. [ 581.028573][T30943] netlink: 56 bytes leftover after parsing attributes in process `syz.1.11553'. [ 581.144670][T30959] smc: net device bond0 erased user defined pnetid SYZ [ 581.231556][T30947] vxcan1 speed is unknown, defaulting to 1000 [ 581.654819][T30982] netlink: 'syz.5.11570': attribute type 3 has an invalid length. [ 581.671692][T30982] netlink: 'syz.5.11570': attribute type 3 has an invalid length. [ 581.940195][T30947] wg1 speed is unknown, defaulting to 1000 [ 582.235088][T31007] sctp: [Deprecated]: syz.4.11581 (pid 31007) Use of struct sctp_assoc_value in delayed_ack socket option. [ 582.235088][T31007] Use struct sctp_sack_info instead [ 582.379048][T31015] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11585'. [ 582.409669][T31015] netem: change failed [ 582.453386][T30947] chnl_net:caif_netlink_parms(): no params data found [ 582.571270][T31027] netlink: 'syz.5.11591': attribute type 1 has an invalid length. [ 582.598381][T31027] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11591'. [ 582.614101][T31027] netlink: 97 bytes leftover after parsing attributes in process `syz.5.11591'. [ 582.913402][T31044] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11598'. [ 582.932481][T31044] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 582.955836][T30947] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.964366][T31044] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 582.981416][T30947] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.991096][T30947] bridge_slave_0: entered allmulticast mode [ 583.015325][T30947] bridge_slave_0: entered promiscuous mode [ 583.055910][T30947] bridge0: port 2(bridge_slave_1) entered blocking state [ 583.084250][ T5876] Bluetooth: hci7: command tx timeout [ 583.092337][T30947] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.100816][T30947] bridge_slave_1: entered allmulticast mode [ 583.109045][T30947] bridge_slave_1: entered promiscuous mode [ 583.223508][T30947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 583.260336][T30947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 583.284397][T31059] netlink: 28 bytes leftover after parsing attributes in process `syz.6.11604'. [ 583.428868][T30947] team0: Port device team_slave_0 added [ 583.473605][T30947] team0: Port device team_slave_1 added [ 583.608432][T30947] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 583.626358][T30947] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 583.655198][T30947] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 583.670947][T30947] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 583.681349][T30947] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 583.719835][T30947] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.003185][T31082] tipc: Disabling bearer [ 584.014606][T31082] team_slave_0: left promiscuous mode [ 584.026866][T31082] team0 (unregistering): Port device team_slave_0 removed [ 584.034345][T31082] team_slave_1: left promiscuous mode [ 584.042649][T31082] team0 (unregistering): Port device team_slave_1 removed [ 584.073260][T30947] hsr_slave_0: entered promiscuous mode [ 584.081694][T30947] hsr_slave_1: entered promiscuous mode [ 584.088720][T30947] debugfs: 'hsr0' already exists in 'hsr' [ 584.094757][T30947] Cannot create hsr debugfs directory [ 584.816264][T31114] __nla_validate_parse: 1 callbacks suppressed [ 584.816283][T31114] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11630'. [ 584.863106][T30947] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 584.936332][T30947] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 584.962615][T30947] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 584.999437][T30947] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 585.027531][T31124] sctp: [Deprecated]: syz.5.11635 (pid 31124) Use of struct sctp_assoc_value in delayed_ack socket option. [ 585.027531][T31124] Use struct sctp_sack_info instead [ 585.164526][ T5876] Bluetooth: hci7: command tx timeout [ 585.257855][T30947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.340374][T30947] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.414324][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.421504][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.458603][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.465851][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.642338][T30947] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 585.898525][T31165] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11650'. [ 585.954508][T31170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11652'. [ 585.995780][T31170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11652'. [ 586.138221][T30947] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 586.926972][T30947] veth0_vlan: entered promiscuous mode [ 586.959969][T30947] veth1_vlan: entered promiscuous mode [ 587.080793][T31218] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11671'. [ 587.091611][T30947] veth0_macvtap: entered promiscuous mode [ 587.105853][T30947] veth1_macvtap: entered promiscuous mode [ 587.177343][T30947] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.216519][T30947] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.244550][ T5876] Bluetooth: hci7: command tx timeout [ 587.256128][T31222] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11674'. [ 587.275399][ T5975] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.286532][ T5975] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.312335][T31222] batman_adv: batadv0: Adding interface: ipvlan2 [ 587.321512][T31222] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 587.351801][T31222] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 587.362873][T31222] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 587.373277][T31222] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 587.399575][ T5975] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.433076][ T5975] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.628423][ T5975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.654351][ T5975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.759015][ T153] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.782177][ T153] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.901833][T31245] syzkaller1: tun_chr_ioctl cmd 2147767520 [ 588.086131][T31258] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 588.368409][T31272] netlink: 24 bytes leftover after parsing attributes in process `syz.5.11697'. [ 588.395601][T31274] netlink: 'syz.1.11698': attribute type 12 has an invalid length. [ 588.395874][T31272] netlink: 24 bytes leftover after parsing attributes in process `syz.5.11697'. [ 588.405639][T31274] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.11698'. [ 588.719151][T31285] netlink: 'syz.7.11703': attribute type 1 has an invalid length. [ 588.802038][T31287] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.11704'. [ 589.326101][ T5876] Bluetooth: hci7: command tx timeout [ 589.649776][T31327] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 589.983387][T31345] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11732'. [ 590.032221][T31345] tipc: Resetting bearer [ 590.550414][T31345] tipc: Disabling bearer [ 590.583642][T31373] netlink: 16 bytes leftover after parsing attributes in process `syz.7.11743'. [ 590.612787][T31357] netlink: 40 bytes leftover after parsing attributes in process `syz.6.11738'. [ 590.758519][T31376] netlink: 277 bytes leftover after parsing attributes in process `syz.1.11745'. [ 591.350241][T31407] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11759'. [ 591.736112][T31407] team0 (unregistering): left promiscuous mode [ 591.877152][ T74] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 591.896521][ T74] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 591.906197][ T10] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 591.914512][T31429] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11767'. [ 592.235021][T31435] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 592.374600][ T10] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 592.876557][T31468] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 592.924683][ T10] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 592.967044][T31471] netlink: 'syz.6.11783': attribute type 1 has an invalid length. [ 592.998682][T31471] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11783'. [ 593.067608][T31473] netlink: 'syz.5.11784': attribute type 1 has an invalid length. [ 593.094258][T31473] netlink: 'syz.5.11784': attribute type 2 has an invalid length. [ 593.133021][T31473] netlink: 1172 bytes leftover after parsing attributes in process `syz.5.11784'. [ 593.862657][T31513] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 593.887536][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 595.081737][T31562] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11814'. [ 595.649797][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 595.744038][T31562] team0 (unregistering): Port device team_slave_0 removed [ 595.761251][T31562] team0 (unregistering): Port device team_slave_1 removed [ 601.271023][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.323297][T31758] netlink: 165 bytes leftover after parsing attributes in process `syz.5.11903'. [ 601.430761][T31748] 8021q: adding VLAN 0 to HW filter on device bond6 [ 601.462248][T31748] bond0: (slave bond6): Enslaving as an active interface with an up link [ 601.734479][T31778] netlink: 'syz.5.11912': attribute type 1 has an invalid length. [ 601.734751][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.781746][T31778] netlink: 172 bytes leftover after parsing attributes in process `syz.5.11912'. [ 601.823871][T31778] netlink: 'syz.5.11912': attribute type 1 has an invalid length. [ 601.956665][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.056980][T31792] IPVS: length: 91191230 != 8 [ 602.175862][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.482155][T31815] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11929'. [ 602.801668][ T13] bridge_slave_1: left allmulticast mode [ 602.824691][ T13] bridge_slave_1: left promiscuous mode [ 602.843863][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.884674][ T13] bridge_slave_0: left allmulticast mode [ 602.897902][ T13] bridge_slave_0: left promiscuous mode [ 602.909259][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.442244][ T13]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 603.454365][ T13]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 603.466070][ T13]  (unregistering): Released all slaves [ 603.490016][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 603.605691][ T13] bond1 (unregistering): Released all slaves [ 603.646504][ T13] bond2 (unregistering): Released all slaves [ 603.743280][T31846] netlink: 'syz.7.11943': attribute type 11 has an invalid length. [ 603.821744][ T13] bond0 (unregistering): Released all slaves [ 604.148697][ T13] þ: left promiscuous mode [ 604.598203][T31876] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 605.788877][ T13] hsr_slave_0: left promiscuous mode [ 605.834419][ T13] hsr_slave_1: left promiscuous mode [ 605.868904][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 605.904251][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 605.934991][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 605.961934][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 606.015996][T31911] netlink: 277 bytes leftover after parsing attributes in process `syz.6.11971'. [ 606.087357][ T13] veth1_macvtap: left promiscuous mode [ 606.114553][ T13] veth1_vlan: left promiscuous mode [ 606.802391][T31934] openvswitch: netlink: IP tunnel dst address not specified [ 607.091316][T31942] nbd: socks must be embedded in a SOCK_ITEM attr [ 607.316264][ T13] team0 (unregistering): Port device team_slave_1 removed [ 607.415642][ T13] team0 (unregistering): Port device C removed [ 607.576256][T31954] sctp: [Deprecated]: syz.1.11990 (pid 31954) Use of int in max_burst socket option deprecated. [ 607.576256][T31954] Use struct sctp_assoc_value instead [ 607.823659][T31962] netlink: 'syz.1.11994': attribute type 1 has an invalid length. [ 607.831802][T31962] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11994'. [ 608.450769][T31971] pimreg: entered allmulticast mode [ 608.498809][T31971] pimreg: left allmulticast mode [ 608.934044][ T6005] IPVS: starting estimator thread 0... [ 609.043902][T31998] IPVS: using max 33 ests per chain, 79200 per kthread [ 609.340671][ T6019] wg1 speed is unknown, defaulting to 1000 [ 609.359236][ T6019] syz0: Port: 1 Link DOWN [ 609.529024][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 609.581639][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.747492][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 609.769766][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.993075][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 610.029508][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.193521][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 610.221823][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.539130][T32054] netlink: 36 bytes leftover after parsing attributes in process `syz.6.12033'. [ 610.573009][T32054] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 612.129898][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 612.148094][ T13] bond0 (unregistering): (slave c@0Ù): Releasing backup interface [ 612.161409][ T13] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 612.172514][ T13] bond0 (unregistering): Released all slaves [ 612.189889][ T13] bond1 (unregistering): Released all slaves [ 612.205417][ T13] bond2 (unregistering): Released all slaves [ 612.518565][ T13] : left promiscuous mode [ 612.584138][T32098] block nbd4: server does not support multiple connections per device. [ 612.614423][ T13] tipc: Left network mode [ 612.624863][T32098] block nbd4: shutting down sockets [ 612.935906][T32121] netlink: 12 bytes leftover after parsing attributes in process `syz.6.12063'. [ 612.945353][T32121] nbd: couldn't find a device at index 65546 [ 613.304400][T32136] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12070'. [ 613.314767][T32137] netlink: 'syz.7.12071': attribute type 9 has an invalid length. [ 613.532032][T32143] netlink: 36 bytes leftover after parsing attributes in process `syz.7.12074'. [ 613.801981][ T13] hsr_slave_0: left promiscuous mode [ 613.842530][ T13] hsr_slave_1: left promiscuous mode [ 613.852557][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 613.863793][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 613.959362][ T13] veth1_macvtap: left promiscuous mode [ 614.024639][ T13] veth0_macvtap: left promiscuous mode [ 614.037729][ T13] veth1_vlan: left allmulticast mode [ 614.062172][ T13] veth1_vlan: left promiscuous mode [ 614.073364][ T13] veth0_vlan: left promiscuous mode [ 614.710203][ T13] macvlan1 (unregistering): left allmulticast mode [ 615.253420][ T13] team0 (unregistering): Port device team_slave_1 removed [ 615.299688][ T13] team0 (unregistering): Port device team_slave_0 removed [ 615.951141][T32189] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 615.958448][T32189] IPv6: NLM_F_CREATE should be set when creating new route [ 615.965777][T32189] IPv6: NLM_F_CREATE should be set when creating new route [ 615.973016][T32189] IPv6: NLM_F_CREATE should be set when creating new route [ 616.065390][T32159] vlan2: entered allmulticast mode [ 616.092723][T32159] batadv0: entered allmulticast mode [ 616.754470][ T13] IPVS: stop unused estimator thread 0... [ 617.396157][T32243] tap0: tun_chr_ioctl cmd 35108 [ 617.440118][T32248] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12119'. [ 617.839945][T32268] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 618.060429][T32278] netlink: 12 bytes leftover after parsing attributes in process `syz.7.12132'. [ 618.537422][T32300] netlink: 8 bytes leftover after parsing attributes in process `syz.7.12145'. [ 618.568892][T32302] netlink: 24 bytes leftover after parsing attributes in process `syz.5.12146'. [ 618.577543][T32300] netlink: 8 bytes leftover after parsing attributes in process `syz.7.12145'. [ 618.843887][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 619.451119][T32347] veth0_to_bridge: entered promiscuous mode [ 619.480733][T32344] veth0_to_bridge: left promiscuous mode [ 619.616228][T32356] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 623.190590][T32514] netlink: 8 bytes leftover after parsing attributes in process `syz.6.12240'. [ 623.400815][T32524] netlink: 8 bytes leftover after parsing attributes in process `syz.6.12245'. [ 623.643028][T32538] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12251'. [ 623.683550][T32538] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12251'. [ 623.695497][T32540] netlink: 'syz.6.12250': attribute type 8 has an invalid length. [ 623.721268][T32538] netlink: 'syz.4.12251': attribute type 20 has an invalid length. [ 624.818267][T32583] netlink: 4 bytes leftover after parsing attributes in process `syz.7.12271'. [ 624.848419][T32586] netlink: 8 bytes leftover after parsing attributes in process `syz.6.12272'. [ 625.158972][T32600] netlink: 16 bytes leftover after parsing attributes in process `syz.7.12280'. [ 626.274293][T32651] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12304'. [ 626.322106][T32654] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 627.178861][T32703] netlink: 104 bytes leftover after parsing attributes in process `syz.1.12329'. [ 627.234177][T32698] netlink: 368 bytes leftover after parsing attributes in process `syz.6.12327'. [ 627.680829][T32723] netlink: 'syz.7.12339': attribute type 1 has an invalid length. [ 628.356787][T32757] __nla_validate_parse: 3 callbacks suppressed [ 628.356808][T32757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12355'. [ 628.620938][ T303] vxlan0: entered promiscuous mode [ 628.647545][ T303] vxlan0: entered allmulticast mode [ 628.667235][ T13] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.685014][ T13] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.713944][ T13] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.723294][ T13] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 629.074648][ T329] tap0: tun_chr_ioctl cmd 1074025677 [ 629.080191][ T329] tap0: linktype set to 769 [ 629.555432][ T349] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 629.975103][ T369] openvswitch: netlink: Message has 16 unknown bytes. [ 630.044879][ T374] netlink: 'syz.1.12396': attribute type 21 has an invalid length. [ 630.083454][ T374] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12396'. [ 630.348155][ T384] netlink: 20 bytes leftover after parsing attributes in process `syz.5.12402'. [ 631.066640][ T415] netlink: 20 bytes leftover after parsing attributes in process `syz.6.12414'. [ 631.262477][ T423] netlink: 12 bytes leftover after parsing attributes in process `syz.7.12418'. [ 631.278028][ T426] netlink: 'syz.4.12419': attribute type 1 has an invalid length. [ 631.311818][ T426] netlink: 'syz.4.12419': attribute type 2 has an invalid length. [ 631.325448][ T427] netlink: 64 bytes leftover after parsing attributes in process `syz.6.12420'. [ 631.339472][ T426] netlink: 'syz.4.12419': attribute type 1 has an invalid length. [ 631.368170][ T426] netlink: 'syz.4.12419': attribute type 2 has an invalid length. [ 631.475015][ T435] netlink: 56 bytes leftover after parsing attributes in process `syz.6.12425'. [ 631.570339][ T441] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12427'. [ 632.000279][T14154] cgroup: fork rejected by pids controller in /syz5 [ 632.412912][ T480] netlink: 36 bytes leftover after parsing attributes in process `syz.7.12447'. [ 632.423279][ T480] netlink: 8 bytes leftover after parsing attributes in process `syz.7.12447'. [ 632.713213][ T458] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 632.730619][ T458] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 632.750593][ T458] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 632.776870][ T458] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 632.827979][ T500] bond0: entered promiscuous mode [ 632.833123][ T500] syz_tun: entered promiscuous mode [ 632.840835][ T500] bond6: entered promiscuous mode [ 632.860084][ T500] bond0: left promiscuous mode [ 632.869765][ T500] syz_tun: left promiscuous mode [ 632.891187][ T500] bond6: left promiscuous mode [ 632.943286][ T458] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 632.956946][ T458] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 633.176450][ T458] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 633.207874][ T458] Bluetooth: hci7: Error when powering off device on rfkill (-4) [ 633.512884][ T522] netlink: 'syz.7.12466': attribute type 1 has an invalid length. [ 633.521525][ T522] __nla_validate_parse: 3 callbacks suppressed [ 633.521544][ T522] netlink: 172 bytes leftover after parsing attributes in process `syz.7.12466'. [ 633.688577][ T74] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.830620][ T74] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.927184][ T74] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.176237][ T74] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.193403][ T542] sctp: [Deprecated]: syz.4.12477 (pid 542) Use of int in maxseg socket option. [ 634.193403][ T542] Use struct sctp_assoc_value instead [ 634.836162][T29635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 634.850467][T29635] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 634.859857][T29635] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 634.872788][T29635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 634.882331][T29635] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 634.912849][ T5876] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 634.933326][ T5876] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 634.943094][ T5876] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 634.953162][ T5876] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 634.962409][ T5876] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 635.510599][ T74] dvmrp0 (unregistering): left allmulticast mode [ 635.529730][ T587] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 635.657247][ T74] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 635.681289][ T74] macvlan0: left promiscuous mode [ 635.690221][ T74] veth1_vlan: left allmulticast mode [ 635.701480][ T74] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 635.723420][ T74] mac80211_hwsim hwsim20 wlan1: left promiscuous mode [ 635.741363][ T74] bond0 (unregistering): Released all slaves [ 635.782579][ T74] bond1 (unregistering): Released all slaves [ 636.078700][ T74] bond2 (unregistering): Released all slaves [ 636.193218][ T565] vxcan1 speed is unknown, defaulting to 1000 [ 636.241548][ T74] _ÐZ`Ô€@ÿÿ: left promiscuous mode [ 636.446337][ T74] _ÐZ`Ô€@S!: left promiscuous mode [ 636.534678][ T74] ave_0: left promiscuous mode [ 636.694344][ T74] tipc: Disabling bearer [ 636.724080][ T74] tipc: Left network mode [ 637.012256][ T5876] Bluetooth: hci0: command tx timeout [ 637.569346][ T5876] Bluetooth: hci4: command tx timeout [ 638.014366][ T74] hsr_slave_0: left promiscuous mode [ 638.033514][ T74] hsr_slave_1: left promiscuous mode [ 639.086119][ T5876] Bluetooth: hci0: command tx timeout [ 641.021867][ T565] chnl_net:caif_netlink_parms(): no params data found [ 641.164363][ T5876] Bluetooth: hci0: command tx timeout [ 641.676835][ T565] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.694394][ T565] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.712428][ T565] bridge_slave_0: entered allmulticast mode [ 641.806906][ T565] bridge_slave_0: entered promiscuous mode [ 641.845922][ T74] ================================================================== [ 641.854308][ T74] BUG: KASAN: slab-use-after-free in __xfrm_state_delete+0x696/0xca0 [ 641.862573][ T74] Write of size 8 at addr ffff8880549ad130 by task kworker/u8:4/74 [ 641.870489][ T74] [ 641.872842][ T74] CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) [ 641.872864][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 641.872877][ T74] Workqueue: netns cleanup_net [ 641.872910][ T74] Call Trace: [ 641.872918][ T74] [ 641.872927][ T74] dump_stack_lvl+0x189/0x250 [ 641.872951][ T74] ? __virt_addr_valid+0x1c8/0x5c0 [ 641.872975][ T74] ? rcu_is_watching+0x15/0xb0 [ 641.872993][ T74] ? __kasan_check_byte+0x12/0x40 [ 641.873019][ T74] ? __pfx_dump_stack_lvl+0x10/0x10 [ 641.873040][ T74] ? rcu_is_watching+0x15/0xb0 [ 641.873059][ T74] ? lock_release+0x4b/0x3e0 [ 641.873088][ T74] ? __virt_addr_valid+0x1c8/0x5c0 [ 641.873112][ T74] ? __virt_addr_valid+0x4a5/0x5c0 [ 641.873137][ T74] print_report+0xca/0x240 [ 641.873155][ T74] ? __xfrm_state_delete+0x696/0xca0 [ 641.873178][ T74] kasan_report+0x118/0x150 [ 641.873206][ T74] ? __xfrm_state_delete+0x696/0xca0 [ 641.873233][ T74] __xfrm_state_delete+0x696/0xca0 [ 641.873262][ T74] xfrm_state_flush+0x45f/0x770 [ 641.873291][ T74] xfrm6_tunnel_net_exit+0x3c/0x100 [ 641.873319][ T74] ops_undo_list+0x497/0x990 [ 641.873345][ T74] ? __pfx_ops_undo_list+0x10/0x10 [ 641.873368][ T74] ? do_raw_spin_unlock+0x122/0x240 [ 641.873394][ T74] cleanup_net+0x4c5/0x800 [ 641.873417][ T74] ? __pfx_cleanup_net+0x10/0x10 [ 641.873439][ T74] ? _raw_spin_unlock_irq+0x23/0x50 [ 641.873459][ T74] ? process_scheduled_works+0x9ef/0x17b0 [ 641.873478][ T74] ? process_scheduled_works+0x9ef/0x17b0 [ 641.873498][ T74] process_scheduled_works+0xae1/0x17b0 [ 641.873529][ T74] ? __pfx_process_scheduled_works+0x10/0x10 [ 641.873556][ T74] worker_thread+0x8a0/0xda0 [ 641.873588][ T74] kthread+0x70e/0x8a0 [ 641.873612][ T74] ? __pfx_worker_thread+0x10/0x10 [ 641.873631][ T74] ? __pfx_kthread+0x10/0x10 [ 641.873654][ T74] ? _raw_spin_unlock_irq+0x23/0x50 [ 641.873670][ T74] ? lockdep_hardirqs_on+0x9c/0x150 [ 641.873687][ T74] ? __pfx_kthread+0x10/0x10 [ 641.873708][ T74] ret_from_fork+0x436/0x7d0 [ 641.873726][ T74] ? __pfx_ret_from_fork+0x10/0x10 [ 641.873745][ T74] ? __switch_to_asm+0x39/0x70 [ 641.873775][ T74] ? __switch_to_asm+0x33/0x70 [ 641.873797][ T74] ? __pfx_kthread+0x10/0x10 [ 641.873820][ T74] ret_from_fork_asm+0x1a/0x30 [ 641.873852][ T74] [ 641.873859][ T74] [ 642.102705][ T74] Allocated by task 23445: [ 642.107199][ T74] kasan_save_track+0x3e/0x80 [ 642.111873][ T74] __kasan_slab_alloc+0x6c/0x80 [ 642.116719][ T74] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 642.122290][ T74] xfrm_state_alloc+0x24/0x2f0 [ 642.127066][ T74] __find_acq_core+0x8a7/0x1c00 [ 642.131923][ T74] xfrm_find_acq+0x78/0xa0 [ 642.136356][ T74] xfrm_alloc_userspi+0x6b3/0xc90 [ 642.141370][ T74] xfrm_user_rcv_msg+0x7a0/0xab0 [ 642.146300][ T74] netlink_rcv_skb+0x208/0x470 [ 642.151073][ T74] xfrm_netlink_rcv+0x79/0x90 [ 642.155925][ T74] netlink_unicast+0x82c/0x9e0 [ 642.160702][ T74] netlink_sendmsg+0x805/0xb30 [ 642.165561][ T74] __sock_sendmsg+0x219/0x270 [ 642.170238][ T74] ____sys_sendmsg+0x505/0x830 [ 642.174996][ T74] ___sys_sendmsg+0x21f/0x2a0 [ 642.179666][ T74] __x64_sys_sendmsg+0x19b/0x260 [ 642.184602][ T74] do_syscall_64+0xfa/0x3b0 [ 642.189102][ T74] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 642.194990][ T74] [ 642.197299][ T74] Freed by task 10: [ 642.201115][ T74] kasan_save_track+0x3e/0x80 [ 642.205792][ T74] kasan_save_free_info+0x46/0x50 [ 642.210807][ T74] __kasan_slab_free+0x5b/0x80 [ 642.215570][ T74] kmem_cache_free+0x18f/0x400 [ 642.220470][ T74] xfrm_state_gc_task+0x52d/0x6b0 [ 642.225483][ T74] process_scheduled_works+0xae1/0x17b0 [ 642.231015][ T74] worker_thread+0x8a0/0xda0 [ 642.235603][ T74] kthread+0x70e/0x8a0 [ 642.239664][ T74] ret_from_fork+0x436/0x7d0 [ 642.244246][ T74] ret_from_fork_asm+0x1a/0x30 [ 642.249022][ T74] [ 642.251332][ T74] The buggy address belongs to the object at ffff8880549ad100 [ 642.251332][ T74] which belongs to the cache xfrm_state of size 928 [ 642.265283][ T74] The buggy address is located 48 bytes inside of [ 642.265283][ T74] freed 928-byte region [ffff8880549ad100, ffff8880549ad4a0) [ 642.278979][ T74] [ 642.281294][ T74] The buggy address belongs to the physical page: [ 642.292826][ T74] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880549ae200 pfn:0x549ac [ 642.302901][ T74] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 642.311414][ T74] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 642.318973][ T74] page_type: f5(slab) [ 642.322948][ T74] raw: 00fff00000000040 ffff888144ea3000 dead000000000122 0000000000000000 [ 642.331616][ T74] raw: ffff8880549ae200 00000000800f000b 00000000f5000000 0000000000000000 [ 642.340214][ T74] head: 00fff00000000040 ffff888144ea3000 dead000000000122 0000000000000000 [ 642.348979][ T74] head: ffff8880549ae200 00000000800f000b 00000000f5000000 0000000000000000 [ 642.357651][ T74] head: 00fff00000000002 ffffea0001526b01 00000000ffffffff 00000000ffffffff [ 642.366337][ T74] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 642.375008][ T74] page dumped because: kasan: bad access detected [ 642.381430][ T74] page_owner tracks the page as allocated [ 642.387138][ T74] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 20663, tgid 20662 (syz.5.6957), ts 373706937980, free_ts 372131614861 [ 642.406580][ T74] post_alloc_hook+0x240/0x2a0 [ 642.411348][ T74] get_page_from_freelist+0x21e4/0x22c0 [ 642.416885][ T74] __alloc_frozen_pages_noprof+0x181/0x370 [ 642.422677][ T74] alloc_pages_mpol+0x232/0x4a0 [ 642.427524][ T74] allocate_slab+0x8a/0x370 [ 642.432022][ T74] ___slab_alloc+0xbeb/0x1420 [ 642.436729][ T74] kmem_cache_alloc_noprof+0x283/0x3c0 [ 642.442273][ T74] xfrm_state_alloc+0x24/0x2f0 [ 642.447127][ T74] xfrm_add_sa+0x17d1/0x4070 [ 642.451915][ T74] xfrm_user_rcv_msg+0x7a0/0xab0 [ 642.456874][ T74] netlink_rcv_skb+0x208/0x470 [ 642.461657][ T74] xfrm_netlink_rcv+0x79/0x90 [ 642.466452][ T74] netlink_unicast+0x82c/0x9e0 [ 642.471227][ T74] netlink_sendmsg+0x805/0xb30 [ 642.475985][ T74] __sock_sendmsg+0x219/0x270 [ 642.480652][ T74] ____sys_sendmsg+0x505/0x830 [ 642.485477][ T74] page last free pid 20585 tgid 20584 stack trace: [ 642.492073][ T74] __free_frozen_pages+0xbc4/0xd30 [ 642.497409][ T74] stack_depot_save_flags+0x436/0x860 [ 642.502799][ T74] ref_tracker_free+0xfe/0x7d0 [ 642.507554][ T74] neigh_destroy+0x34f/0x5c0 [ 642.512136][ T74] __neigh_ifdown+0x1e8/0x8b0 [ 642.516829][ T74] neigh_ifdown+0x1f/0x30 [ 642.521162][ T74] fib_inetaddr_event+0x17c/0x190 [ 642.526183][ T74] notifier_call_chain+0x1b3/0x3e0 [ 642.531290][ T74] blocking_notifier_call_chain+0x6a/0x90 [ 642.537000][ T74] __inet_del_ifa+0x87d/0x1040 [ 642.541775][ T74] inetdev_event+0x632/0x15b0 [ 642.546472][ T74] notifier_call_chain+0x1b3/0x3e0 [ 642.551667][ T74] netif_set_mtu_ext+0x594/0x7d0 [ 642.556604][ T74] do_setlink+0x91a/0x41c0 [ 642.561034][ T74] rtnl_setlink+0x604/0x900 [ 642.565624][ T74] rtnetlink_rcv_msg+0x7cf/0xb70 [ 642.570567][ T74] [ 642.572873][ T74] Memory state around the buggy address: [ 642.578487][ T74] ffff8880549ad000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 642.586621][ T74] ffff8880549ad080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 642.594674][ T74] >ffff8880549ad100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 642.602759][ T74] ^ [ 642.608414][ T74] ffff8880549ad180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 642.616469][ T74] ffff8880549ad200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 642.624602][ T74] ================================================================== [ 642.633347][ T74] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 642.640570][ T74] CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) [ 642.649883][ T74] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 642.659967][ T74] Workqueue: netns cleanup_net [ 642.664755][ T74] Call Trace: [ 642.668050][ T74] [ 642.670994][ T74] dump_stack_lvl+0x99/0x250 [ 642.675596][ T74] ? __asan_memcpy+0x40/0x70 [ 642.680332][ T74] ? __pfx_dump_stack_lvl+0x10/0x10 [ 642.685684][ T74] ? __pfx__printk+0x10/0x10 [ 642.690296][ T74] vpanic+0x281/0x750 [ 642.694333][ T74] ? __pfx_print_hex_dump+0x10/0x10 [ 642.699523][ T74] ? __pfx_vpanic+0x10/0x10 [ 642.704194][ T74] ? irqentry_exit+0x74/0x90 [ 642.708786][ T74] ? lockdep_hardirqs_on+0x9c/0x150 [ 642.713975][ T74] panic+0xb9/0xc0 [ 642.717698][ T74] ? __pfx_panic+0x10/0x10 [ 642.722107][ T74] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 642.727990][ T74] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 642.734311][ T74] ? __xfrm_state_delete+0x696/0xca0 [ 642.739590][ T74] check_panic_on_warn+0x89/0xb0 [ 642.744522][ T74] ? __xfrm_state_delete+0x696/0xca0 [ 642.749803][ T74] end_report+0x78/0x160 [ 642.754043][ T74] kasan_report+0x129/0x150 [ 642.758571][ T74] ? __xfrm_state_delete+0x696/0xca0 [ 642.763858][ T74] __xfrm_state_delete+0x696/0xca0 [ 642.769008][ T74] xfrm_state_flush+0x45f/0x770 [ 642.773860][ T74] xfrm6_tunnel_net_exit+0x3c/0x100 [ 642.779080][ T74] ops_undo_list+0x497/0x990 [ 642.783678][ T74] ? __pfx_ops_undo_list+0x10/0x10 [ 642.788799][ T74] ? do_raw_spin_unlock+0x122/0x240 [ 642.794008][ T74] cleanup_net+0x4c5/0x800 [ 642.798424][ T74] ? __pfx_cleanup_net+0x10/0x10 [ 642.803361][ T74] ? _raw_spin_unlock_irq+0x23/0x50 [ 642.808568][ T74] ? process_scheduled_works+0x9ef/0x17b0 [ 642.814395][ T74] ? process_scheduled_works+0x9ef/0x17b0 [ 642.820133][ T74] process_scheduled_works+0xae1/0x17b0 [ 642.825791][ T74] ? __pfx_process_scheduled_works+0x10/0x10 [ 642.831802][ T74] worker_thread+0x8a0/0xda0 [ 642.836437][ T74] kthread+0x70e/0x8a0 [ 642.840528][ T74] ? __pfx_worker_thread+0x10/0x10 [ 642.845643][ T74] ? __pfx_kthread+0x10/0x10 [ 642.850242][ T74] ? _raw_spin_unlock_irq+0x23/0x50 [ 642.855521][ T74] ? lockdep_hardirqs_on+0x9c/0x150 [ 642.860800][ T74] ? __pfx_kthread+0x10/0x10 [ 642.865546][ T74] ret_from_fork+0x436/0x7d0 [ 642.870132][ T74] ? __pfx_ret_from_fork+0x10/0x10 [ 642.875240][ T74] ? __switch_to_asm+0x39/0x70 [ 642.880025][ T74] ? __switch_to_asm+0x33/0x70 [ 642.884785][ T74] ? __pfx_kthread+0x10/0x10 [ 642.889373][ T74] ret_from_fork_asm+0x1a/0x30 [ 642.894141][ T74] [ 642.897531][ T74] Kernel Offset: disabled [ 642.901953][ T74] Rebooting in 86400 seconds..