last executing test programs: 1m4.286889348s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 53.357628991s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 42.060258339s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 31.326303371s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 21.101664062s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 10.430194567s ago: executing program 4 (id=1093): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) 3.032586251s ago: executing program 0 (id=1786): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000980), 0xe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="40000000020601080000000000000000000000040900020073797a3000000000050004000000000010000300686173683a69702c6d6163070500010006000000"], 0x40}}, 0x40000) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x1c, 0x0, 0x2, 0x70bd2d, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040000}, 0x4) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) listen(r0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$isdn(0x22, 0x2, 0x1) close(r5) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54000000060a0b040000000000000000020000002800048024000180090001006d6574610000000014000280080001400000000008000240000000200900010073797a3000000f000900020073797a3200000000140000001100010000000000000000000000000a"], 0x7c}}, 0x0) 2.197145003s ago: executing program 2 (id=1797): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_TDLS_OPER(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x30, r1, 0x1, 0xfffffffe, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TDLS_OPERATION={0x5}]}, 0x30}}, 0x8000) 1.949320613s ago: executing program 0 (id=1800): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@ipv6_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfc}, [@RTA_GATEWAY={0x14, 0x5, @loopback}]}, 0x30}}, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c000000787cf3a5b16fbc4e8fb1e47790e70e070acbf9ffffffffffffd0abe0661eb3b4cf87", @ANYRES16=r2, @ANYBLOB="00042abd7000ffdbdf250000000006001c000700000005000d00000000000800180000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x24000800}, 0x4008044) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000200)={'wg0\x00', &(0x7f00000001c0)=@ethtool_sfeatures={0x3b, 0x4, [{0x4, 0x6}, {0x8, 0xfffffff7}, {0xfffffff8, 0xfffffff1}, {0x81, 0x80000000}]}}) sendmmsg$inet6(r0, &(0x7f0000004b80)=[{{&(0x7f0000000180)={0xa, 0x4e20, 0xffff, @empty, 0x3}, 0x1c, 0x0}}, {{&(0x7f0000001440)={0xa, 0x4e23, 0x4, @ipv4={'\x00', '\xff\xff', @loopback}, 0xffffff01}, 0x1c, 0x0, 0x0, &(0x7f0000001780)=[@tclass={{0xfffffd0b, 0x29, 0x43, 0x8}}], 0x18}}], 0x2, 0x800) 1.888756735s ago: executing program 1 (id=1801): r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) ioctl$sock_bt_hci(r1, 0x800448d2, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000), 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000003d0007010000000000000000047c0000040008900c00018006000600800a0000100002800c00170005000100"], 0x34}}, 0xc000) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="20000000000000000000000000000000000008000500d768d9000000"], 0x20}}, 0x0) r4 = socket$inet6(0xa, 0x6, 0xd) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000180)="27050200590214000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000102821880b00", 0x45}], 0x1}, 0x9cdc2384056b48b8) setsockopt$sock_int(r4, 0x1, 0x27, &(0x7f0000000300)=0x3, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@cgroup=r7, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffffb}, 0x11) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@const]}, {0x0, [0x61, 0x2e, 0x5f, 0x0]}}, &(0x7f0000000600)=""/4096, 0x2a, 0x1000, 0x0, 0x600, 0x0, @void, @value}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000006b004000660000000000000016000000ebbfffff9500000000000000"], &(0x7f0000000140)='GPL\x00', 0x9, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'geneve0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb1000000080086dd4803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r9}, 0x14) 1.750259984s ago: executing program 2 (id=1802): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d00)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="99742bbd7000fbdbdf25150000004c000180380004001400010002004e20ac14141d0000000000000000200002d20a004e20000000040000000000008f9b00000000000000df030000000d0001007564703a73797a320000"], 0x60}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) 1.729719921s ago: executing program 3 (id=1803): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000001c00)="b7028d7a89a1a9e34b7acba3d9bff1ab77e1013b52513a5cb7517654ea56087a12fc122db35560019cab83110b00e4b990cc5c7df69da2e4f2361ae22704000000000030", 0x44}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5000009, 0x10012, r0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x200000000000008d, &(0x7f0000000580)=@framed={{0x18, 0x2, 0x0, 0x0, 0x559}, [@call={0x85, 0x0, 0x0, 0x17}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000001c00)="b7028d7a89a1a9e34b7acba3d9bff1ab77e1013b52513a5cb7517654ea56087a12fc122db35560019cab83110b00e4b990cc5c7df69da2e4f2361ae22704000000000030", 0x44}], 0x1) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5000009, 0x10012, r0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x200000000000008d, &(0x7f0000000580)=@framed={{0x18, 0x2, 0x0, 0x0, 0x559}, [@call={0x85, 0x0, 0x0, 0x17}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffed0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) 1.612632536s ago: executing program 0 (id=1804): unshare(0x28000400) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x4e, &(0x7f0000000800)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "ecff80", 0x18, 0x11, 0x0, @private0, @mcast2, {[], {0x0, 0x4e22, 0x18, 0x0, @wg=@data={0x3}}}}}}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x54, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_BC_QUEUE_LEN={0x8}, @IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x54}}, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="120000000d000000040000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000e6f88e9082814b6d707d892264c301000000000000000000000000006135e6a4a8000000"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r6, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r5}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r6}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r5}, 0x20) recvmsg(r5, &(0x7f0000000780)={&(0x7f0000000440)=@caif=@util, 0x80, &(0x7f0000000740)=[{&(0x7f0000000640)=""/252, 0xfc}, {&(0x7f00000004c0)=""/91, 0x5b}, {&(0x7f0000000540)=""/6, 0x6}], 0x3, &(0x7f0000000880)=""/145, 0x91}, 0x2) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000008300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r9 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000380)=@o_path={&(0x7f0000000340)='./file0\x00', 0x0, 0x4010, r5}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r8}, &(0x7f0000000300), &(0x7f00000003c0)=r9}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r7}, &(0x7f0000000240), &(0x7f0000000280)=r5}, 0x20) ioctl$sock_qrtr_SIOCGIFADDR(r5, 0x8915, &(0x7f0000000040)={'veth0_to_bridge\x00'}) bind$bt_sco(r4, 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r11, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r11, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) r13 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r13, 0x1, 0x12, &(0x7f0000000080), 0x4) 1.512203569s ago: executing program 2 (id=1805): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) syz_emit_ethernet(0x66, &(0x7f00000004c0)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x1000002, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0xfffff788}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0xffff}}}, {0x8, 0x6558, 0xfffffffe}}}}}}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, 0x0, 0x0, 0x84) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000004900)=[{{0x0, 0xfffffffffffffdc8, &(0x7f0000000040)=[{&(0x7f0000000280)="af3e1e4192f32c91f8f6f15fb8fc2aacecc42e1af2e0d4b9c4a05c0300000000000000c2acbf5844c7d8f29a7f5e4b5a319544629aecd32e752d5fa113df03aa0a3cb03e13a2dc1f7b2a4344196817b3c645e82765390190cbe31b440ac6b03d7d1e7fc628faf6c25c6cc36e7a10b0a4f56485f08c956c", 0x77}], 0x1}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)="a2202bde6a2d985169eb4cc79396d5cd15c0f924625be64bb208bfe03d7b7d09892c626cd1bb4ef81d51b7987d4b5c88cdc3e3cc33c9cc53bf642cf18e5c68"}, {&(0x7f0000000100)="9a7c57a8d328ecc01a3f50a5cb939553b89913eb471f4e3b24b40f11723dd2c688753369"}, {&(0x7f0000000200)="9be5e2f84d1ace3592164fa5987bf4e6b4bfa0d99e03d838d34f87ab56038210eb626fdfbacc4132aed8dcf84c35c1ac6b4b7dd9f9065adc0626597c55ab9f8ecc4b"}, {&(0x7f0000000300)="4f61506817bcbb858640092bfe97dae07162c7e80e174f63311335052ccf75e8c630c2d65083d66b755c755067818ed68cd3f71e06d4df512ec0e3ad"}]}}], 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(r0, &(0x7f0000000080)="bc49860dfad05e7e7ca7b2edc352d3c27537745c0a59d1fdcc651e9dbca18e0cd8ca822a0b7796ea46168af5b780b70dcd4c4e98c1e262002572662dd415ae0fecb7dc2c673b59ae8789df66f975fd0aa211253f0d8117", 0x57, 0x8080, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000280)={r4, 0x2800000}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000380)={r4, 0x8, 0x54, "c9c463864f68a7344fe9b6144009b1a39ce8508497501c1d40ae9e5611f93f917084ad477b2fbb9a584a99de614e5dde62f4215a5eb95d547a9a12114e705800935c33431ffcb9664d716383ae9e76b28b9e5f9f"}, 0x5c) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="3bab00000000000000002e1100000e0001"], 0x50}}, 0x0) 1.438615148s ago: executing program 3 (id=1806): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0xe, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000007110bb000000000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001500010000000000000000000100000008000100", @ANYRES16=r1], 0x1c}}, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0], 0x2c}, 0x1, 0x0, 0x0, 0x4040095}, 0x80c0) (async) socket$igmp(0x2, 0x3, 0x2) 1.376823916s ago: executing program 1 (id=1807): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r3, 0x1, {}, 0xff}, 0x18) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0x3, 0x3}, 0x6) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x21, 0x13, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000580)=@security={'security\x00', 0x3a, 0x4, 0x348, 0xffffffff, 0x110, 0x110, 0x1e0, 0x110, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0x110, 0x4, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth1_to_bond\x00', 'vcan0\x00'}, 0x0, 0xb0, 0x110, 0x0, {}, [@common=@set={{0x40}}]}, @common=@SET={0x60}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}, {{@ip={@empty, @private, 0x0, 0x0, 'vlan0\x00', 'vlan0\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000007c0)={{r5}, 0x0, 0x0}, 0x20) write(r4, &(0x7f0000000340)="07000000010001", 0x7) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_j1939(r1, 0x0, 0x8000) connect$can_j1939(r1, &(0x7f0000000240)={0x1d, r3, 0x0, {}, 0xff}, 0x18) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r8 = openat$cgroup_devices(r7, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r9, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSFLAGS1(r9, 0x40047459, &(0x7f0000000040)=0x2002044) ioctl$PPPIOCSFLAGS1(r9, 0x40047459, &(0x7f0000000100)=0x2000004) write$cgroup_devices(r8, &(0x7f0000000000)=ANY=[@ANYBLOB='b *:', @ANYRESDEC], 0xc) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0xc, 0x4, 0x2, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000c80)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r10}, {}, {0x7, 0x0, 0xb, 0x2}, {0x85, 0x0, 0x0, 0x51}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) setsockopt$bt_BT_SNDMTU(r4, 0x112, 0xc, &(0x7f0000000140)=0x916, 0x2) sendmsg$nl_netfilter(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x14, 0x0, 0x4, 0x3}, 0x14}}, 0x0) 1.239822299s ago: executing program 3 (id=1808): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_DELTABLE={0x28, 0x2, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x50}, 0x1, 0x0, 0x0, 0xf79353b6962dc409}, 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETVIFCNT(r2, 0x89e0, &(0x7f0000000000)) (async) setsockopt$inet6_mtu(r0, 0x29, 0x4e, &(0x7f0000000400)=0x2, 0x4) 1.206809236s ago: executing program 2 (id=1809): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000555661b43764630867aca000"/31, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xfffffffe, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3e, &(0x7f00000002c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0x73, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x58) (async, rerun: 64) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) (rerun: 64) r5 = accept4(r4, 0x0, 0x0, 0x0) recvmsg$can_j1939(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)=""/132, 0x84}], 0x1}, 0x40000042) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {}, [{0x54, 0x1, [@m_ife={0x50, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x49}, @TCA_IFE_METALST={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r6, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000001a000100000000000000000002007300", @ANYRES32=0x0, @ANYBLOB="000000001400010020010000000000000000000000000002"], 0x30}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000001840)=@ringbuf={{0x18, 0x7, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1b}, {0x85, 0x0, 0x0, 0x8a}}, {}, [], {{}, {0x6, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x94) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r8 = socket$unix(0x1, 0x5, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) sendto$inet(r3, &(0x7f0000000600)="f39ddd68b30edad4b567e559555b3954d01b487e20a1b2e4e8db471240704a85a68b1876619ff379f5ca3870dd3ef6c01ae9856848c5b386ce881325700023ea003584ce83b18d0e54e92c6420c1cb035a2f177b8ba4c3fc94123425e52d99d9bc47d200c8ef6ee04dbb59edde9ed0c572501c4f92562d23df95a1fa4b79d6e905485bdc7eaaeaee9d056a00f28dc58f561c6ceb10972f2a60b9d52a2f7f4e7583ec608445a058ad5fdcabf86e4ccd7f2f45656aa6d70e87bb4d0e1ccf51ff8232cd7d72", 0xc4, 0x80, &(0x7f0000000540)={0x2, 0x4e23, @local}, 0x10) (async, rerun: 32) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0bfc0000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x40820}, 0x0) (async) writev(r10, &(0x7f0000000040), 0x2) close(0x3) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) (async) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000009c0)=ANY=[@ANYRES64=r7, @ANYRES16=r7, @ANYRES16=r7, @ANYBLOB="6d9da314f74717670edf4f3c5c773a3bf8cfb3254839558362b321b98c3fff854f40af6fb673b4a5d988e5360659fcf8b9540c0cbcc3116bc394bce371c1922a6c82bbff87812274d179f1068106ec66720998ca6254a143de41c3159b926248cd346245e1e57d364f28337704887efe4b7b878ead5da8ba29fd84dc4569cc3bf41599a6db8a188920122832ed8ee851bf58dba55e894cef7bc6947a1c4a7574316b5fa855915aa646422c450fe656194c03f8882e5c429deb47ed71e9604f9e56b6f0cb3433dcc1aeb86c4181b0fbd15a7e4e008c3d33bfe516200c92a1b107ac494f39870e56bc17e36a262688e7e016ba95e0b4", @ANYRESDEC=r3], 0x24}}, 0x4000000) 1.000626333s ago: executing program 1 (id=1810): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e204e227f000001925aa80020007b0009008003000000000000000000ff0000f03ac71002000000fffffffffeffffffffe7ee00000000000000000200000000", 0x58}], 0x1) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) openat$cgroup_ro(r1, &(0x7f0000000580)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000180002000000000000000d"], 0x0, 0x32, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) unshare(0x2000400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000000b5c0)={0x8, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="660a000000000000611177000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, @void, @value, @void, @value}, 0x50) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r6, &(0x7f0000006380)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000c80)=""/4096, 0x1000}], 0x1}, 0xe}], 0x1, 0x40000042, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000180000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3d, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000280)={r7}, 0xc) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={&(0x7f0000000440)="c04bde046a4f15d5ddfc19663282684e1c6c8760ea3f6ac09ccc4043e7e8be35cac172fbedfcf44e94eeac006283770064bd8914bbf98b67d21385c60633729f129bf0ca", &(0x7f0000000640)=""/164, &(0x7f0000000700)="f02c152f5b53d47d0bf21d8e1bbe11c0923b3e406ea4eef8ce8961bef3d2b8ac5050851c7a01000cc8116754563c749f53cc0a49b31813fd75be00e6963becc3818f19fd8e0f12b2ace85854b133f2dc1c162db77001f2db7be4b21de977cd318143599f83e106f2c9bce01f84f3aa42d9831a0a02ee60ab1fe7b05017d0f012d2ffe3ce687897222e0e12d10d9bba125f56598e554cd0804fa328806bb2e8deccf9e511336a972bcc", &(0x7f00000007c0)="878f9ddc0babb0d554942a40cda7a38c697d14e2af73abb72715577ff9a738613d034a505bec7b16c3e689c88efa28657139ed2c054bd6af1c900d83d42b5c20ca4e5edf5dbe56c992f2c759a849b2b68174f8c3fe2ca9f47405cf036237e959b2a2b152963d1998244990e4e7696ca6ac7d23737749f9ec18a794a95c96feabef7734031178af881e594c97b2a5bb99d1a01aea9b4113d20218474c344c753ea764df85d25f46e37ea92dc3817edf8bde757f207203a8596fd66bfd02c2db255c0a3cc4237e5c75d44322c71e5320251490797ed19830b6c3f40d23c3fe84e85268b7824ac4acc70880d00df93366b56fdec5b8c659a83f9052e8e69387238e685971a21b537f6acc11a2cd1e0f7c6b57555d3455d2fbacc660aa221ff5fdfdb897208f87b96ad164ced9394e609caa6479b91567954aa3dc96d43fd4e2a7bf04482a9f645db09ed68e4b409405ce7ad142b83ebd4bc7873b5e502ef0af9c61fa4e685728a6a539383450ad07cc87ff2e8f9fcab9c9c081e740b61845d1a8d667484a63b65f32b821e36807a44992f3fa8466e00473fb27898317d5ab6d9f4600a4b49fb1a175867215b43816f69c1923900dd0b1e88ea137532638b69f0dfb4af035125cb04417fe5dcf3a866381cef814b78c14a99bd677d550ead886a87761892fcc4bdce1e3ced6f283e2c4e51a243e2b381163c13bd61b337df5518818e962bbe1cff3111841822d63cb46a50d06358af3e575f3024bd2036b89fe2f005e029837b870dcfe9b270bc909d04515cea8a9f28e6b88d249fbf108486032a9461f8c186bc1249fefac1723e2fc621372ec26f699496fe4096db918d93ad7560a6e1fc3e96e211b1b659f1ed6943b05df0e3017cad35ecc4e90b349543f2ec50379e0fbb734df8367710945126d361a10547550ae8d0f4f482f673c32016a5d425864c39f5a3d8d1950dcbf1f5e2321bbf867b2cb5a96e98b41181670004f4fbcd5e3a30ecb80b2ebc8370ea22246ba796d64ad5c559c5dbe93072bd0850f70462c18c805c431b930c36c0290941f79187c73cb0d5eaee4fc162226cf57028c7f03c4fe98584740e404deb5fbd5dd678d69832de5774d80efad803025a76b011742faae7141eac7466d9921bfaa244390d7806acfe8269ff2a84bcec88db9977d852bf4b73b3291531a09ea3caf16a2880bd752721301b4f1d793aaab068aca6ce38e424918b43bf5ac3ad82755a52fac68a37495e41ae87bc587bf13d392f49cff9db7d135a5c29b27ca02aaf1ea923ebc8e489101d7bc193cb1dd27ba2d3a633af4daad5f2ce5dd9470fb42017c3ca0fa96210f66e278ec6a7fcd6ebbbf1d6f235090587193cf1ddcee1fe3f7007edf5ca09c6dce4c68f3a2e17ddf4bf9ad03c3d11b0c8e0dbe40279aab75637809f5ac0d1c3c00ebba3c4899186f2fda1f1ecc1b256d83e420f9b04e391d6b70251d8cd475e626fa7f930b3c955408d02758c27bdfdd298e4cdebee70794a7766316cfce0e570c18629c975872a8672186ccc0a4cb46b0ccf575e42b2d92ada8ddd6a9be3d57797709ac8797fe3cc5c7000443eda646832c43371f3a5ff150139000f7d674b73c1bff0ef917c3d656550431449f5be471e2b50f878f908f59e9609d46f12c235a08efbe8c301362dd9b30b2cad4fa09b5a0c768316093d989ce9f2789318e231c43355297ad49351a5886aabfbd808f3081fedd8b895561aac09e2c9f3b1b63b73ee160d026435f11bd03f7c05757d14c51b4d9fce7f3ea16650a0278147fa81cde56eea863cdade0c1ba625970ad77798e050b1907b87693509518867fe67f036c6f6111c7be3a6dbb2dfb0130e24067d9e547cb1adeb89bc34995bc6fd8357a864ddfe5eab88da417bc902e97d4d389c54926099ae906c7e13902408bb22af494c80b980bfa84943a27e19aa756959fb95c0d8a3c93d4192c54698871d21e94041bf0b85060065c522bd3fba647b6a204626da71bd66efa9ae6dcb2af6e440b10d55d5a55571e48f167e5c83aa96755eb5b0ac7766cc2797f233c891d460e0b69929efcdc0b9a64543a83b6cc7ba7d85839e18d6fd59edb4904ef4e345264a918fdc3644a9d29f39f5c9dc9560d500979d9092ad3d0344aa4fbbf8608e858a8086bf18ada0eae1751c845f652c1dfd501bbea5ea3a6ce291c61b5f97a801459f17a6f8ae6767336b1bfb96816d85813d3894b5031aab63aeb9a899b9e9db08dcfcd882848fa29b148c60d66d77c674339c7747991601c06ae0d699e4ad3d4be430291bf220a18e1e7ff061d66f9350e158d795ad12866f5ba57b4b5108d7d8f1e4c684a20919ca5408417e5674efbade0e2dad8c0e4077cc068faa109fd54cf05a1f9c61ac33d8f8067a7807ef51f100086b98887e805c726c710a3059222df5f97e3a2c6b3318a798367293063ca3a4ea1b2d95bcd5badf55532592a84b7c2d76633f951462cf4df7b498fa918c4475e288453f5daf613543ca38ff57a6759f938663a3e36aecf7b56c69481129df96f719c511eb3987cb77852768476de230b545298a7d9c027b0c72172790ab09557cf06f9df482134d5dd5ef4837a8f96f5335a719491bb733de35ae0f26fea0242a9ca701c32108fbc4b3f21e680984599276fd8473e40dec11066da4bc14d63c44f1c9977989d6977ff868504e5fca17d779f40180b962122b559e49751f5577566178229d82c5fefd64187bd9dc982fabfc7c4914d881f3950969176dd861a182bab94af218b1ec982a83332a8eab3d80c1ec5830c7d3fee0762b7fa9a31db3b6d221f359acc5edfe30cd8fb4ff7ce563e59023a6129add8c850d8a1e126bc25440d4ed0bf40c6dbbb2df8fded24d41cbc83daab1422e77a3904dd385dcf52b503ffdda600af2df3b7e0e3db8f1d078b0e6d785cb817ecb63a2e1ef12c4e375cede1c26d46b50a2ba01555c5ddb3c9931b345096093cc09073a6b501d483096ffe5e2d42c9db606ffd6a63c94a17f26d3334a47fca4a6158014292e3c5569a018486137e16685d3f760ae15a5f1b3fde34d9030febcf4e2830689c5e5cf9d02bc9c8d0eacf4582bcab50f78248dec424fd8e607c538a7525fc3c190325e0024a6f395825ae54362ca2eee1654a9cca1caaeacd9ec702721ed0a00e2c67b700415166f0eee9013797a2bc724577294f28a3b742b1d23f0de3f6c97327f7fdd8b030171ae641dee916d36a59d6f5b02b5e1f0a28110e4fc12e823cacee1cfd245bd5450ac2b0db48af8bdd096f5b3c2fea98a5c590d88a29b15ae11047a5ca6ba83de7c945b8660c41e99459a2a9ee269d8fe63308993b9485742fbe6d892412f1176e2a2b8d1c90fc34039c2f682d7d41d6389c63f09957b63591eb75674387640a845358174602daaa77c708c2e861ee541c2ded3f3d192460e983eb0bf5720ee42db84b311fa52b8725ec16edf2ee04863b5c61a6428366168c43666c4a216eee6dab928ce246c0651e229a9c6a792aba478097668c1647937d3aa3b2ae6019384361663b317a72a456a4f429093477e0927ffc840b23edf08754c33ace9eb53f25e01bde312ee3247d8610f07af89778f5a8686f61173aac65e0375c0fc95709b3b9499c2c1844d6b56e55d9d0d6317a9ac8173ff0ca501142d8a4a136789c0cb8db605c36690cbd32dc603f7321aa023f222b6f653ed592c2353ac966146aabdeb6f249601650b36c2dac915d41cf74f2193f4e7596ca01113bfaffbbe28041b3df9d131e8c0f96196c7b936ecf95d283e10c6f04fd3c08c969f357f9454ed0168a74a24968b93ab5ae619fd4888d4235c4c288f1b018d23d26c09af762ed62b47e263d06b181d079568d7e5fb754a393ec75ddee3a4802f701e8f0366bfeb0cdc69600c3cc8c5175d799bef18d94f23b534c358a59abda41b401edf935fe3fb07c4e4206c7cf3ee8099ca2fff39c44a0a134a553572b1f3e81acf0f3c467d1d11a57bca58eba288eca2bd3272c7441d651814b0f4be8e4e5e1d60cd91128986a89b21877886d0c84874fcef15e1b534f69ada0691960d53159d45d172451c21c266309597b123fec982beaf5c43375d3f0c4410a8f988d5f5b49aab6b916147fb4ca1b962421a80a8197372ea57b260744b7283ccfe6f0a7601246ff170c7d9bc899727c46e7d1616c12e27d96d534031e24af36cfdce9f9233786b2c6a0fc6d6051de19ede41b6f6d8fee17393926ff176ebf94bde712bcefbdd105c3c2d9f6eb04bce0c8e5c0c9ffc4d05125bf1bdeba05d31ae82d75d460e28f310071c1ab87846cdab6e1d0c657a2f4dcfdbb399c122391c56dde5b814e75e6c46ee109f0332e16ec14bc4942d81d176a1e7fae516880e3d2ed223763317dd9334165b8a33c8cb2c681ef3e89d90ae04151f1ba17660dbe3b6579f46148c21e6da69e41346a47dfcf4d3ede5c414a4e55af9c476b8495c5209328771f23f53bb44ccde62e1c8cf15a4e664efbb4341a81e733b1dd96f4bbe5e7366480af22cdafcbb2330167a0ee91498c19cd08a08567aa1a4c9fc638ffb151d8a9069b3578f6e841b3ebf66784c587824916a5b595c7823a9316acaec675e4eef657696c4ad1987aec059c2b8c4ba353007f38822ca19b9645ba025b08ba1dd1af29bd57bd16a0f6d6a5535d4f3cd322e2233600b618be43a7856d10761cf3881ef787f29957c9606fb7c2502942463d58b10fccd59e191175f665101d513417b34b2ac9538369ce4d75e86944af5f3e970ffdef6f66c733a10bf072160c715b30f38ac704153f90a23766a914850aa361fefdeac11109eb3fe368109b37fb6c7d5f09323d13bd806d61c2413b54dbbcb6424af61c67288ea337b0689b3d43334b2fd2c10d2ca9809e3a90ae6c4353f4baecd07d132ccb1e019caf080a08f21fbe73a165b7a9b96c377203cf917bc390c44131862b3c295d15a3b03872135e14e2a45f506c4ede96ba48e1c745eb968df977eea19bef4cbe8130bdc4685c3294fb61917e8243ad18310e5475d74ea1ee321b3c9fd553ebd5faf4c902931e19bc1b065abcb37db9bbb008d74c2964000ef88c87760ad290ef5f872681e4e72959fa476fe1d29960f20860fa22f1e637f4e1b30ffb1b784284ad087abc832cdcd513f8f18c2070d889df29905c4cccee422288957fa302d1792db55af76e81636624af74e3af2ff312db72127ffcb0f445af557d209d5b936cd2d6e2a5142876121fe8bf24295dcde032dfc3632e1c2d82bc253ab3025e1d649705484eead1bc485502aeeeeabacb0c536ce48ed75746d07cffbdf0bb674500d7bc08c9f025a33ab0e7376d3a780a0f8c3130a292c079ac1097d97ad154829074513d9cad2d21fb0ea99abb5066a17fc0e9d1ac56b2e94b61030117e62c5df9b8f846532629274af4ce51b595bd959fc1f05c4ec81ba162d3c1bbef8335b84cd15db79dc10e53f66561f8d147a24d7df5fbb3b3cd883a2ad932ca9b826d2fa6ad0abb02dc0eb7e61e9e0bcd11bb6f19290165caf8574fbff849f9a8a5dfb3800f4d3907783f550c3aa97b2fd66c624131f0058439b5bfbb18337c4982c840680941822fd131c7a890d91fd0a3062ae0e1ba3f265573670e211cd72f8bf1916fec2251da6fa0785d7547ec3fc941efc09bfdae5cd4f5741d4652ed6ffff4a60aefbc7d7fc6d2c4c3308532fb0478e8b36299fd431dcce15a7cfade53d46306ad463d9accdfd6f3c5dce358e6a67bd420cb0500a9df0021dce7de26aee81c85a31c6ff1dcb448d1a7bf", 0x7, r2}, 0x38) sendmsg$key(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x2, 0x0, 0x7, 0x5, 0x10, 0x0, 0x70bd26, 0x25dfdbfe, [@sadb_spirange={0x2, 0x10, 0x4d6, 0x4d4}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e22}, @sadb_x_policy={0x8, 0x12, 0x2, 0x4, 0x0, 0x0, 0x7, {0x6, 0xff, 0x7, 0x8, 0x0, 0x5, 0x0, @in=@multicast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e23}, @sadb_ident={0x2, 0xb, 0x5, 0x0, 0x7fffffffffffffff}]}, 0x80}}, 0x8000) 999.921507ms ago: executing program 3 (id=1811): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)="30a0", 0x2}], 0x1}, 0x4040001) bind$unix(r1, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) recvmsg$unix(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/116, 0x74}], 0x1}, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000001dc0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="c9", 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)="30a0", 0x2}], 0x1}, 0x4040001) (async) bind$unix(r1, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) (async) recvmsg$unix(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/116, 0x74}], 0x1}, 0x2) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r2, &(0x7f0000001dc0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="c9", 0x1) (async) 831.455883ms ago: executing program 2 (id=1812): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "60cf8eac2b3820ec", "efdf5c4abfddf4aa82c309a12dc0d927b82d1a02820004e645368bd8a8341564", "212054b8", "22bf54e356d320d8"}, 0x38) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x3, &(0x7f0000000240)=@framed={{0x25, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x51}}, &(0x7f0000000040)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket$packet(0x11, 0x2, 0x300) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)={0x38, r5, 0x8d61ddcfedb48df, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x11, 0x8100, r3, 0x1, 0x1, 0x6, @multicast}, 0x14) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000900)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x24, r5, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x7f}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000b1}, 0x4048004) (async) r6 = getuid() (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000001c0)={'gretap0\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x1, 0x20, 0x80000001, 0x9, {{0x2b, 0x4, 0x3, 0x2a, 0xac, 0x65, 0x0, 0x8, 0x0, 0x0, @local, @multicast1, {[@lsrr={0x83, 0x17, 0xb2, [@local, @rand_addr=0x64010102, @local, @private=0xa010102, @local]}, @ssrr={0x89, 0x1b, 0x81, [@multicast1, @broadcast, @multicast2, @private=0xa010100, @broadcast, @broadcast]}, @timestamp_addr={0x44, 0x34, 0xf9, 0x1, 0x3, [{@broadcast, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@empty, 0x4}, {@rand_addr=0x64010100, 0x4}, {@local, 0xffffc96c}]}, @noop, @rr={0x7, 0x1b, 0x67, [@dev={0xac, 0x14, 0x14, 0x25}, @multicast2, @broadcast, @private=0xa010101, @private=0xa010101, @rand_addr=0x64010102]}, @ra={0x94, 0x4}, @generic={0x83, 0x11, "cabdd220bd0e14f576a75cedda313b"}]}}}}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=@newsa={0x4a4, 0x10, 0x8, 0x70bd2c, 0x25dfdbff, {{@in=@loopback, @in6=@empty, 0x4e20, 0x3, 0x4e23, 0x0, 0xa, 0x100, 0x20, 0x6c, r3, r6}, {@in=@rand_addr=0x64010102, 0x4d4, 0x2b}, @in6=@mcast2, {0x9, 0x800, 0x200, 0x0, 0x0, 0xffffffffffff32b7, 0x3, 0x8}, {0x8000000000000001, 0x9, 0xffffffff, 0x9}, {0x5, 0x8, 0x3}, 0x70bd26, 0x3505, 0x2, 0x0, 0x0, 0x2}, [@proto={0x5, 0x19, 0x2b}, @algo_crypt={0x133, 0x2, {{'ctr-cast5-avx\x00'}, 0x758, "7a75c89f4ae4ef2588a016beecbf7c55dd8fcd3aba2638bc3eb57c2efd056e603a833382a9591236d3806ef747c6af1b456650a9366670693a5e1576d50c8fa40db2c9252d7d463784f4d43b0ca7a5d8f70f3070fe3f8f4d5243615a160a80d3f429e9419ab5f160aade6a02d58f4875a4862435927398614333a323918266e72c08b820749f9bab4c8bc20a80a98a6f977a0501130db26e0b0cc468b8cc19460e220d1c4f9abd40bc8b4edd4af5adf39153390c0757571f6f006b4818f8d0ecfb3632e86a72f2625420619045e18949b0da08f6056f76bdfb51874a7767112d819f512ca9302273395e73"}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x9}, @offload={0xc, 0x1c, {r7, 0x2}}, @sec_ctx={0xb7, 0x8, {0xb3, 0x8, 0x1, 0x0, 0xab, "a0db78825bb4beb465eda09077365d9ea26c874fc5da1fc51e1545378c5cce9a6de997bb719ef6a040d9f6da25afe9afd0b255ef80d9a6affe2ebd1f872fcab49a7a5d7f15526164510a096502d37e97e2e64174952a94832e52f88e0af1c3d2891da65f63f6c26cb6abbca87bb291557812741ea4bb960f2dec4f60960feac1f73518b739a7d635c2bcbdd610c69a9eed6b79b3a30e425791a88102db01668cc355cdc7a09f6aad52df5d"}}, @algo_auth_trunc={0x139, 0x14, {{'wp384-generic\x00'}, 0x768, 0x40, "13916649f2e82fef998e5d878f2db2c7849b6b10d8d48acadbc54be1a9852e5cb73d4a851a70f676353206da1c6d649222dc422129572ced469358240c1aa6fcec92c3b2bbc59ee4ea51fe1bf3fd8c8e172a8e2df35a9df11d302c3f2ca52c8bd632eec3616852a9a826735592cbac7cc8e45a1d069c74d42925bd1f1a09eee741fb8b6f7f6b0fade3765cffd8ab8c2840ed7eb02fde4773b35a96765b77e13cf85093b2ac1b60e331997603a0db4d9bceff110386513643fe539a7f5e755a7c3f3d6fe84df7cc4008cde3c74769d52d3123b68e87bfaef5cdd5513b8f44e0e2ba2bc2f9c18be6466efeacde57"}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x3}, @mark={0xc, 0x15, {0x35075c, 0x5}}, @policy_type={0xa}, @migrate={0x50, 0x11, [{@in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in6=@private1, @in6=@private0, @in6=@private2, 0xff, 0x1, 0x0, 0x3501, 0x2, 0xa}]}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000010) 819.241114ms ago: executing program 1 (id=1813): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000280)={0x3, &(0x7f0000000100)=[{0x28, 0x0, 0xf9, 0xfffff030}, {0x4d, 0x0, 0x0, 0x3}, {0x6}]}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'team_slave_1\x00', 0x6bf1c2d5adba8c32}) close(r5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r6, &(0x7f00000000c0)=ANY=[], 0x138) r7 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x1, 0x0) (async) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) setsockopt(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000002c0)="1a00000002000000", 0x8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005200)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x5c}}, 0x0) (async) sendmsg$NFT_BATCH(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005200)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x5c}}, 0x0) sendmsg$NL80211_CMD_FLUSH_PMKSA(r5, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x7, 0x6b}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x24008005) ioctl$SIOCSIFHWADDR(r5, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffdd, 0xa}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000080)={0x4c, r0, 0x801, 0x0, 0x1, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}]}]}, 0x4c}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000240)={'gre0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x7f00, 0x8, 0x8, 0x5, {{0x17, 0x4, 0x3, 0x8, 0x5c, 0x67, 0x0, 0x9, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0xc, 0x17, 0x1, 0x1, [{@multicast2, 0x9}]}, @generic={0x94, 0x7, "e75be76688"}, @noop, @timestamp_prespec={0x44, 0x34, 0x37, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x2d}, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x2e}}, {@dev={0xac, 0x14, 0x14, 0x33}, 0x65a}, {@dev={0xac, 0x14, 0x14, 0xe}, 0x6}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000240)={'gre0\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x7f00, 0x8, 0x8, 0x5, {{0x17, 0x4, 0x3, 0x8, 0x5c, 0x67, 0x0, 0x9, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0xc, 0x17, 0x1, 0x1, [{@multicast2, 0x9}]}, @generic={0x94, 0x7, "e75be76688"}, @noop, @timestamp_prespec={0x44, 0x34, 0x37, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x2d}, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x2e}}, {@dev={0xac, 0x14, 0x14, 0x33}, 0x65a}, {@dev={0xac, 0x14, 0x14, 0xe}, 0x6}]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x8000, 0x8, 0x2, 0x22010, r5, 0x9, '\x00', r10, r5, 0x4, 0x2, 0x1, 0x6, @void, @value, @void, @value}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x8000, 0x8, 0x2, 0x22010, r5, 0x9, '\x00', r10, r5, 0x4, 0x2, 0x1, 0x6, @void, @value, @void, @value}, 0x50) syz_emit_ethernet(0x1c6, &(0x7f0000000000)=ANY=[@ANYRES16=r2], 0x0) 632.886943ms ago: executing program 3 (id=1814): tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x530, 0x348, 0x18c, 0x203, 0x348, 0x19030000, 0x460, 0x2e0, 0x2e0, 0x460, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x300, 0x348, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}]}}, @common=@hl={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x590) r1 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0x22, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f00000006c0)={{0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, {0xa, 0x4e22, 0x2, @local, 0x3}, 0xffffffffffffffff, {[0x9, 0x6, 0x5, 0x9b7, 0x2ea, 0x7, 0x4, 0x2]}}, 0x5c) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000600)={0x5, {{0xa, 0x4e21, 0x1000, @rand_addr=' \x01\x00', 0xe26f}}}, 0x88) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r5, &(0x7f0000000000)={0x27}, 0x74) sendmmsg$unix(r5, &(0x7f0000006380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r4, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000005c0)={'wpan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x61}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) 628.733575ms ago: executing program 0 (id=1815): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d00)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="99742bbd7000fbdbdf25150000004c000180380004001400010002004e20ac14141d0000000000000000200002d20a004e20000000040000000000008f9b00000000000000df030000000d0001007564703a73797a3200"], 0x60}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) 513.161584ms ago: executing program 0 (id=1816): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'syztnl2\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x2f, 0x8, 0x55, 0xffffffff, 0x60, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8, 0x1, 0x8}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000100)={'tunl0\x00', &(0x7f00000000c0)={'syztnl2\x00', r2, 0x80, 0x40, 0x6, 0x2, {{0x7, 0x4, 0x2, 0x36, 0x1c, 0x64, 0x0, 0x3, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3f}, @local, {[@rr={0x7, 0x7, 0xe9, [@private=0xa010102]}]}}}}}) syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3a}, @void, {@x25={0x805, {0x3, 0x7, 0xb, "4e34e8db9c72c6f93f50b5fc7360844873445c97c1f0c6440c66a7ca5409583e718cc78de038b33db4e26df59e8ffab703d94fd93e2200bc3d558d0890f522d94f0bb02768e37b5f9ab90fbc8486bb03a6e4a7a6f4"}}}}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x2d, 'cpuacct'}, {0x2d, 'cpu'}, {0x2d, 'blkio'}, {0x2b, 'cpuset'}, {0x2d, 'net_prio'}, {0x2d, 'blkio'}, {0x2d, 'memory'}, {0x2d, 'pids'}]}, 0x3c) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000200)={r0, 0xffffffffb307e6b7, 0x5, 0x1}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e24, 0x2, @mcast2, 0x7fff}}, 0x84, 0x5}, &(0x7f0000000300)=0x90) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000340)={r4, 0x8f, "a8165242ace883e5cb8a4bcff967eed4693c82b3f7d696f47b9f4f4b5aadec1e021234cf9ef35cd4f128bbd7faf5619a848ea54df3b5e02a6471b47ce5fb89b04a2a959381e7c769d57b92523fc46e61609640d4e35304ea52230666648aba4747e8c294e67ab72e87e00ac8646b6918a81db4fef6f74eb081bd9840fed3793188e72a1711581d732ca36a3df29098"}, &(0x7f0000000400)=0x97) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000440), &(0x7f0000000480)=0x4) sendmsg$IPSET_CMD_TEST(r3, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0xb4, 0xb, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_ETHER={0xa, 0x11, @link_local}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_IP2_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}]}, @IPSET_ATTR_ADT={0x6c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e21}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private1}}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}}, {0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_IFACE={0x14, 0x17, 'gre0\x00'}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x2004c820}, 0x40000) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r5, &(0x7f0000000640)={0x1f, 0x7, @any, 0xe6, 0x2}, 0xe) bind$bt_hci(r3, &(0x7f0000000680)={0x1f, 0x4, 0x2}, 0x6) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f00000006c0)={'pim6reg\x00', {0x2, 0x0, @multicast1}}) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, &(0x7f0000000700)=0x1, &(0x7f0000000740)=0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r3) sendmsg$NL80211_CMD_DEL_PMK(r3, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, r6, 0x200, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000009c0)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r7, &(0x7f0000000d80)={&(0x7f00000008c0), 0xc, &(0x7f0000000d40)={&(0x7f0000000a40)={0x2d8, r8, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_SEC_KEY={0x13c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "e8370dac0cdc3fa5a434a95a3b55ba7562b02dc43265e8d36d0a92466f0fe507"}, @NL802154_KEY_ATTR_ID={0x78, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x28, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x18, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0xfffffffffffffffd}]}, @NL802154_KEY_ATTR_ID={0x58, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffff359}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1ff}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffffffd}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x800}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_KEY_ATTR_ID={0x44, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1ff}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}, @NL802154_ATTR_SEC_KEY={0x34, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x1}, @NL802154_KEY_ATTR_ID={0x14, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "96edd1845bace6a79a3ecddf5391feeb"}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_KEY={0x11c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "a31ba974b6efdb68a3146a7a95ce03ebc13d4c6a82a82b9bff8572fb2d405390"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "269120d34835277c6f0ed6c7b1bed0dc"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "a8cb35ead5fbfce2b351ec125d19b711"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "dcd111672c57511d6a0abad6bed964bb"}, @NL802154_KEY_ATTR_ID={0x10, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x74d}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "08e3107be7b19c3fd055860f3b364126"}, @NL802154_KEY_ATTR_ID={0x94, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x50, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffffffd}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x2d8}}, 0x40) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000dc0)={0x3, 'veth0_vlan\x00', {0x4}, 0x8}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r7, &(0x7f0000000fc0)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000e40)={0x13c, r8, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x9ade}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x9}, @NL802154_ATTR_SEC_OUT_KEY_ID={0x34, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x20, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_OUT_KEY_ID={0xc, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_OUT_KEY_ID={0x30, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffffff9}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}]}, @NL802154_ATTR_SEC_OUT_KEY_ID={0x90, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x3c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x2c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xfffffffd}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x8}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x2004080d}, 0x40008c1) sendmsg$NL802154_CMD_SET_PAN_ID(r7, &(0x7f0000001100)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x44, r8, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0xffff}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}]}, 0x44}}, 0x40040) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000001140)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001180)) 448.920699ms ago: executing program 2 (id=1817): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0x66, &(0x7f0000000080)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "d20040", 0x30, 0x3a, 0x0, @dev, @local, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "31c909", 0x0, 0x2b, 0x0, @empty, @remote}}}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r3) sendto$packet(r3, &(0x7f0000000440)="bb86fbe2f12dc09766d48151e6c485640159430d2e861ff7bc89e750cab1e0b428ec9ee06e74b2d9c9f1cb89b7c5ba51a198b25c2f4a5de08f214376c29c2355ae793ba70d9d0c0cb0413d904392f6bab7ac27049f257cdda677674f9eb67d74a7fd2cbe4c61630404870124697d5811bb00986f8ec2c145457554003598821cda45f37647b1a68795bf4757517c0f232a5bf4c9713a9d312c19b012c3d3e657c51533b08cd55b371666fb0f674cfaa80a658d3d4541e453bdd2c8a658fcfe6ee2ec902762ba405fe33497cd70c5d3482925451c7ce4d63803253b887c89ae446b7410c8658409e8e82dd1a8c5bff7087e1e168cf39849940329912c8eed9bd656a132dfe1d7df76af8bffe3984badbead1a9ff0d525d56804e40d7dce309757fee0ab28ad11827e871d7736e50212bec20bb9825f069d141566ef1e9a59797dceccb65bbe5d25f5aee8f582832ccf904837d39075e189f1ae8a5af6ee6db90ce09bf0e467788b0ae00ed992b4c2d70e0bfccb494527a0439edce0718b2073ebbadf00a28f7bf32893ff5bd3884b8ced01c241b8d497b0573e1b31f90d07b108a1528f0bdd671885a63cee011636a42cc21d9eacebca65afc03f8de951d298cd60d211b3e10e5d3d6f3e000eaad69f8174f08d50dfcb64b0c7cada4bd46943e7966d34444c34678a885dac7f55866cd48b2aae075f0489127ba1d838be85499a6e95c0fec993ea608d4a4f3c3b97fb2b49f7dbbb16098a678664b7ef27e2f3c841913ee8bfdf0ed8e2dca217c7ab1a93ced8935dfd6a9585569b151c0c7450180d424fb4b8a3d6370729d457c3ea42e7ae06ecd9429e2b3b8385a47058f6198a174419c4be3579f0c530dc40ba73d2ba6524a91f6b866f4894c85ea344957600faa9dc39bef800693469659737457114846c3b30ecec5c8349d7751e6faca13b673c694e55e0a460997cab748b04c268b4c8572f305944bffd0e8c8cb893ab4b2aefdceb0d4fcf6a37c264f766a9e454cdf842a075a253a2b3c43e36a72df279c66867d42cc7e38d6d428a36a67fe96693a3396f70523bde31eabeda3bddba3ba07876b04085b92d53fffcd30540aee7a73356f1a8383905de17da1f3d7556696d9b1e3127b4fa2b1ded86aebacd951811fe1e641fa076f08508dfa1f8e106537db22843dadc047dce3624cf424c0138da61995663445fc19988e1e6ceb12215dac783683cbb05b5c6a4b634efea939d7ed4d2adaa7151cbd19a114d5630ee05f6650bff44a65653380bb42c3c405c0c16cf248800f0b0c240e03bc7fa8d12e10a6b3f59f94a3e3ce9723acdde30dfd152ebf4729ae14411a203a5adbea7bc6425cdd6a0404f90a2b648f6392213ad926d461733ef17d9959e33cd9ad11b68cae7a20f97c782331bf33c08203b6cb2dd9214a1072f3478ec2ebfd195140d986f0dcf923b85a6f668a14f886bc605426afbe0065f02131e868e2611afb4139dec56e534659b7ed7bb7acfa42bfe09da06303876690690f7e1c28a21cafbef3420a16eab9db9a50d4a7bb0b6e700fd6b19ce1f8b610260269eec64f72298d63662c624b0d591fa408a0b91639cfcd73b899c3f7e72901faecef658e29ff4cef96c805a77e974568be599aa2e6e4ac1c6735c927a280bb8f66e607b5a68e4e01794133fa47c4ceb33977147cd150a98b84e658f10afb2ef63c8532d8cff8b14a9cf9683c7342d0db3ff77c7adc519451604f8ee2c79e5d5c5909d5f242ff71a1417c7d7acaf6a3489ee1a0a6ffd87bd78eb14be172d0673236f822fa556761c1013770fc0159234f6e1a1f61601c66d52576c1b5c1ef319514293902c747815d5ada1bd44fdc6acf772548668b1255767409f1a246b0cc9715182e237792d845dd3763e59a330ea1d64244cc1c84ae455c7c4dade1beff5833f34398af2c4bb390c9144cfcbe7bc8e7a9de837fc6346bdde951d16590ecb001ea1e6b0a1125240a925ba71a5268a4accbb7c079d6c8ae70a6b9ebe968aea4611ee794b27505114442684d555050f36c5a5844a9db5e518f1f5ac9507c1abaccd1f522d9bc72cae9315e8f84c6ab8a52a6d0a627bea1eb227a4683072a57ed88499881403f6074a4d6a04ed70203b28fe9b518b607054272ae7ec5faca01af7cacf56d2698b9a9f83575318", 0x603, 0x8800, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x4, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010104, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xb, 0x0, 0x0, 0x0, 0x0, {[@mss={0x2, 0x4, 0x499}, @md5sig={0x1d, 0x12, "910000000000006f00"}]}}}}}}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000006d0001000000000000000000003c0000", @ANYRES32=r0, @ANYBLOB="000000000000000018003480140035"], 0x38}}, 0x0) 408.740061ms ago: executing program 1 (id=1818): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec56147d66527da307bf731fef97861750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447c2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72e7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b31592479ecf2392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a85430600f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb79f5589829b6b0679b5d65a120d59591bce31f7aab1ae4312e5c8b7d0f1c00295cc0d277b9ad21783d75caa"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000dc0)={r1, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000480)="b9ff03076844268cb89e14f088471b", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0x4e, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp={0x44, 0x10, 0x5, 0x3, 0x0, [0x0, 0x0, 0xfffffffe]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) socket(0x1d, 0x5, 0x101) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) r4 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x20, r5, 0xe7d02281b1d40445, 0x0, 0x0, {}, [@ETHTOOL_A_WOL_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0xb}]}]}, 0x20}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000e40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00022cbd7000fcdbdf25030000000500030001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x814) sendto$ax25(r3, 0x0, 0x0, 0xc891, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000000)={0x14, r0, 0x1, 0x0, 0x0, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x8844) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0x23c, r6, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5d9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1ff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc}]}, @TIPC_NLA_SOCK={0x50, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7563}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xbc2d}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0x80, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffbff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x64, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6ee}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xcb}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7932db86}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}, @TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9c6a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6a9d}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x54}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x141}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}]}, 0x23c}, 0x1, 0x0, 0x0, 0x5000}, 0x2) 101.072406ms ago: executing program 1 (id=1819): r0 = socket$nl_audit(0x10, 0x3, 0x9) (async) r1 = socket$can_raw(0x1d, 0x3, 0x1) pread64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc) (async) r2 = socket(0x10, 0x3, 0x0) sendmsg$AUDIT_ADD_RULE(r2, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0x438, 0x3f3, 0x400, 0x70bd2c, 0x25dfdbfe, {0x4, 0x2, 0x18, [0x1, 0x0, 0x3, 0x5ad, 0x8, 0x8, 0x7fffffff, 0x3d616629, 0x4, 0xfffffff1, 0x80000001, 0x5, 0x4, 0x2, 0x8805, 0xae, 0xba82, 0x1, 0x89, 0x1, 0xc000, 0x2, 0x1, 0x9, 0x7, 0x7, 0x8, 0x200, 0x7, 0x8, 0x5, 0x5, 0x1, 0x8, 0x5, 0xf7c, 0x9, 0x2, 0xfffffff4, 0x6093ed59, 0x9, 0x4, 0x4, 0x3, 0x7, 0x6, 0x4, 0xfff, 0x200, 0x8001, 0xcfe, 0x9c35, 0x8001, 0x4, 0xf42, 0xff, 0xfffffffe, 0xfd4, 0x8, 0x9, 0x80000000, 0x5, 0x3, 0x4], [0x0, 0x5, 0x1f, 0x0, 0x2, 0x6, 0x1, 0x9, 0x1, 0x5, 0xa837, 0x0, 0xffffffc0, 0x8ac, 0xf, 0xffffffff, 0x2, 0x3, 0x8, 0x2, 0x6, 0x7, 0x5, 0x0, 0x800, 0x4, 0x9, 0x1000, 0x2, 0x8, 0x3f, 0x7, 0x3ff, 0xffffff81, 0x90, 0x40, 0x0, 0x0, 0x3ff, 0x101, 0x2, 0x6, 0x4, 0xbe, 0x4, 0x8, 0xe00, 0x3, 0x4fef283b, 0xfffffffb, 0x3ff, 0x6, 0x1, 0x4, 0x0, 0x10001, 0x6, 0x6, 0x6, 0x10000, 0xa7e, 0x7, 0x5], [0x5, 0xfffffffe, 0xfff, 0x8, 0x4, 0x282, 0xa, 0x1, 0x6, 0x9, 0x7, 0xe0, 0x8, 0xa4e, 0x6, 0x774, 0x5, 0xc, 0x0, 0x5, 0x80000000, 0x4, 0x9, 0x7f, 0x7, 0x4, 0x8, 0x8000, 0x9, 0x3, 0xf54a, 0x7, 0x8, 0x0, 0x1, 0xc0c, 0x40, 0x2, 0x6, 0xa, 0x8a, 0x4, 0x5b7, 0x6, 0x8, 0x6, 0x2, 0x8, 0x7, 0xa, 0x200, 0x2, 0x401, 0xfc1, 0x97, 0x3, 0x2, 0x101, 0x6, 0xfffffffb, 0x400, 0x6, 0x9, 0x8], [0x1, 0x798, 0x5, 0x3, 0x4a44, 0xffffffff, 0x1, 0xfffffff7, 0x5, 0x35b, 0x40, 0x7fffffff, 0x80000001, 0x5, 0x1, 0x8, 0x2, 0x3, 0x100, 0x4, 0xa9f7, 0x4e0, 0xff, 0x8001, 0x28, 0x2, 0x9, 0x9, 0x8ed, 0xf, 0x9043, 0x0, 0x7, 0x2, 0xfff, 0x7, 0x2, 0xe, 0xfffffffa, 0xffff5768, 0x10001, 0x0, 0x6, 0x8, 0x2, 0x9, 0x400, 0x2, 0xa, 0xf, 0xf, 0xc, 0x2, 0x9, 0xffffffff, 0x8862, 0x5, 0x8, 0x7, 0x4c, 0x2, 0x27, 0x350, 0x3b3], 0x17, ['bond0\x00', 'bond0\x00', '$%\'(\x00', 'bond0\x00']}, ["", "", "", ""]}, 0x438}, 0x1, 0x0, 0x0, 0x800}, 0x4000) (async) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) (async, rerun: 64) r3 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r4}, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000002c40)={'wlan1\x00', &(0x7f0000002bc0)=@ethtool_gstrings={0x1b, 0x1}}) 20.798309ms ago: executing program 0 (id=1820): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) (async) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8}]}}]}, 0x3c}}, 0x0) r4 = epoll_create(0x7) socket$igmp6(0xa, 0x3, 0x2) (async) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000001100)}], 0x1}}], 0x1, 0x8080) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) (async) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0x8) (async) r7 = accept4(r6, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, '\x00', 0xb}, 0xfdc6}}}, &(0x7f00000005c0)=0x84) r8 = epoll_create1(0x0) (async) r9 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r4, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f00000000c0)) (async) r10 = epoll_create1(0x0) (async) r11 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r10, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000100)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r13 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r12, &(0x7f0000000200)) (async) close(r0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1e, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0200bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c1e2f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r0, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 0s ago: executing program 3 (id=1821): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x82, &(0x7f0000000140)=@assoc_value, &(0x7f0000000040)=0x8) shutdown(r0, 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000080)=""/74, &(0x7f0000000000)=0x4a) kernel console output (not intermixed with test programs): promiscuous mode [ 89.223447][ T6515] batadv0: entered promiscuous mode [ 89.244184][ T6515] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 89.458870][ T6529] netlink: 'syz.0.196': attribute type 11 has an invalid length. [ 89.653044][ T6537] netlink: 8 bytes leftover after parsing attributes in process `syz.2.197'. [ 89.817052][ T6543] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 89.841638][ T6543] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 89.878679][ T6543] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.902258][ T6543] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 90.054060][ T6551] raw_sendmsg: syz.4.206 forgot to set AF_INET. Fix it! [ 90.395429][ T6576] sctp: failed to load transform for md5: -4 [ 90.714079][ T6600] dvmrp0: entered allmulticast mode [ 91.416811][ T6632] openvswitch: netlink: IPv4 tun info is not correct [ 91.426321][ T6633] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 91.447648][ T6632] veth0_to_hsr: entered promiscuous mode [ 91.499931][ T6633] xt_hashlimit: overflow, try lower: 1125899906842624/8 [ 91.505350][ T6632] veth1_macvtap: left promiscuous mode [ 91.518292][ T6632] macsec0: entered allmulticast mode [ 91.746248][ T6631] veth0_to_hsr: left promiscuous mode [ 91.941289][ T6659] lo: entered promiscuous mode [ 91.951361][ T6659] netlink: 'syz.0.238': attribute type 2 has an invalid length. [ 91.959804][ T6659] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 91.977234][ T6661] netlink: 'syz.3.239': attribute type 21 has an invalid length. [ 91.988695][ T6662] __nla_validate_parse: 6 callbacks suppressed [ 91.988721][ T6662] netlink: 20 bytes leftover after parsing attributes in process `syz.0.238'. [ 92.023741][ T6662] netlink: 8 bytes leftover after parsing attributes in process `syz.0.238'. [ 92.423152][ T6684] netlink: 'syz.3.246': attribute type 1 has an invalid length. [ 92.442557][ T6684] netlink: 228 bytes leftover after parsing attributes in process `syz.3.246'. [ 92.537522][ T6699] netlink: 24 bytes leftover after parsing attributes in process `syz.2.248'. [ 93.191744][ T6730] netlink: 28 bytes leftover after parsing attributes in process `syz.1.256'. [ 93.517852][ T6750] netlink: 44 bytes leftover after parsing attributes in process `syz.2.262'. [ 94.044444][ T6785] netlink: 'syz.0.273': attribute type 1 has an invalid length. [ 94.077261][ T6785] netlink: 224 bytes leftover after parsing attributes in process `syz.0.273'. [ 94.221502][ T6795] netlink: 40 bytes leftover after parsing attributes in process `syz.2.275'. [ 94.252153][ T6786] netlink: 'syz.0.273': attribute type 1 has an invalid length. [ 94.268065][ T6786] netlink: 224 bytes leftover after parsing attributes in process `syz.0.273'. [ 94.661800][ T6813] xt_cluster: you have exceeded the maximum number of cluster nodes (768 > 32) [ 94.683414][ T6817] xt_cluster: you have exceeded the maximum number of cluster nodes (768 > 32) [ 94.711690][ T6818] xt_HMARK: spi-set and port-set can't be combined [ 94.721867][ T6764] syz.3.264 (6764) used greatest stack depth: 16624 bytes left [ 94.751290][ T6819] netlink: 28 bytes leftover after parsing attributes in process `syz.4.284'. [ 94.767268][ T6818] netlink: 'syz.2.283': attribute type 4 has an invalid length. [ 95.355752][ T6853] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 95.531225][ T6863] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.577970][ T6864] x_tables: ip6_tables: REDIRECT target: used from hooks INPUT, but only usable from PREROUTING/OUTPUT [ 95.707037][ T6864] x_tables: ip6_tables: REDIRECT target: used from hooks INPUT, but only usable from PREROUTING/OUTPUT [ 95.719396][ T6866] syzkaller1: entered promiscuous mode [ 95.729756][ T6866] syzkaller1: entered allmulticast mode [ 95.757573][ T6866] macsec0: entered promiscuous mode [ 96.084816][ T6885] Bluetooth: MGMT ver 1.23 [ 96.119628][ T6883] openvswitch: netlink: Flow actions attr not present in new flow. [ 96.306327][ T6897] netlink: 'syz.2.309': attribute type 6 has an invalid length. [ 96.352569][ T6897] netlink: 'syz.2.309': attribute type 5 has an invalid length. [ 96.606886][ T6910] netlink: 'syz.2.314': attribute type 7 has an invalid length. [ 96.660393][ T6918] netlink: 'syz.1.316': attribute type 16 has an invalid length. [ 96.743855][ T6918] netlink: 'syz.1.316': attribute type 3 has an invalid length. [ 96.833611][ T6922] xt_bpf: check failed: parse error [ 96.903278][ T6926] Bluetooth: MGMT ver 1.23 [ 97.083294][ T6938] netlink: 'syz.4.321': attribute type 1 has an invalid length. [ 97.104942][ T6938] __nla_validate_parse: 14 callbacks suppressed [ 97.104961][ T6938] netlink: 244 bytes leftover after parsing attributes in process `syz.4.321'. [ 97.658697][ T6969] netlink: 4 bytes leftover after parsing attributes in process `syz.2.333'. [ 97.682718][ T6969] syz_tun: entered promiscuous mode [ 97.703611][ T6969] macvtap1: entered promiscuous mode [ 97.710308][ T6969] macvtap1: entered allmulticast mode [ 97.759804][ T6969] syz_tun: entered allmulticast mode [ 98.532763][ T7010] netlink: 'syz.3.345': attribute type 3 has an invalid length. [ 98.588793][ T7013] hsr0: entered allmulticast mode [ 98.598620][ T7013] hsr_slave_0: entered allmulticast mode [ 98.632703][ T7013] hsr_slave_1: entered allmulticast mode [ 98.650865][ T7012] netlink: 20 bytes leftover after parsing attributes in process `syz.1.346'. [ 98.729934][ T7010] hsr_slave_0: left promiscuous mode [ 98.760432][ T7010] hsr_slave_1: left promiscuous mode [ 98.793186][ T7019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.349'. [ 98.812892][ T7019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.349'. [ 98.849240][ T7010] hsr0 (unregistering): left allmulticast mode [ 98.864975][ T7019] netlink: 16 bytes leftover after parsing attributes in process `syz.4.349'. [ 99.127865][ T7031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.353'. [ 99.432561][ T7043] netlink: 156 bytes leftover after parsing attributes in process `syz.4.358'. [ 99.559662][ T7043] netlink: 'syz.4.358': attribute type 10 has an invalid length. [ 99.705400][ T7060] sctp: [Deprecated]: syz.2.366 (pid 7060) Use of struct sctp_assoc_value in delayed_ack socket option. [ 99.705400][ T7060] Use struct sctp_sack_info instead [ 99.723435][ T7060] netlink: 20 bytes leftover after parsing attributes in process `syz.2.366'. [ 99.732635][ T7060] netlink: 20 bytes leftover after parsing attributes in process `syz.2.366'. [ 99.757413][ T7060] sctp: [Deprecated]: syz.2.366 (pid 7060) Use of struct sctp_assoc_value in delayed_ack socket option. [ 99.757413][ T7060] Use struct sctp_sack_info instead [ 99.796037][ T7043] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 100.255989][ T7083] xt_SECMARK: invalid mode: 0 [ 100.272210][ T7083] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 100.292869][ T7083] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 100.324576][ T7087] netlink: 'syz.1.375': attribute type 1 has an invalid length. [ 100.416142][ T7087] 8021q: adding VLAN 0 to HW filter on device bond1 [ 100.551347][ T7087] 8021q: adding VLAN 0 to HW filter on device bond1 [ 100.588548][ T7087] bond1: (slave ipip0): The slave device specified does not support setting the MAC address [ 100.617823][ T7087] bond1: (slave ipip0): Error -95 calling set_mac_address [ 100.909770][ T7110] FAULT_INJECTION: forcing a failure. [ 100.909770][ T7110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 100.930978][ T7109] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 100.948616][ T7110] CPU: 1 UID: 0 PID: 7110 Comm: syz.1.382 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 100.948642][ T7110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 100.948654][ T7110] Call Trace: [ 100.948661][ T7110] [ 100.948669][ T7110] dump_stack_lvl+0x241/0x360 [ 100.948700][ T7110] ? __pfx_dump_stack_lvl+0x10/0x10 [ 100.948723][ T7110] ? __pfx__printk+0x10/0x10 [ 100.948746][ T7110] ? __pfx_lock_release+0x10/0x10 [ 100.948787][ T7110] should_fail_ex+0x40a/0x550 [ 100.948820][ T7110] _copy_from_user+0x2d/0xb0 [ 100.948847][ T7110] copy_msghdr_from_user+0xae/0x680 [ 100.948870][ T7110] ? __pfx___might_resched+0x10/0x10 [ 100.948901][ T7110] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 100.948930][ T7110] ? do_recvmmsg+0x44e/0xab0 [ 100.948962][ T7110] ? __might_fault+0xaa/0x120 [ 100.949001][ T7110] do_recvmmsg+0x3bd/0xab0 [ 100.949052][ T7110] ? __pfx_do_recvmmsg+0x10/0x10 [ 100.949106][ T7110] ? ksys_write+0x22a/0x2b0 [ 100.949127][ T7110] ? __pfx_lock_release+0x10/0x10 [ 100.949164][ T7110] ? sb_end_write+0xe9/0x1c0 [ 100.949192][ T7110] ? vfs_write+0x7fa/0xd10 [ 100.949215][ T7110] ? __mutex_unlock_slowpath+0x227/0x800 [ 100.949251][ T7110] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 100.949276][ T7110] ? __fget_files+0x2a/0x410 [ 100.949320][ T7110] __x64_sys_recvmmsg+0x199/0x250 [ 100.949354][ T7110] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 100.949387][ T7110] ? do_syscall_64+0x100/0x230 [ 100.949428][ T7110] ? do_syscall_64+0xb6/0x230 [ 100.949454][ T7110] do_syscall_64+0xf3/0x230 [ 100.949478][ T7110] ? clear_bhb_loop+0x35/0x90 [ 100.949528][ T7110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.949556][ T7110] RIP: 0033:0x7fdc9378cde9 [ 100.949574][ T7110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 100.949591][ T7110] RSP: 002b:00007fdc946be038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 100.949612][ T7110] RAX: ffffffffffffffda RBX: 00007fdc939a5fa0 RCX: 00007fdc9378cde9 [ 100.949627][ T7110] RDX: 0000000000000002 RSI: 0000400000000540 RDI: 0000000000000004 [ 100.949639][ T7110] RBP: 00007fdc946be090 R08: 0000000000000000 R09: 0000000000000000 [ 100.949651][ T7110] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 100.949664][ T7110] R13: 0000000000000000 R14: 00007fdc939a5fa0 R15: 00007ffd2b9eaf78 [ 100.949693][ T7110] [ 101.207726][ T7115] syzkaller0: entered promiscuous mode [ 101.213339][ T7115] syzkaller0: entered allmulticast mode [ 101.771036][ T7151] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 101.990265][ T7165] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 102.716293][ T7201] netlink: 'syz.4.405': attribute type 10 has an invalid length. [ 102.757906][ T7201] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.785699][ T7201] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 103.055802][ T7215] __nla_validate_parse: 12 callbacks suppressed [ 103.055822][ T7215] netlink: 8 bytes leftover after parsing attributes in process `syz.2.409'. [ 103.092170][ T7219] netlink: 'syz.4.411': attribute type 1 has an invalid length. [ 103.100844][ T7219] netlink: 'syz.4.411': attribute type 2 has an invalid length. [ 103.134239][ T7219] netlink: 'syz.4.411': attribute type 1 has an invalid length. [ 103.556748][ T7239] xt_policy: output policy not valid in PREROUTING and INPUT [ 103.769174][ T7246] netlink: 32 bytes leftover after parsing attributes in process `syz.4.417'. [ 103.836091][ T7252] netlink: 'syz.2.418': attribute type 11 has an invalid length. [ 103.888268][ T7252] netlink: 204 bytes leftover after parsing attributes in process `syz.2.418'. [ 103.914861][ T7255] netlink: 'syz.2.418': attribute type 11 has an invalid length. [ 103.952753][ T7255] netlink: 204 bytes leftover after parsing attributes in process `syz.2.418'. [ 104.460714][ T7275] pimreg: entered allmulticast mode [ 104.787809][ T7297] netlink: 16 bytes leftover after parsing attributes in process `syz.1.428'. [ 105.665596][ T7318] xt_CT: No such helper "pptp" [ 105.764094][ T7323] ieee802154 phy0 wpan0: encryption failed: -22 [ 105.830403][ T7323] netlink: 656 bytes leftover after parsing attributes in process `syz.1.437'. [ 106.429266][ T7346] netlink: 'syz.2.445': attribute type 10 has an invalid length. [ 106.456566][ T7346] bridge0: port 3(team0) entered blocking state [ 106.468990][ T7346] bridge0: port 3(team0) entered disabled state [ 106.488317][ T7346] team0: entered allmulticast mode [ 106.511919][ T7346] team_slave_0: entered allmulticast mode [ 106.521410][ T7346] team_slave_1: entered allmulticast mode [ 106.531847][ T7346] team0: entered promiscuous mode [ 106.536984][ T7346] team_slave_0: entered promiscuous mode [ 106.563674][ T7346] team_slave_1: entered promiscuous mode [ 106.570207][ T7346] bridge0: port 3(team0) entered blocking state [ 106.576850][ T7346] bridge0: port 3(team0) entered forwarding state [ 106.680334][ T7348] lo: left promiscuous mode [ 106.685378][ T7348] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 106.707849][ T7351] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 106.960422][ T7364] FAULT_INJECTION: forcing a failure. [ 106.960422][ T7364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 106.982878][ T7364] CPU: 1 UID: 0 PID: 7364 Comm: syz.0.451 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 106.982905][ T7364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 106.982916][ T7364] Call Trace: [ 106.982922][ T7364] [ 106.982930][ T7364] dump_stack_lvl+0x241/0x360 [ 106.982958][ T7364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 106.982979][ T7364] ? __pfx__printk+0x10/0x10 [ 106.983003][ T7364] ? snprintf+0xda/0x120 [ 106.983034][ T7364] should_fail_ex+0x40a/0x550 [ 106.983065][ T7364] _copy_to_user+0x31/0xb0 [ 106.983090][ T7364] simple_read_from_buffer+0xca/0x150 [ 106.983117][ T7364] proc_fail_nth_read+0x1e9/0x250 [ 106.983150][ T7364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 106.983178][ T7364] ? rw_verify_area+0x243/0x630 [ 106.983208][ T7364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 106.983234][ T7364] vfs_read+0x1f8/0xb40 [ 106.983253][ T7364] ? fdget_pos+0x254/0x320 [ 106.983281][ T7364] ? __pfx___mutex_lock+0x10/0x10 [ 106.983304][ T7364] ? __pfx_vfs_read+0x10/0x10 [ 106.983325][ T7364] ? __fget_files+0x2a/0x410 [ 106.983352][ T7364] ? __fget_files+0x395/0x410 [ 106.983376][ T7364] ? __fget_files+0x2a/0x410 [ 106.983410][ T7364] ksys_read+0x18f/0x2b0 [ 106.983431][ T7364] ? __pfx_ksys_read+0x10/0x10 [ 106.983450][ T7364] ? do_syscall_64+0x100/0x230 [ 106.983476][ T7364] ? do_syscall_64+0xb6/0x230 [ 106.983502][ T7364] do_syscall_64+0xf3/0x230 [ 106.983524][ T7364] ? clear_bhb_loop+0x35/0x90 [ 106.983554][ T7364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.983579][ T7364] RIP: 0033:0x7f89fb58b7fc [ 106.983596][ T7364] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 106.983611][ T7364] RSP: 002b:00007f89fc3b9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 106.983631][ T7364] RAX: ffffffffffffffda RBX: 00007f89fb7a5fa0 RCX: 00007f89fb58b7fc [ 106.983644][ T7364] RDX: 000000000000000f RSI: 00007f89fc3b90a0 RDI: 0000000000000005 [ 106.983656][ T7364] RBP: 00007f89fc3b9090 R08: 0000000000000000 R09: 0000000000000000 [ 106.983668][ T7364] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 106.983696][ T7364] R13: 0000000000000000 R14: 00007f89fb7a5fa0 R15: 00007ffe68cba8b8 [ 106.983727][ T7364] [ 107.336621][ T7204] Set syz1 is full, maxelem 65536 reached [ 107.583226][ T7378] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 107.641820][ T7374] syzkaller1: entered promiscuous mode [ 107.666247][ T7374] syzkaller1: entered allmulticast mode [ 107.898842][ T7395] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 108.254494][ T7405] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 108.418804][ T7412] xt_l2tp: wrong L2TP version: 0 [ 108.942617][ T7448] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:20000 [ 109.336255][ T7462] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 109.528844][ T7470] netlink: 12 bytes leftover after parsing attributes in process `syz.3.486'. [ 109.632048][ T7470] 8021q: adding VLAN 0 to HW filter on device bond1 [ 109.813632][ T7485] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 110.194607][ T7500] nftables ruleset with unbound chain [ 110.512910][ T7517] netlink: 6 bytes leftover after parsing attributes in process `syz.1.500'. [ 110.541469][ T7517] bridge: RTM_NEWNEIGH with invalid ether address [ 110.571507][ T7520] veth1_macvtap: left promiscuous mode [ 110.645744][ T7523] netlink: 8 bytes leftover after parsing attributes in process `syz.2.502'. [ 110.671755][ T7520] syzkaller0: entered promiscuous mode [ 110.677597][ T7520] syzkaller0: entered allmulticast mode [ 110.949152][ T7538] netlink: 20 bytes leftover after parsing attributes in process `syz.2.507'. [ 112.496284][ T7556] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 112.678275][ T7573] netlink: 10 bytes leftover after parsing attributes in process `syz.0.515'. [ 112.828839][ T7580] netlink: 'syz.1.517': attribute type 32 has an invalid length. [ 112.838839][ T7582] netlink: 12 bytes leftover after parsing attributes in process `syz.4.518'. [ 112.909983][ T7582] bond1: entered promiscuous mode [ 112.918977][ T7582] 8021q: adding VLAN 0 to HW filter on device bond1 [ 113.031559][ T7594] netlink: 340 bytes leftover after parsing attributes in process `syz.4.521'. [ 113.223518][ T7602] netlink: 64 bytes leftover after parsing attributes in process `syz.4.524'. [ 113.313141][ T7604] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 113.377022][ T7614] netlink: 4 bytes leftover after parsing attributes in process `syz.4.527'. [ 113.531016][ T7620] netlink: 8 bytes leftover after parsing attributes in process `syz.4.531'. [ 113.551857][ T7617] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 113.899813][ T7633] sctp: [Deprecated]: syz.1.537 (pid 7633) Use of int in max_burst socket option deprecated. [ 113.899813][ T7633] Use struct sctp_assoc_value instead [ 114.382927][ T7652] netlink: 'syz.0.544': attribute type 10 has an invalid length. [ 114.452127][ T7652] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.492124][ T7652] bond0: (slave team0): Enslaving as an active interface with an up link [ 114.524006][ T7657] sctp: [Deprecated]: syz.2.546 (pid 7657) Use of struct sctp_assoc_value in delayed_ack socket option. [ 114.524006][ T7657] Use struct sctp_sack_info instead [ 114.560651][ T7657] tipc: Enabling of bearer rejected, media not registered [ 114.727598][ T7668] A link change request failed with some changes committed already. Interface veth1_to_team may have been left with an inconsistent configuration, please check. [ 115.097213][ T7689] netlink: 'syz.4.557': attribute type 4 has an invalid length. [ 115.122133][ T7684] No such timeout policy "syz0" [ 115.145649][ T7692] netlink: 'syz.1.559': attribute type 10 has an invalid length. [ 115.165615][ T7692] __nla_validate_parse: 1 callbacks suppressed [ 115.165634][ T7692] netlink: 40 bytes leftover after parsing attributes in process `syz.1.559'. [ 115.280682][ T7692] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 115.315057][ T7692] team0: Failed to send options change via netlink (err -105) [ 115.344649][ T7692] team0: Port device geneve0 added [ 115.490363][ T7709] bond0: option ad_select: unable to set because the bond device is up [ 115.525956][ T7713] netlink: 'syz.4.563': attribute type 9 has an invalid length. [ 115.542369][ T7713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.563'. [ 115.730252][ T7727] IPVS: sync thread started: state = BACKUP, mcast_ifn = sit0, syncid = 4, id = 0 [ 115.933376][ T7732] netlink: 32 bytes leftover after parsing attributes in process `syz.1.572'. [ 116.144867][ T7748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.576'. [ 116.508875][ T7765] netlink: 16 bytes leftover after parsing attributes in process `syz.4.584'. [ 116.773124][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880206fd400: rx timeout, send abort [ 117.171602][ T7798] netlink: 28 bytes leftover after parsing attributes in process `syz.3.595'. [ 117.282043][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880206fd400: abort rx timeout. Force session deactivation [ 117.694863][ T7826] netlink: 24 bytes leftover after parsing attributes in process `syz.2.603'. [ 117.923961][ T7834] netlink: 'syz.1.607': attribute type 7 has an invalid length. [ 117.952928][ T7841] netlink: 60 bytes leftover after parsing attributes in process `syz.2.610'. [ 117.955751][ T7840] tipc: Enabling of bearer rejected, failed to enable media [ 118.029508][ T7840] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 118.065272][ T7834] (unnamed net_device) (uninitialized): up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 118.120337][ T7847] Bluetooth: MGMT ver 1.23 [ 118.497386][ T7873] netlink: 'syz.3.618': attribute type 1 has an invalid length. [ 118.563258][ T7873] netlink: 8 bytes leftover after parsing attributes in process `syz.3.618'. [ 118.875131][ T7894] netlink: 4 bytes leftover after parsing attributes in process `syz.4.625'. [ 119.314391][ T7915] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 119.513453][ T7925] ;U®õ: entered promiscuous mode [ 120.029050][ T7959] netlink: 'syz.1.646': attribute type 49 has an invalid length. [ 120.404649][ T7983] xt_l2tp: invalid flags combination: c [ 120.504347][ T7992] __nla_validate_parse: 50 callbacks suppressed [ 120.504370][ T7992] netlink: 256 bytes leftover after parsing attributes in process `syz.3.655'. [ 120.528570][ T7994] netlink: 'syz.0.656': attribute type 8 has an invalid length. [ 120.755699][ T8009] netlink: 72 bytes leftover after parsing attributes in process `syz.3.663'. [ 120.776418][ T8009] netlink: 72 bytes leftover after parsing attributes in process `syz.3.663'. [ 121.598397][ T8055] netlink: 80 bytes leftover after parsing attributes in process `syz.4.676'. [ 121.780573][ T8069] netlink: 24 bytes leftover after parsing attributes in process `syz.2.680'. [ 121.932309][ T8080] netlink: 'syz.3.684': attribute type 1 has an invalid length. [ 121.960638][ T8080] netlink: 'syz.3.684': attribute type 11 has an invalid length. [ 121.978967][ T8080] netlink: 220 bytes leftover after parsing attributes in process `syz.3.684'. [ 122.453259][ T8103] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 122.548989][ T8106] netlink: 8 bytes leftover after parsing attributes in process `syz.2.695'. [ 122.572381][ T8108] netlink: 4 bytes leftover after parsing attributes in process `syz.1.696'. [ 122.593382][ T8106] netlink: 12 bytes leftover after parsing attributes in process `syz.2.695'. [ 122.646032][ T8112] netlink: 'syz.4.697': attribute type 12 has an invalid length. [ 122.654800][ C1] Illegal XDP return value 16128 on prog (id 115) dev lo, expect packet loss! [ 122.664426][ T8112] netlink: 'syz.4.697': attribute type 29 has an invalid length. [ 122.672337][ T8112] netlink: 148 bytes leftover after parsing attributes in process `syz.4.697'. [ 122.683050][ T8112] netlink: 'syz.4.697': attribute type 1 has an invalid length. [ 122.691607][ T8112] netlink: 'syz.4.697': attribute type 2 has an invalid length. [ 122.814487][ T8118] hsr_slave_1 (unregistering): left promiscuous mode [ 123.090623][ T8131] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 123.100982][ T8131] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.309349][ T8143] netlink: 'syz.3.709': attribute type 12 has an invalid length. [ 123.318039][ T8143] netlink: 'syz.3.709': attribute type 29 has an invalid length. [ 123.599430][ T8157] ip6gre1: entered allmulticast mode [ 123.977554][ T8179] wg2: entered promiscuous mode [ 124.032664][ T8179] wg2: entered allmulticast mode [ 124.061288][ T8186] netlink: 'syz.3.723': attribute type 1 has an invalid length. [ 124.325462][ T8221] netlink: 'syz.4.728': attribute type 1 has an invalid length. [ 124.342180][ T8223] netlink: 'syz.2.725': attribute type 11 has an invalid length. [ 125.826797][ T8317] __nla_validate_parse: 16 callbacks suppressed [ 125.826816][ T8317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.755'. [ 125.980230][ T8322] x_tables: unsorted underflow at hook 1 [ 126.312793][ T8339] sctp: [Deprecated]: syz.2.761 (pid 8339) Use of struct sctp_assoc_value in delayed_ack socket option. [ 126.312793][ T8339] Use struct sctp_sack_info instead [ 126.425207][ T8345] netlink: 8 bytes leftover after parsing attributes in process `syz.4.764'. [ 126.574817][ T8348] netlink: 9 bytes leftover after parsing attributes in process `syz.2.765'. [ 126.601173][ T8348] 0·: renamed from hsr0 (while UP) [ 126.614925][ T8348] 0·: entered promiscuous mode [ 126.619984][ T8348] A link change request failed with some changes committed already. Interface 70· may have been left with an inconsistent configuration, please check. [ 126.645525][ T8356] netlink: 4 bytes leftover after parsing attributes in process `syz.3.768'. [ 126.914465][ T8372] netlink: 192 bytes leftover after parsing attributes in process `syz.4.770'. [ 127.019309][ T8380] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 127.132853][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 127.847014][ T8419] syzkaller0: entered promiscuous mode [ 127.866591][ T8419] syzkaller0: entered allmulticast mode [ 129.778763][ T8459] xt_SECMARK: invalid mode: 0 [ 130.154053][ T8485] netlink: 'syz.2.800': attribute type 4 has an invalid length. [ 130.169144][ T8485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.800'. [ 130.209567][ T8485] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 130.468730][ T8503] netlink: 4 bytes leftover after parsing attributes in process `syz.2.803'. [ 130.518256][ T8507] netlink: 36 bytes leftover after parsing attributes in process `syz.3.804'. [ 130.520178][ T8504] netlink: 32 bytes leftover after parsing attributes in process `syz.1.802'. [ 130.660659][ T8510] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 130.701224][ T8514] IPVS: set_ctl: invalid protocol: 64874 0.0.7.255:20004 [ 130.739755][ T8510] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 130.874133][ T8521] __nla_validate_parse: 2 callbacks suppressed [ 130.874153][ T8521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.807'. [ 130.938205][ T8516] (unnamed net_device) (uninitialized): up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 131.147789][ T8200] bond0: (slave bond_slave_0): interface is now down [ 131.187250][ T8200] bond0: (slave bond_slave_1): interface is now down [ 131.211167][ T8200] bond0: (slave wlan1): interface is now down [ 131.228893][ T8200] bond0: (slave batadv0): interface is now down [ 131.265638][ T8200] bond0: now running without any active interface! [ 131.436475][ T8552] netlink: 96 bytes leftover after parsing attributes in process `syz.1.812'. [ 131.776149][ T8569] netlink: 'syz.1.819': attribute type 21 has an invalid length. [ 131.824831][ T8569] netlink: 'syz.1.819': attribute type 11 has an invalid length. [ 131.867887][ T8577] netlink: 4 bytes leftover after parsing attributes in process `syz.4.821'. [ 132.193710][ T8597] IPVS: set_ctl: invalid protocol: 46 224.0.0.1:20000 [ 132.403920][ T8610] netlink: 5 bytes leftover after parsing attributes in process `syz.1.829'. [ 132.455375][ T8613] netlink: 20 bytes leftover after parsing attributes in process `syz.4.830'. [ 132.578925][ T8619] netlink: 'syz.3.832': attribute type 24 has an invalid length. [ 132.867994][ T8637] dccp_v4_rcv: dropped packet with invalid checksum [ 132.897552][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.042074][ T8646] netlink: 28 bytes leftover after parsing attributes in process `syz.2.840'. [ 133.196383][ T8656] netlink: 'syz.0.843': attribute type 29 has an invalid length. [ 133.220438][ T8656] netlink: 4 bytes leftover after parsing attributes in process `syz.0.843'. [ 133.284014][ T8663] netlink: 24 bytes leftover after parsing attributes in process `syz.1.844'. [ 133.300606][ T8663] tipc: Started in network mode [ 133.301060][ T8665] netlink: 36 bytes leftover after parsing attributes in process `syz.3.847'. [ 133.305636][ T8663] tipc: Node identity 6e415382957a, cluster identity 4711 [ 133.320353][ T8665] netlink: 16 bytes leftover after parsing attributes in process `syz.3.847'. [ 133.332642][ T8663] tipc: Enabled bearer , priority 0 [ 133.344066][ T8663] +: renamed from syzkaller0 [ 133.437880][ T8663] tipc: Disabling bearer [ 133.500118][ T8672] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 133.579771][ T8672] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 133.807510][ T8657] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.913387][ T8688] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 133.943913][ T5846] Bluetooth: hci4: link tx timeout [ 133.947666][ T8690] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.949314][ T5846] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 133.970193][ T5843] Bluetooth: hci4: link tx timeout [ 133.977238][ T5843] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 134.073618][ T8693] openvswitch: netlink: Missing key (keys=40, expected=100) [ 134.084108][ T8695] netlink: 'syz.3.856': attribute type 2 has an invalid length. [ 134.092227][ T8695] netlink: 'syz.3.856': attribute type 9 has an invalid length. [ 134.213222][ T8700] netlink: 'syz.1.860': attribute type 1 has an invalid length. [ 134.221289][ T8700] netlink: 'syz.1.860': attribute type 2 has an invalid length. [ 134.265454][ T8700] netlink: 'syz.1.860': attribute type 10 has an invalid length. [ 134.285263][ T8704] dccp_invalid_packet: P.type (RESPONSE) not Data || [Data]Ack, while P.X == 0 [ 134.299690][ T8700] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.308354][ T8700] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.359531][ T8700] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.366744][ T8700] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.374254][ T8700] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.381387][ T8700] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.424768][ T8700] bridge0: entered promiscuous mode [ 134.436694][ T8700] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 134.493415][ T8706] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 135.183960][ T8749] netlink: 'syz.0.878': attribute type 1 has an invalid length. [ 135.223339][ T8749] netlink: 'syz.0.878': attribute type 4 has an invalid length. [ 135.342179][ T8752] openvswitch: netlink: IP tunnel dst address not specified [ 135.454595][ T5843] Bluetooth: hci4: command 0x0405 tx timeout [ 135.913587][ T8794] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 135.921465][ T8797] netlink: 'syz.1.895': attribute type 39 has an invalid length. [ 136.359548][ T8819] netlink: 'syz.0.901': attribute type 1 has an invalid length. [ 136.389206][ T8818] 8021q: adding VLAN 0 to HW filter on device bond1 [ 136.449036][ T8818] 8021q: adding VLAN 0 to HW filter on device bond1 [ 136.480913][ T8818] bond1: (slave ipip0): The slave device specified does not support setting the MAC address [ 136.500799][ T8832] openvswitch: netlink: IP tunnel dst address not specified [ 136.529784][ T8818] bond1: (slave ipip0): Error -95 calling set_mac_address [ 136.530846][ T8832] openvswitch: netlink: IP tunnel dst address not specified [ 136.607042][ T8819] bond1: (slave ip6erspan0): making interface the new active one [ 136.653271][ T8819] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link [ 136.875944][ T8852] __nla_validate_parse: 74 callbacks suppressed [ 136.875963][ T8852] netlink: 20 bytes leftover after parsing attributes in process `syz.0.910'. [ 136.914970][ T8852] netlink: 'syz.0.910': attribute type 21 has an invalid length. [ 137.112858][ T5933] hid-generic 0005:7FFF:0008.0002: unknown main item tag 0x0 [ 137.120306][ T5933] hid-generic 0005:7FFF:0008.0002: unknown main item tag 0x0 [ 137.180586][ T5933] hid-generic 0005:7FFF:0008.0002: item fetching failed at offset 7/8 [ 137.220313][ T5933] hid-generic 0005:7FFF:0008.0002: probe with driver hid-generic failed with error -22 [ 137.328018][ T8884] netlink: 165 bytes leftover after parsing attributes in process `syz.1.919'. [ 137.328425][ T8880] netlink: 8 bytes leftover after parsing attributes in process `syz.2.917'. [ 137.532881][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 137.988293][ T8915] netlink: 32 bytes leftover after parsing attributes in process `syz.4.931'. [ 138.094317][ T8919] netlink: 8 bytes leftover after parsing attributes in process `syz.1.933'. [ 138.131515][ T8919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.933'. [ 138.157904][ T8919] netlink: 32 bytes leftover after parsing attributes in process `syz.1.933'. [ 138.235720][ T5846] block nbd0: Receive control failed (result -107) [ 138.816140][ T8960] net_ratelimit: 1 callbacks suppressed [ 138.816161][ T8960] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 138.879420][ T8956] netlink: 40 bytes leftover after parsing attributes in process `syz.4.946'. [ 138.899841][ T8956] netlink: 40 bytes leftover after parsing attributes in process `syz.4.946'. [ 139.190262][ T8975] do_dccp_getsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app [ 139.706146][ T8985] netlink: 28 bytes leftover after parsing attributes in process `syz.4.953'. [ 139.741505][ T8985] netlink: 'syz.4.953': attribute type 7 has an invalid length. [ 139.765797][ T8985] netlink: 'syz.4.953': attribute type 8 has an invalid length. [ 140.178176][ T9011] FAULT_INJECTION: forcing a failure. [ 140.178176][ T9011] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.195752][ T9011] CPU: 0 UID: 0 PID: 9011 Comm: syz.0.963 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 140.195782][ T9011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 140.195794][ T9011] Call Trace: [ 140.195802][ T9011] [ 140.195811][ T9011] dump_stack_lvl+0x241/0x360 [ 140.195843][ T9011] ? __pfx_dump_stack_lvl+0x10/0x10 [ 140.195865][ T9011] ? __pfx__printk+0x10/0x10 [ 140.195888][ T9011] ? __pfx_lock_release+0x10/0x10 [ 140.195928][ T9011] should_fail_ex+0x40a/0x550 [ 140.195962][ T9011] _copy_from_user+0x2d/0xb0 [ 140.195989][ T9011] copy_msghdr_from_user+0xae/0x680 [ 140.196018][ T9011] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 140.196038][ T9011] ? __fget_files+0x2a/0x410 [ 140.196070][ T9011] ? __fget_files+0x2a/0x410 [ 140.196108][ T9011] __sys_sendmsg+0x209/0x350 [ 140.196144][ T9011] ? __pfx___sys_sendmsg+0x10/0x10 [ 140.196194][ T9011] ? do_sys_openat2+0x17a/0x1d0 [ 140.196250][ T9011] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 140.196283][ T9011] ? do_syscall_64+0x100/0x230 [ 140.196313][ T9011] ? do_syscall_64+0xb6/0x230 [ 140.196339][ T9011] do_syscall_64+0xf3/0x230 [ 140.196364][ T9011] ? clear_bhb_loop+0x35/0x90 [ 140.196397][ T9011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.196426][ T9011] RIP: 0033:0x7f89fb58cde9 [ 140.196444][ T9011] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 140.196461][ T9011] RSP: 002b:00007f89fc3b9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 140.196483][ T9011] RAX: ffffffffffffffda RBX: 00007f89fb7a5fa0 RCX: 00007f89fb58cde9 [ 140.196498][ T9011] RDX: 0000000000000880 RSI: 00004000000001c0 RDI: 0000000000000003 [ 140.196511][ T9011] RBP: 00007f89fc3b9090 R08: 0000000000000000 R09: 0000000000000000 [ 140.196524][ T9011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.196535][ T9011] R13: 0000000000000000 R14: 00007f89fb7a5fa0 R15: 00007ffe68cba8b8 [ 140.196565][ T9011] [ 140.418718][ T9017] team0: left allmulticast mode [ 140.427024][ T9017] team_slave_0: left allmulticast mode [ 140.444986][ T9017] team_slave_1: left allmulticast mode [ 140.450523][ T9017] team0: left promiscuous mode [ 140.472516][ T9017] team_slave_0: left promiscuous mode [ 140.478187][ T9017] team_slave_1: left promiscuous mode [ 140.488995][ T9017] bridge0: port 3(team0) entered disabled state [ 140.598852][ T9017] bridge_slave_0: left allmulticast mode [ 140.605721][ T9017] bridge_slave_0: left promiscuous mode [ 140.612360][ T9017] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.628073][ T9017] bridge_slave_1: left allmulticast mode [ 140.642527][ T9017] bridge_slave_1: left promiscuous mode [ 140.657422][ T9017] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.682165][ T9017] bond0: (slave bond_slave_0): Releasing backup interface [ 140.693469][ T9017] bond0: (slave bond_slave_1): Releasing backup interface [ 140.718714][ T9017] team0: Port device team_slave_0 removed [ 140.728468][ T9017] team0: Port device team_slave_1 removed [ 140.736365][ T9017] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.746085][ T9017] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 140.755968][ T9017] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.763875][ T9017] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 140.959009][ T9039] erspan0: vlans aren't supported yet for dev_uc|mc_add() [ 141.316116][ T9062] FAULT_INJECTION: forcing a failure. [ 141.316116][ T9062] name failslab, interval 1, probability 0, space 0, times 1 [ 141.361480][ T9062] CPU: 1 UID: 0 PID: 9062 Comm: syz.1.976 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 141.361508][ T9062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 141.361537][ T9062] Call Trace: [ 141.361545][ T9062] [ 141.361553][ T9062] dump_stack_lvl+0x241/0x360 [ 141.361583][ T9062] ? __pfx_dump_stack_lvl+0x10/0x10 [ 141.361605][ T9062] ? __pfx__printk+0x10/0x10 [ 141.361627][ T9062] ? kmem_cache_alloc_node_noprof+0x4f/0x380 [ 141.361656][ T9062] ? __pfx___might_resched+0x10/0x10 [ 141.361688][ T9062] should_fail_ex+0x40a/0x550 [ 141.361721][ T9062] should_failslab+0xac/0x100 [ 141.361749][ T9062] kmem_cache_alloc_node_noprof+0x77/0x380 [ 141.361777][ T9062] ? __alloc_skb+0x1c3/0x440 [ 141.361808][ T9062] __alloc_skb+0x1c3/0x440 [ 141.361840][ T9062] ? __pfx___alloc_skb+0x10/0x10 [ 141.361869][ T9062] ? netlink_autobind+0xd6/0x2f0 [ 141.361888][ T9062] ? netlink_autobind+0x2b0/0x2f0 [ 141.361913][ T9062] netlink_sendmsg+0x634/0xcb0 [ 141.361944][ T9062] ? __pfx_netlink_sendmsg+0x10/0x10 [ 141.361968][ T9062] ? aa_sock_msg_perm+0x91/0x160 [ 141.362002][ T9062] ? __pfx_netlink_sendmsg+0x10/0x10 [ 141.362020][ T9062] __sock_sendmsg+0x221/0x270 [ 141.362046][ T9062] ____sys_sendmsg+0x53a/0x860 [ 141.362084][ T9062] ? __pfx_____sys_sendmsg+0x10/0x10 [ 141.362111][ T9062] ? __fget_files+0x2a/0x410 [ 141.362142][ T9062] ? __fget_files+0x2a/0x410 [ 141.362179][ T9062] __sys_sendmsg+0x269/0x350 [ 141.362214][ T9062] ? __pfx___sys_sendmsg+0x10/0x10 [ 141.362255][ T9062] ? do_sys_openat2+0x17a/0x1d0 [ 141.362309][ T9062] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 141.362348][ T9062] ? do_syscall_64+0x100/0x230 [ 141.362377][ T9062] ? do_syscall_64+0xb6/0x230 [ 141.362410][ T9062] do_syscall_64+0xf3/0x230 [ 141.362434][ T9062] ? clear_bhb_loop+0x35/0x90 [ 141.362465][ T9062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.362492][ T9062] RIP: 0033:0x7fdc9378cde9 [ 141.362509][ T9062] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 141.362525][ T9062] RSP: 002b:00007fdc946be038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 141.362546][ T9062] RAX: ffffffffffffffda RBX: 00007fdc939a5fa0 RCX: 00007fdc9378cde9 [ 141.362560][ T9062] RDX: 0000000000000880 RSI: 00004000000001c0 RDI: 0000000000000003 [ 141.362573][ T9062] RBP: 00007fdc946be090 R08: 0000000000000000 R09: 0000000000000000 [ 141.362585][ T9062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.362596][ T9062] R13: 0000000000000000 R14: 00007fdc939a5fa0 R15: 00007ffd2b9eaf78 [ 141.362626][ T9062] [ 142.250515][ T9097] netlink: 'syz.2.986': attribute type 1 has an invalid length. [ 142.330225][ T9097] 8021q: adding VLAN 0 to HW filter on device bond2 [ 142.361397][ T9104] __nla_validate_parse: 5 callbacks suppressed [ 142.361415][ T9104] netlink: 8 bytes leftover after parsing attributes in process `syz.0.989'. [ 142.380413][ T9097] bond2: (slave ip6erspan0): making interface the new active one [ 142.389888][ T9097] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 142.405207][ T9097] IPVS: length: 8 != 1152 [ 143.224187][ T9147] batadv1: entered allmulticast mode [ 143.638930][ T9163] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1006'. [ 143.653472][ T9162] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.661752][ T9162] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.670198][ T9162] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.678533][ T9162] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.692657][ T9162] vxlan0: entered promiscuous mode [ 143.698355][ T9162] vxlan0: entered allmulticast mode [ 143.724828][ T9162] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 143.733492][ T9162] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 143.741904][ T9162] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 143.750385][ T9162] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 143.922878][ T9165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1006'. [ 144.254064][ T9179] bond0: (slave batadv0): Releasing backup interface [ 144.297927][ T9179] bridge_slave_0: left allmulticast mode [ 144.348849][ T9179] bridge_slave_0: left promiscuous mode [ 144.363051][ T9179] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.408729][ T9179] bridge_slave_1: left allmulticast mode [ 144.422203][ T9179] bridge_slave_1: left promiscuous mode [ 144.440334][ T9179] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.446691][ T9188] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1012'. [ 144.553551][ T9179] bond0: (slave bond_slave_0): Releasing backup interface [ 144.556514][ T9193] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 144.616914][ T9193] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1012'. [ 144.643272][ T9179] bond0: (slave bond_slave_1): Releasing backup interface [ 144.696467][ T9179] team0: Port device team_slave_0 removed [ 144.733945][ T9179] team0: Port device team_slave_1 removed [ 144.740382][ T9179] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 144.741672][ T9199] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1014'. [ 144.770201][ T9179] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 144.804700][ T9179] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 144.817010][ T9179] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.842993][ T9179] bond0: (slave wlan1): Releasing backup interface [ 145.401819][ T9221] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1020'. [ 145.423598][ T9221] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1020'. [ 145.464241][ T9221] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1020'. [ 145.564162][ T9238] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1024'. [ 145.911637][ T9251] xt_hashlimit: invalid interval [ 146.523680][ T9281] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.838085][ T9268] SET target dimension over the limit! [ 146.959750][ T9294] .: renamed from bond0 (while UP) [ 146.961456][ T9134] Set syz1 is full, maxelem 65536 reached [ 147.131106][ T9299] veth0: entered promiscuous mode [ 147.148848][ T9298] veth0: left promiscuous mode [ 147.467982][ T9316] __nla_validate_parse: 5 callbacks suppressed [ 147.468001][ T9316] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1047'. [ 147.659485][ T9331] sctp: [Deprecated]: syz.2.1052 (pid 9331) Use of struct sctp_assoc_value in delayed_ack socket option. [ 147.659485][ T9331] Use struct sctp_sack_info instead [ 148.080056][ T9337] delete_channel: no stack [ 148.764381][ T9372] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1062'. [ 148.885358][ T9379] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1063'. [ 149.262097][ T9396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1069'. [ 149.376591][ T9402] netlink: 'syz.3.1072': attribute type 10 has an invalid length. [ 149.406876][ T9402] team0: Device ipvlan1 failed to register rx_handler [ 149.687335][ T9411] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1075'. [ 149.777406][ T9423] xt_SECMARK: invalid mode: 0 [ 149.918119][ T9429] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1080'. [ 149.965757][ T9431] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1082'. [ 149.993905][ T9431] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1082'. [ 150.032014][ T9431] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 150.282209][ T9450] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.1088'. [ 150.294266][ T9450] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 150.319656][ T9450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1088'. [ 150.404641][ T9456] xt_bpf: check failed: parse error [ 150.527208][ T8200] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.658136][ T8200] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.807214][ T8200] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.893651][ T9472] xt_HMARK: proto mask must be zero with L3 mode [ 151.051799][ T8200] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.077274][ T9480] netlink: 'syz.2.1099': attribute type 1 has an invalid length. [ 151.085207][ T9480] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 151.433402][ T5843] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 151.444535][ T5843] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 151.462638][ T5843] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 151.479988][ T5843] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 151.492778][ T5843] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 151.500561][ T5843] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 151.780309][ T9503] netlink: 'syz.1.1109': attribute type 12 has an invalid length. [ 151.927028][ T8200] dvmrp0 (unregistering): left allmulticast mode [ 152.141587][ T8200] bond0 (unregistering): Released all slaves [ 152.236933][ T8200] bond1 (unregistering): Released all slaves [ 152.265315][ T9504] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 152.869519][ T9545] __nla_validate_parse: 2 callbacks suppressed [ 152.869537][ T9545] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1115'. [ 153.036363][ T9491] chnl_net:caif_netlink_parms(): no params data found [ 153.536798][ T5846] Bluetooth: hci0: command tx timeout [ 153.561704][ T9586] netlink: 1264 bytes leftover after parsing attributes in process `syz.1.1121'. [ 153.769021][ T9491] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.787216][ T9491] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.797461][ T9491] bridge_slave_0: entered allmulticast mode [ 153.820844][ T9491] bridge_slave_0: entered promiscuous mode [ 153.839455][ T9491] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.853859][ T9491] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.861276][ T9491] bridge_slave_1: entered allmulticast mode [ 153.868966][ T9491] bridge_slave_1: entered promiscuous mode [ 153.880218][ T9595] ip6tnl1: entered allmulticast mode [ 154.112096][ T8200] hsr_slave_0: left promiscuous mode [ 154.153865][ T8200] hsr_slave_1: left promiscuous mode [ 154.221004][ T8200] veth0_macvtap: left promiscuous mode [ 154.231474][ T8200] veth1_vlan: left promiscuous mode [ 154.240280][ T8200] [H: left promiscuous mode [ 154.256407][ T5886] hid-generic 0005:0B57:0200.0003: item fetching failed at offset 0/1 [ 154.266449][ T5886] hid-generic 0005:0B57:0200.0003: probe with driver hid-generic failed with error -22 [ 154.304831][ T9627] ax25_connect(): syz.0.1132 uses autobind, please contact jreuter@yaina.de [ 155.122278][ T9491] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 155.137490][ T9612] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 155.144828][ T9612] IPv6: NLM_F_CREATE should be set when creating new route [ 155.152115][ T9612] IPv6: NLM_F_CREATE should be set when creating new route [ 155.269677][ T9491] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 155.382400][ T9648] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1136'. [ 155.406419][ T9491] team0: Port device team_slave_0 added [ 155.493507][ T9491] team0: Port device team_slave_1 added [ 155.553040][ T9650] netlink: 'syz.1.1134': attribute type 10 has an invalid length. [ 155.614036][ T5846] Bluetooth: hci0: command tx timeout [ 155.723186][ T9491] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.730373][ T9491] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.760048][ T9491] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.818427][ T9491] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.838067][ T9491] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.902512][ T9491] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 156.117824][ T9491] hsr_slave_0: entered promiscuous mode [ 156.124331][ T9491] hsr_slave_1: entered promiscuous mode [ 156.252199][ T8200] IPVS: stop unused estimator thread 0... [ 156.305191][ T9690] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1145'. [ 156.390747][ T9695] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 156.398159][ T9695] IPv6: NLM_F_CREATE should be set when creating new route [ 156.405473][ T9695] IPv6: NLM_F_CREATE should be set when creating new route [ 156.444317][ T9698] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1146'. [ 156.684327][ T9707] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1150'. [ 156.857142][ T9715] batadv_slave_0: entered promiscuous mode [ 156.885119][ T9715] tipc: Started in network mode [ 156.890183][ T9715] tipc: Node identity ac14142f, cluster identity 4711 [ 156.901335][ T9715] tipc: New replicast peer: 0.0.0.0 [ 156.912053][ T9715] tipc: Enabled bearer , priority 10 [ 156.981934][ T9714] batadv_slave_0: left promiscuous mode [ 157.217288][ T9734] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1154'. [ 157.468617][ T9491] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 157.513789][ T9491] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 157.556213][ T9491] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 157.579604][ T9491] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 157.625553][ T9751] vlan1: entered promiscuous mode [ 157.704362][ T5846] Bluetooth: hci0: command tx timeout [ 157.847847][ T9491] 8021q: adding VLAN 0 to HW filter on device bond0 [ 157.875649][ T9751] vlan1: left promiscuous mode [ 157.934778][ T9491] 8021q: adding VLAN 0 to HW filter on device team0 [ 157.992888][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.000052][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.022937][ T25] tipc: Node number set to 2886997039 [ 158.080964][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.088161][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.180946][ T9779] netlink: 'syz.1.1164': attribute type 10 has an invalid length. [ 158.304500][ T9779] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 158.314327][ T9779] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 158.366096][ T9491] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 158.405413][ T9787] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 158.688182][ T9804] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 158.695540][ T9804] IPv6: NLM_F_CREATE should be set when creating new route [ 158.702830][ T9804] IPv6: NLM_F_CREATE should be set when creating new route [ 159.129764][ T9491] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 159.213917][ T9830] nftables ruleset with unbound set [ 159.498918][ T9845] netlink: 'syz.3.1179': attribute type 7 has an invalid length. [ 159.765504][ T9855] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 159.774131][ T5843] Bluetooth: hci0: command tx timeout [ 159.878447][ T9491] veth0_vlan: entered promiscuous mode [ 159.947067][ T9491] veth1_vlan: entered promiscuous mode [ 160.064857][ T9491] veth0_macvtap: entered promiscuous mode [ 160.101256][ T9491] veth1_macvtap: entered promiscuous mode [ 160.195579][ T9491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.252914][ T9491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.279940][ T9491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 160.309177][ T9491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.334914][ T9491] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 160.391475][ T9491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.411622][ T9491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.423048][ T9491] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 160.434414][ T9491] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 160.447635][ T9491] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 160.508357][ T9491] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.511322][ T9886] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1189'. [ 160.534699][ T9491] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.547198][ T9491] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.558642][ T9491] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.757162][ T9892] veth1: entered promiscuous mode [ 160.774926][ T9892] veth1: left promiscuous mode [ 160.822807][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 160.837889][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 160.922707][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 160.957915][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 161.043634][ T9906] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 161.061564][ T9908] netlink: 'syz.2.1195': attribute type 3 has an invalid length. [ 161.098932][ T9908] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1195'. [ 161.173519][ T9915] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1195'. [ 161.660079][ T9937] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1199'. [ 161.733859][ T9942] x_tables: unsorted underflow at hook 3 [ 161.782598][ T9943] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1200'. [ 161.783692][ T9941] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1200'. [ 161.987374][ T8193] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.126694][ T8193] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.308377][ T8193] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.397658][ T9981] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1205'. [ 162.425277][ T8193] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.672887][ T8193] bridge_slave_1: left allmulticast mode [ 162.688951][ T8193] bridge_slave_1: left promiscuous mode [ 162.696228][ T8193] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.738346][ T8193] bridge_slave_0: left allmulticast mode [ 162.752557][ T8193] bridge_slave_0: left promiscuous mode [ 162.763511][ T8193] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.992807][ T5850] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 163.003509][ T5850] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 163.011826][ T5850] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 163.022195][ T5850] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 163.031811][ T5850] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 163.039950][ T5850] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 163.691526][ T8193] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 163.716070][ T8193] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 163.739454][ T8193] bond0 (unregistering): Released all slaves [ 163.782281][ T9995] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1209'. [ 164.057103][T10053] ieee802154 phy0 wpan0: encryption failed: -22 [ 164.093550][T10053] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 164.309491][T10066] netlink: 216 bytes leftover after parsing attributes in process `syz.1.1220'. [ 164.327606][T10060] xt_CT: No such helper "syz1" [ 164.337645][T10066] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1220'. [ 164.343471][T10065] bond0: entered promiscuous mode [ 164.361974][T10065] bond_slave_0: entered promiscuous mode [ 164.383522][T10065] bond_slave_1: entered promiscuous mode [ 164.389305][T10065] team0: entered promiscuous mode [ 164.454319][T10065] team_slave_0: entered promiscuous mode [ 164.475342][T10065] team_slave_1: entered promiscuous mode [ 164.725183][ T8193] hsr_slave_0: left promiscuous mode [ 164.731129][ T8193] hsr_slave_1: left promiscuous mode [ 164.751807][ T8193] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 164.766489][ T8193] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 164.787583][ T8193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 164.797793][ T8193] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 164.845924][ T8193] veth1_macvtap: left promiscuous mode [ 164.851639][ T8193] veth0_macvtap: left promiscuous mode [ 164.857700][ T8193] veth1_vlan: left promiscuous mode [ 164.863870][ T8193] veth0_vlan: left promiscuous mode [ 165.137550][ T5850] Bluetooth: hci0: command tx timeout [ 165.478718][ T8193] team0 (unregistering): Port device team_slave_1 removed [ 165.516721][ T8193] team0 (unregistering): Port device team_slave_0 removed [ 166.009149][T10126] sock: sock_timestamping_bind_phc: sock not bind to device [ 166.018638][T10006] chnl_net:caif_netlink_parms(): no params data found [ 166.058217][T10128] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 166.257463][T10140] netlink: 'syz.1.1232': attribute type 32 has an invalid length. [ 166.284838][T10140] __nla_validate_parse: 1 callbacks suppressed [ 166.284857][T10140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1232'. [ 166.324666][T10148] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1234'. [ 166.325973][T10147] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1234'. [ 166.367117][T10140] (unnamed net_device) (uninitialized): Setting coupled_control to off (0) [ 166.541576][T10006] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.562828][T10006] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.578687][T10006] bridge_slave_0: entered allmulticast mode [ 166.588028][T10006] bridge_slave_0: entered promiscuous mode [ 166.597116][T10161] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1238'. [ 166.620304][T10006] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.650700][T10006] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.662747][T10006] bridge_slave_1: entered allmulticast mode [ 166.669846][T10006] bridge_slave_1: entered promiscuous mode [ 166.784778][T10006] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.840842][T10006] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 166.998009][T10006] team0: Port device team_slave_0 added [ 167.031286][T10006] team0: Port device team_slave_1 added [ 167.235400][ T5850] Bluetooth: hci0: command tx timeout [ 167.375789][T10204] netlink: 80 bytes leftover after parsing attributes in process `syz.3.1243'. [ 167.459872][T10006] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 167.502491][T10006] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.560969][T10213] netlink: 176 bytes leftover after parsing attributes in process `syz.2.1248'. [ 167.569018][T10006] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 167.724276][T10006] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 167.753086][T10006] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.790776][T10006] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 167.833131][T10226] openvswitch: netlink: IP tunnel dst address not specified [ 167.921983][T10006] hsr_slave_0: entered promiscuous mode [ 167.938998][T10006] hsr_slave_1: entered promiscuous mode [ 168.113206][T10240] xt_policy: output policy not valid in PREROUTING and INPUT [ 168.327262][T10242] tap0: tun_chr_ioctl cmd 1074025677 [ 168.341866][T10242] tap0: linktype set to 778 [ 168.476004][T10258] netlink: 284 bytes leftover after parsing attributes in process `syz.2.1259'. [ 169.016747][T10006] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 169.048983][T10006] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 169.060983][T10296] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1267'. [ 169.064127][T10006] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 169.085805][T10006] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 169.292709][ T5850] Bluetooth: hci0: command tx timeout [ 169.343339][T10006] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.445459][T10006] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.489023][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.496258][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.515803][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.523016][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.687374][T10006] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 169.716587][T10320] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1273'. [ 170.133411][T10006] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.318330][T10353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1278'. [ 170.386600][T10358] geneve2: entered promiscuous mode [ 170.688021][T10369] x_tables: ip6_tables: MASQUERADE target: used from hooks INPUT, but only usable from POSTROUTING [ 170.826558][T10006] veth0_vlan: entered promiscuous mode [ 170.865037][T10006] veth1_vlan: entered promiscuous mode [ 170.889347][T10386] netlink: 'syz.1.1285': attribute type 2 has an invalid length. [ 170.957093][T10006] veth0_macvtap: entered promiscuous mode [ 170.966811][T10386] netlink: 'syz.1.1285': attribute type 9 has an invalid length. [ 170.989497][T10006] veth1_macvtap: entered promiscuous mode [ 171.077140][T10006] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.106104][T10006] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.142302][T10006] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.164894][T10006] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.230451][T10006] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 171.259228][T10397] tipc: Cannot configure node identity twice [ 171.279692][T10006] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.307259][T10006] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.327903][T10006] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 171.367382][T10006] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.377628][ T5850] Bluetooth: hci0: command tx timeout [ 171.385353][T10006] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 171.414357][T10006] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.423654][T10006] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.433299][T10006] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.442020][T10006] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 171.529170][T10419] __nla_validate_parse: 5 callbacks suppressed [ 171.529188][T10419] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1291'. [ 171.723418][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.754280][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.807912][T10433] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1296'. [ 171.849913][ T8193] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 171.870880][ T8193] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 171.984205][T10441] netlink: 'syz.0.1298': attribute type 12 has an invalid length. [ 172.246582][T10454] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 172.282098][T10457] Dead loop on virtual device ip6_vti0, fix it urgently! [ 172.327384][T10457] Dead loop on virtual device ip6_vti0, fix it urgently! [ 172.348141][T10457] Dead loop on virtual device ip6_vti0, fix it urgently! [ 172.624436][T10480] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1309'. [ 172.657822][T10480] netlink: 'syz.1.1309': attribute type 1 has an invalid length. [ 172.827382][T10480] 8021q: adding VLAN 0 to HW filter on device bond5 [ 172.899292][T10495] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1310'. [ 172.913194][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.941533][T10495] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1310'. [ 173.047015][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.284298][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.538888][T10509] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.546458][T10509] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.674195][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.832987][T10525] netlink: 'syz.3.1317': attribute type 29 has an invalid length. [ 174.199293][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 174.210183][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 174.242767][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 174.275266][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 174.283734][ T5846] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 174.292899][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 174.332997][T10559] tipc: Enabled bearer , priority 0 [ 174.369849][T10559] syzkaller0: entered promiscuous mode [ 174.421182][T10559] syzkaller0: entered allmulticast mode [ 174.477949][T10559] tipc: Resetting bearer [ 174.515795][T10559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1321'. [ 174.592238][T10559] macsec1: entered promiscuous mode [ 174.616448][T10581] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1327'. [ 174.625996][T10575] xt_CT: No such helper "pptp" [ 174.633279][T10559] macvlan1: entered promiscuous mode [ 174.648751][ T12] bridge_slave_1: left allmulticast mode [ 174.657889][ T12] bridge_slave_1: left promiscuous mode [ 174.664023][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.677771][ T12] bridge_slave_0: left allmulticast mode [ 174.684831][ T12] bridge_slave_0: left promiscuous mode [ 174.690742][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.993167][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 175.005832][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 175.017612][ T12] bond0 (unregistering): Released all slaves [ 175.112796][T10542] tipc: Resetting bearer [ 175.178842][T10542] tipc: Disabling bearer [ 175.434549][T10601] netlink: 71 bytes leftover after parsing attributes in process `syz.0.1331'. [ 175.746770][T10620] netlink: 39 bytes leftover after parsing attributes in process `syz.2.1333'. [ 175.770237][T10619] macvlan2: entered allmulticast mode [ 175.780638][T10619] veth1_vlan: entered allmulticast mode [ 175.788463][T10619] veth1_vlan: left allmulticast mode [ 175.953164][ T12] hsr_slave_0: left promiscuous mode [ 175.967830][ T12] hsr_slave_1: left promiscuous mode [ 175.983031][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 175.990448][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 176.002905][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 176.011363][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 176.037786][ T12] veth1_macvtap: left promiscuous mode [ 176.043544][ T12] veth0_macvtap: left promiscuous mode [ 176.049172][ T12] veth1_vlan: left promiscuous mode [ 176.055660][ T12] veth0_vlan: left promiscuous mode [ 176.333915][ T5846] Bluetooth: hci0: command tx timeout [ 176.419384][ T12] team0 (unregistering): Port device team_slave_1 removed [ 176.457765][ T12] team0 (unregistering): Port device team_slave_0 removed [ 176.827978][T10632] netlink: 'syz.0.1338': attribute type 5 has an invalid length. [ 176.939264][T10556] chnl_net:caif_netlink_parms(): no params data found [ 177.463861][T10556] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.501253][T10556] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.543384][T10556] bridge_slave_0: entered allmulticast mode [ 177.566662][T10556] bridge_slave_0: entered promiscuous mode [ 177.581235][T10679] veth0_to_bridge: entered allmulticast mode [ 177.641780][T10556] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.668570][T10556] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.691985][T10556] bridge_slave_1: entered allmulticast mode [ 177.728446][T10556] bridge_slave_1: entered promiscuous mode [ 177.750034][T10693] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 177.919595][T10556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 177.972309][T10556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 178.123734][ T25] IPVS: starting estimator thread 0... [ 178.214505][T10714] IPVS: using max 19 ests per chain, 45600 per kthread [ 178.231952][T10556] team0: Port device team_slave_0 added [ 178.250171][T10556] team0: Port device team_slave_1 added [ 178.258455][T10715] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1355'. [ 178.412631][ T5846] Bluetooth: hci0: command tx timeout [ 178.503219][T10556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 178.510428][T10556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.537438][T10556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 178.553774][T10556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 178.560922][T10556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.599701][T10556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.609950][T10729] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1360'. [ 178.786399][T10556] hsr_slave_0: entered promiscuous mode [ 178.813525][T10556] hsr_slave_1: entered promiscuous mode [ 178.900907][T10742] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1364'. [ 178.969215][T10747] netlink: 23 bytes leftover after parsing attributes in process `syz.3.1364'. [ 178.985255][T10747] netlink: 23 bytes leftover after parsing attributes in process `syz.3.1364'. [ 179.103585][T10752] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1366'. [ 179.219957][T10755] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1367'. [ 179.759109][T10792] netlink: 'syz.0.1377': attribute type 4 has an invalid length. [ 179.814128][T10792] netlink: 'syz.0.1377': attribute type 5 has an invalid length. [ 179.931009][T10556] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 179.970917][T10556] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 179.997932][T10556] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 180.031304][T10556] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 180.065670][T10802] xt_CONNSECMARK: invalid mode: 0 [ 180.194162][T10556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.266137][T10556] 8021q: adding VLAN 0 to HW filter on device team0 [ 180.287204][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.294386][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.358416][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.365586][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.440781][T10556] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 180.493360][ T5846] Bluetooth: hci0: command tx timeout [ 180.526312][T10827] netlink: 'syz.2.1386': attribute type 1 has an invalid length. [ 180.534638][T10827] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1386'. [ 180.782347][T10839] unknown channel width for channel at 909000KHz? [ 180.802207][T10839] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1388'. [ 180.845049][T10556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 181.060667][T10849] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1389'. [ 181.182734][T10856] xt_CT: You must specify a L4 protocol and not use inversions on it [ 181.568472][T10556] veth0_vlan: entered promiscuous mode [ 181.589205][T10556] veth1_vlan: entered promiscuous mode [ 181.666570][T10556] veth0_macvtap: entered promiscuous mode [ 181.708762][T10556] veth1_macvtap: entered promiscuous mode [ 181.731168][T10893] netlink: 'syz.3.1399': attribute type 25 has an invalid length. [ 181.768681][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.813234][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.842262][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.867297][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.887884][T10556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 181.915396][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 181.934375][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.948936][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 181.959569][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.976608][T10556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 181.987584][T10903] netlink: 'syz.3.1401': attribute type 12 has an invalid length. [ 182.017651][T10556] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.048944][T10556] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.071471][T10556] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.097878][T10556] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.311907][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 182.337144][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 182.381122][ T8193] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 182.389509][ T8193] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 182.573217][ T5846] Bluetooth: hci0: command tx timeout [ 182.858713][T10950] sctp: [Deprecated]: syz.2.1407 (pid 10950) Use of struct sctp_assoc_value in delayed_ack socket option. [ 182.858713][T10950] Use struct sctp_sack_info instead [ 183.393347][T10978] __nla_validate_parse: 6 callbacks suppressed [ 183.393367][T10978] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1417'. [ 183.417767][T10980] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1418'. [ 183.431625][T10980] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1418'. [ 183.434554][T10978] vlan3: entered allmulticast mode [ 183.466370][T10980] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1418'. [ 183.476878][T10980] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1418'. [ 183.624923][T10986] netlink: 'syz.0.1421': attribute type 32 has an invalid length. [ 183.639121][T10986] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1421'. [ 183.661459][T10985] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 183.670133][T10985] team0: Device ipvlan2 is already an upper device of the team interface [ 183.902065][ T8200] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.288943][ T8200] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.347066][ T8200] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.453289][T11012] sctp: [Deprecated]: syz.1.1424 (pid 11012) Use of int in max_burst socket option. [ 184.453289][T11012] Use struct sctp_assoc_value instead [ 184.504351][ T8200] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.785291][T11023] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1428'. [ 184.876439][ T8200] bridge_slave_1: left allmulticast mode [ 184.902702][ T8200] bridge_slave_1: left promiscuous mode [ 184.918748][ T8200] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.943280][T11031] netlink: 120 bytes leftover after parsing attributes in process `syz.2.1433'. [ 184.965112][ T8200] bridge_slave_0: left allmulticast mode [ 184.984202][ T8200] bridge_slave_0: left promiscuous mode [ 184.990057][ T8200] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.163253][ T5850] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 185.175553][ T5850] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 185.183903][ T5850] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 185.195714][ T5850] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 185.204143][ T5850] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 185.211590][ T5850] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 185.381384][T11047] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1436'. [ 185.662614][ T8200] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 185.677097][ T8200] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 185.688079][ T8200] bond0 (unregistering): Released all slaves [ 186.289738][T11072] can: request_module (can-proto-5) failed. [ 186.802888][ T8200] hsr_slave_0: left promiscuous mode [ 186.824530][ T8200] hsr_slave_1: left promiscuous mode [ 186.830458][ T8200] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.868391][ T8200] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 186.903490][ T8200] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.912582][ T8200] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 186.982829][ T8200] veth1_macvtap: left promiscuous mode [ 186.997163][ T8200] veth0_macvtap: left promiscuous mode [ 187.010471][ T8200] veth1_vlan: left promiscuous mode [ 187.020703][ T8200] veth0_vlan: left promiscuous mode [ 187.296752][ T5850] Bluetooth: hci0: command tx timeout [ 187.449083][ T8200] team0 (unregistering): Port device team_slave_1 removed [ 187.487337][ T8200] team0 (unregistering): Port device team_slave_0 removed [ 187.836283][T11118] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 187.894300][T11041] chnl_net:caif_netlink_parms(): no params data found [ 188.204329][T11041] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.211495][T11041] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.255761][T11041] bridge_slave_0: entered allmulticast mode [ 188.301095][T11041] bridge_slave_0: entered promiscuous mode [ 188.359788][T11041] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.377465][T11041] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.398620][T11041] bridge_slave_1: entered allmulticast mode [ 188.409364][T11041] bridge_slave_1: entered promiscuous mode [ 188.553840][T11041] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.607842][T11041] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.701530][T11041] team0: Port device team_slave_0 added [ 188.732243][T11041] team0: Port device team_slave_1 added [ 188.828763][T11041] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 188.849266][T11041] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 188.898271][T11041] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 188.931912][T11041] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 188.949582][T11041] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 188.981329][T11041] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 189.177083][T11041] hsr_slave_0: entered promiscuous mode [ 189.198175][T11041] hsr_slave_1: entered promiscuous mode [ 189.372617][ T5843] Bluetooth: hci0: command tx timeout [ 189.555770][T11212] team0 (unregistering): Port device team_slave_0 removed [ 189.563172][T11221] netlink: 'syz.2.1474': attribute type 3 has an invalid length. [ 189.587769][T11225] netlink: 'syz.2.1474': attribute type 3 has an invalid length. [ 189.612147][T11212] team0 (unregistering): Port device team_slave_1 removed [ 189.992102][T11240] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1478'. [ 190.043306][T11242] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1479'. [ 190.130386][T11248] sock: sock_timestamping_bind_phc: sock not bind to device [ 190.390058][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1485'. [ 190.474964][T11261] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1486'. [ 190.873852][T11281] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1491'. [ 190.947380][T11041] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 191.080586][T11041] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 191.130322][T11041] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 191.130973][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.160902][T11303] netlink: 'syz.3.1495': attribute type 8 has an invalid length. [ 191.193502][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.193750][T11041] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 191.244698][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.278138][T11290] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 191.301917][ T5843] Bluetooth: hci2: command 0x0406 tx timeout [ 191.308258][ T5843] Bluetooth: hci1: command 0x0406 tx timeout [ 191.356523][T11290] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 191.387083][T11307] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1496'. [ 191.450909][T11041] 8021q: adding VLAN 0 to HW filter on device bond0 [ 191.452616][ T5850] Bluetooth: hci0: command tx timeout [ 191.552884][T11041] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.562137][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.597472][ T8200] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.604746][ T8200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.618854][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.640933][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.642167][ T8200] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.654141][ T8200] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.671738][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 191.717776][T11290] xfrm0 speed is unknown, defaulting to 1000 [ 192.100794][T11041] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 192.219089][T11337] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1505'. [ 192.271071][T11343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1506'. [ 192.355568][T11346] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1505'. [ 192.501536][T11358] sctp: [Deprecated]: syz.1.1508 (pid 11358) Use of int in maxseg socket option. [ 192.501536][T11358] Use struct sctp_assoc_value instead [ 192.686790][T11361] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1509'. [ 192.943200][T11041] veth0_vlan: entered promiscuous mode [ 193.000488][T11041] veth1_vlan: entered promiscuous mode [ 193.121009][T11041] veth0_macvtap: entered promiscuous mode [ 193.167843][T11041] veth1_macvtap: entered promiscuous mode [ 193.197258][T11390] sctp: [Deprecated]: syz.0.1514 (pid 11390) Use of struct sctp_assoc_value in delayed_ack socket option. [ 193.197258][T11390] Use struct sctp_sack_info instead [ 193.220120][T11041] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 193.231443][T11041] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 193.272225][T11041] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 193.292524][T11041] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 193.331540][T11041] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 193.494622][T11041] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 193.532858][ T5850] Bluetooth: hci0: command tx timeout [ 193.562382][T11041] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 193.582078][T11041] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 193.609261][T11041] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 193.621240][T11041] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 193.679478][T11041] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.703493][T11041] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.744904][T11041] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.771457][T11041] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.978818][T10999] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.999844][T10999] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.067630][T11002] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 194.090799][T11002] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.309890][T11437] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 194.350573][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.596174][T11457] openvswitch: netlink: nsh attribute has 65504 unknown bytes. [ 194.625384][T11457] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 194.917691][T10999] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.059252][T11477] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 195.144133][T10999] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.396564][T10999] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.474273][T10999] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.595683][T10999] bridge_slave_1: left allmulticast mode [ 195.601879][T10999] bridge_slave_1: left promiscuous mode [ 195.608490][T10999] bridge0: port 2(bridge_slave_1) entered disabled state [ 195.631936][T10999] bridge_slave_0: left allmulticast mode [ 195.639552][T10999] bridge_slave_0: left promiscuous mode [ 195.646014][T10999] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.993665][T11512] netlink: 'syz.2.1536': attribute type 1 has an invalid length. [ 196.002364][T11510] __nla_validate_parse: 8 callbacks suppressed [ 196.002382][T11510] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1537'. [ 196.068663][T11510] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1537'. [ 196.354762][T10999] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 196.377692][T10999] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 196.388749][T10999] bond0 (unregistering): Released all slaves [ 196.416825][ T5850] Bluetooth: hci3: command 0x0406 tx timeout [ 196.429217][T11512] xfrm0 speed is unknown, defaulting to 1000 [ 196.458425][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 196.478673][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 196.502862][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 196.503582][T11505] netlink: 'syz.2.1536': attribute type 1 has an invalid length. [ 196.522600][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 196.532672][ T5846] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 196.543052][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 196.588324][T11529] xfrm0 speed is unknown, defaulting to 1000 [ 196.947994][T11549] syzkaller0: entered allmulticast mode [ 197.209443][T11563] netlink: 'syz.0.1547': attribute type 1 has an invalid length. [ 197.248068][T11563] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1547'. [ 197.268633][T10999] hsr_slave_0: left promiscuous mode [ 197.292228][T10999] hsr_slave_1: left promiscuous mode [ 197.312366][T10999] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 197.339483][T10999] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 197.351132][T10999] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 197.365653][T11572] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1549'. [ 197.367634][T10999] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 197.565974][T10999] veth1_macvtap: left promiscuous mode [ 197.571547][T10999] veth0_macvtap: left promiscuous mode [ 197.577510][T10999] veth1_vlan: left promiscuous mode [ 197.583671][T10999] veth0_vlan: left promiscuous mode [ 197.980306][T10999] team0 (unregistering): Port device team_slave_1 removed [ 198.044684][T10999] team0 (unregistering): Port device team_slave_0 removed [ 198.572581][ T5846] Bluetooth: hci0: command tx timeout [ 198.696648][T11529] chnl_net:caif_netlink_parms(): no params data found [ 198.767745][T11600] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1559'. [ 198.808222][T11601] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1557'. [ 199.071477][T11529] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.089457][T11529] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.098625][T11619] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1560'. [ 199.119412][T11529] bridge_slave_0: entered allmulticast mode [ 199.127465][T11529] bridge_slave_0: entered promiscuous mode [ 199.153302][T11529] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.174298][T11529] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.189223][T11529] bridge_slave_1: entered allmulticast mode [ 199.196752][T11529] bridge_slave_1: entered promiscuous mode [ 199.305016][T11529] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.342163][T11529] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.436656][T11529] team0: Port device team_slave_0 added [ 199.446403][T11529] team0: Port device team_slave_1 added [ 199.542967][T11529] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 199.550004][T11529] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 199.630400][T11529] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 199.658271][T11529] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 199.666089][T11529] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 199.692509][T11529] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 199.715634][T11652] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1567'. [ 199.724687][T11652] nbd: must specify at least one socket [ 199.851180][T11656] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1569'. [ 199.886341][T11529] hsr_slave_0: entered promiscuous mode [ 199.900678][T11529] hsr_slave_1: entered promiscuous mode [ 200.168714][T11674] netlink: 'syz.2.1571': attribute type 15 has an invalid length. [ 200.513991][T11689] team0: Mode changed to "activebackup" [ 200.572092][T11695] FAULT_INJECTION: forcing a failure. [ 200.572092][T11695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 200.657240][ T5846] Bluetooth: hci0: command tx timeout [ 200.664425][T11695] CPU: 1 UID: 0 PID: 11695 Comm: syz.3.1579 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 200.664453][T11695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 200.664466][T11695] Call Trace: [ 200.664473][T11695] [ 200.664481][T11695] dump_stack_lvl+0x241/0x360 [ 200.664512][T11695] ? __pfx_dump_stack_lvl+0x10/0x10 [ 200.664536][T11695] ? __pfx__printk+0x10/0x10 [ 200.664558][T11695] ? __pfx_lock_release+0x10/0x10 [ 200.664593][T11695] should_fail_ex+0x40a/0x550 [ 200.664619][T11695] _copy_from_user+0x2d/0xb0 [ 200.664640][T11695] copy_msghdr_from_user+0xae/0x680 [ 200.664659][T11695] ? __pfx___might_resched+0x10/0x10 [ 200.664683][T11695] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 200.664706][T11695] ? do_recvmmsg+0x44e/0xab0 [ 200.664741][T11695] ? __might_fault+0xaa/0x120 [ 200.664771][T11695] do_recvmmsg+0x3bd/0xab0 [ 200.664805][T11695] ? __pfx_do_recvmmsg+0x10/0x10 [ 200.664846][T11695] ? ksys_write+0x22a/0x2b0 [ 200.664873][T11695] ? __pfx_lock_release+0x10/0x10 [ 200.664901][T11695] ? sb_end_write+0xe9/0x1c0 [ 200.664936][T11695] ? vfs_write+0x7fa/0xd10 [ 200.664952][T11695] ? __mutex_unlock_slowpath+0x227/0x800 [ 200.664979][T11695] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 200.664997][T11695] ? __fget_files+0x2a/0x410 [ 200.665028][T11695] __x64_sys_recvmmsg+0x199/0x250 [ 200.665053][T11695] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 200.665077][T11695] ? do_syscall_64+0x100/0x230 [ 200.665098][T11695] ? do_syscall_64+0xb6/0x230 [ 200.665136][T11695] do_syscall_64+0xf3/0x230 [ 200.665163][T11695] ? clear_bhb_loop+0x35/0x90 [ 200.665189][T11695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.665210][T11695] RIP: 0033:0x7f23b9d8cde9 [ 200.665231][T11695] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 200.665245][T11695] RSP: 002b:00007f23bac07038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 200.665266][T11695] RAX: ffffffffffffffda RBX: 00007f23b9fa5fa0 RCX: 00007f23b9d8cde9 [ 200.665278][T11695] RDX: 0000000000000002 RSI: 0000400000000540 RDI: 0000000000000004 [ 200.665288][T11695] RBP: 00007f23bac07090 R08: 0000000000000000 R09: 0000000000000000 [ 200.665298][T11695] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 200.665308][T11695] R13: 0000000000000000 R14: 00007f23b9fa5fa0 R15: 00007ffeea7d2d88 [ 200.665331][T11695] [ 201.143558][T11705] geneve3: entered promiscuous mode [ 201.159437][T11705] geneve3: entered allmulticast mode [ 201.222102][T11721] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1584'. [ 201.431502][T11731] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1587'. [ 201.441352][T11529] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 201.473093][T11529] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 201.485491][T11529] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 201.492767][T11731] netlink: 'syz.3.1587': attribute type 10 has an invalid length. [ 201.510047][T11529] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 201.554320][T11733] netlink: 'syz.2.1586': attribute type 1 has an invalid length. [ 201.704516][T11529] 8021q: adding VLAN 0 to HW filter on device bond0 [ 201.747383][T11529] 8021q: adding VLAN 0 to HW filter on device team0 [ 201.777548][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.784772][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.848079][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.855296][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.875178][T11743] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1590'. [ 202.360849][T11529] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 202.732756][ T5846] Bluetooth: hci0: command tx timeout [ 202.860531][T11529] veth0_vlan: entered promiscuous mode [ 202.897941][T11529] veth1_vlan: entered promiscuous mode [ 202.960187][T11529] veth0_macvtap: entered promiscuous mode [ 202.987436][T11529] veth1_macvtap: entered promiscuous mode [ 203.118246][T11529] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.181601][T11529] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.213544][T11529] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.252588][T11529] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.280859][T11529] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.300425][T11809] sctp: [Deprecated]: syz.1.1601 (pid 11809) Use of struct sctp_assoc_value in delayed_ack socket option. [ 203.300425][T11809] Use struct sctp_sack_info instead [ 203.321533][T11797] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1600'. [ 203.498773][T11815] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1603'. [ 203.534240][T11529] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.569042][T11529] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.599626][T11529] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.625898][T11529] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.649356][T11529] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 203.709846][T11529] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.752789][T11529] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.761568][T11529] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.793618][T11529] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.827591][T11819] wireguard: wg1: Could not create IPv4 socket [ 204.166317][ T8200] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 204.209967][ T8200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 204.263253][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 204.289581][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 204.315624][T11845] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1610'. [ 204.339702][T11848] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1610'. [ 204.376243][T11845] tc_dump_action: action bad kind [ 204.438928][T11855] netlink: 'syz.0.1613': attribute type 3 has an invalid length. [ 204.455661][T11855] netlink: 208 bytes leftover after parsing attributes in process `syz.0.1613'. [ 204.466457][T11855] openvswitch: netlink: Flow key attr not present in new flow. [ 204.548075][T11857] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1614'. [ 204.803207][T11865] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1615'. [ 204.825967][T11866] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 205.083954][T11876] xt_CT: You must specify a L4 protocol and not use inversions on it [ 205.135715][T11001] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.294978][T11001] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.446747][T11001] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.514846][T11001] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.634879][T11001] bridge_slave_1: left allmulticast mode [ 205.640698][T11001] bridge_slave_1: left promiscuous mode [ 205.647094][T11001] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.657403][T11001] bridge_slave_0: left allmulticast mode [ 205.663681][T11001] bridge_slave_0: left promiscuous mode [ 205.669343][T11001] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.948149][T11001] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 205.959124][T11001] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 205.969284][T11001] bond0 (unregistering): Released all slaves [ 206.290008][T11891] __nla_validate_parse: 1 callbacks suppressed [ 206.290028][T11891] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1626'. [ 206.552165][T11906] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1630'. [ 206.618320][T11915] netdevsim netdevsim1 netdevsim1: Unsupported IPsec algorithm [ 206.638463][T11915] netlink: 'syz.1.1629': attribute type 15 has an invalid length. [ 206.654818][T11915] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1629'. [ 206.818348][ T5850] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 206.827932][ T5850] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 206.836338][ T5850] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 206.845097][ T5850] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 206.853096][ T5850] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 206.860388][ T5850] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 206.874453][T11001] hsr_slave_0: left promiscuous mode [ 206.927056][T11001] hsr_slave_1: left promiscuous mode [ 206.950361][T11001] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 206.968415][T11001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 206.996371][T11001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 207.027921][T11001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 207.088238][T11001] veth1_macvtap: left promiscuous mode [ 207.094138][T11001] veth0_macvtap: left promiscuous mode [ 207.099770][T11001] veth1_vlan: left promiscuous mode [ 207.109900][T11001] veth0_vlan: left promiscuous mode [ 207.424345][T11953] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1637'. [ 207.660243][T11001] team0 (unregistering): Port device team_slave_1 removed [ 207.698423][T11001] team0 (unregistering): Port device team_slave_0 removed [ 208.154777][T11955] pim6reg: entered allmulticast mode [ 208.165098][T11922] xfrm0 speed is unknown, defaulting to 1000 [ 208.674818][T11981] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1645'. [ 208.770315][T11922] chnl_net:caif_netlink_parms(): no params data found [ 208.891553][ T978] IPVS: starting estimator thread 0... [ 208.905856][ T5850] Bluetooth: hci0: command tx timeout [ 208.922033][T12002] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1649'. [ 208.945436][T11999] IPv6: sit2: Disabled Multicast RS [ 209.002664][T12001] IPVS: using max 19 ests per chain, 45600 per kthread [ 209.133486][T11922] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.155546][T11922] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.186539][T11922] bridge_slave_0: entered allmulticast mode [ 209.209845][T11922] bridge_slave_0: entered promiscuous mode [ 209.272908][T11922] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.290701][T11922] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.329487][T12022] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1653'. [ 209.333035][T11922] bridge_slave_1: entered allmulticast mode [ 209.365593][T11922] bridge_slave_1: entered promiscuous mode [ 209.456013][T11922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 209.491296][T11922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 209.614078][T11922] team0: Port device team_slave_0 added [ 209.651788][T11922] team0: Port device team_slave_1 added [ 209.902921][T11922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 209.924337][T11922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 209.989794][T11922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 210.020558][T11922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 210.040003][T11922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 210.125583][T11922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 210.180788][T12069] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1661'. [ 210.205393][T11922] hsr_slave_0: entered promiscuous mode [ 210.211754][T11922] hsr_slave_1: entered promiscuous mode [ 210.542006][T12082] delete_channel: no stack [ 210.582191][T12082] netlink: 'syz.1.1665': attribute type 1 has an invalid length. [ 210.761856][T12090] netlink: 'syz.3.1667': attribute type 2 has an invalid length. [ 210.986832][ T5850] Bluetooth: hci0: command tx timeout [ 211.156967][T12115] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1671'. [ 211.682810][T11922] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 211.713742][T11922] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 211.725775][T12147] netlink: 'syz.1.1680': attribute type 2 has an invalid length. [ 211.743614][T11922] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 211.778151][T11922] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 211.997107][T11922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 212.040525][T11922] 8021q: adding VLAN 0 to HW filter on device team0 [ 212.066370][T10999] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.073668][T10999] bridge0: port 1(bridge_slave_0) entered forwarding state [ 212.100918][T10998] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.108127][T10998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 212.640782][T11922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 213.054227][ T5850] Bluetooth: hci0: command tx timeout [ 213.304053][T12236] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1691'. [ 213.514379][T11922] veth0_vlan: entered promiscuous mode [ 213.568794][T11922] veth1_vlan: entered promiscuous mode [ 213.650018][T11922] veth0_macvtap: entered promiscuous mode [ 213.694485][T12254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1696'. [ 213.705326][T11922] veth1_macvtap: entered promiscuous mode [ 213.774717][T11922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 213.852188][T11922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.891726][T11922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 213.919645][T11922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 213.961790][T11922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 213.995179][T11922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 214.045854][T11922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.064817][T11922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 214.083974][T11922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.103620][T11922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 214.122862][T12264] netlink: 'syz.0.1697': attribute type 12 has an invalid length. [ 214.163622][T11922] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.208006][T11922] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.237305][T11922] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.291050][T11922] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.334873][T12290] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1701'. [ 214.514748][T12301] netlink: 'syz.2.1704': attribute type 10 has an invalid length. [ 214.525316][T12301] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1704'. [ 214.543339][T12275] delete_channel: no stack [ 214.619805][T12301] team0: Port device geneve0 added [ 214.824840][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 214.876151][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 214.923043][T12314] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1709'. [ 214.948426][T12315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1708'. [ 214.965745][T12314] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 214.984176][ T8200] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 215.007151][ T8200] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 215.134803][ T5850] Bluetooth: hci0: command tx timeout [ 215.209020][T12329] veth0: entered promiscuous mode [ 215.219372][T12329] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1713'. [ 215.346618][T12328] veth0: left promiscuous mode [ 215.406576][T12337] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1715'. [ 215.777747][T10999] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.960339][T10999] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.263381][T10999] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.446098][T10999] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.591853][T10999] bridge_slave_1: left allmulticast mode [ 216.610716][T10999] bridge_slave_1: left promiscuous mode [ 216.619648][T10999] bridge0: port 2(bridge_slave_1) entered disabled state [ 216.647799][T10999] bridge_slave_0: left allmulticast mode [ 216.654117][T10999] bridge_slave_0: left promiscuous mode [ 216.659894][T10999] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.395517][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 217.424878][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 217.441485][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 217.451775][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 217.459823][ T5846] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 217.460438][T10999] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 217.475984][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 217.491653][T10999] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 217.507588][T10999] bond0 (unregistering): Released all slaves [ 217.604784][T12417] xfrm0 speed is unknown, defaulting to 1000 [ 217.893541][T12429] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1728'. [ 217.953170][T12446] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 217.963590][T12429] netdevsim netdevsim1: Direct firmware load for . [ 217.963590][T12429] failed with error -2 [ 218.013985][T12429] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 218.013985][T12429] [ 218.082843][T12455] Bluetooth: MGMT ver 1.23 [ 218.410718][T10999] hsr_slave_0: left promiscuous mode [ 218.449923][T10999] hsr_slave_1: left promiscuous mode [ 218.461931][T10999] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.498213][T10999] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.517085][T10999] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.532590][T10999] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.608105][T10999] veth1_macvtap: left promiscuous mode [ 218.624256][T10999] veth0_macvtap: left promiscuous mode [ 218.639208][T10999] veth1_vlan: left promiscuous mode [ 218.670650][T10999] veth0_vlan: left promiscuous mode [ 218.785822][T12488] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1741'. [ 218.816714][T12497] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1740'. [ 219.205493][T10999] team0 (unregistering): Port device team_slave_1 removed [ 219.244527][T10999] team0 (unregistering): Port device team_slave_0 removed [ 219.533309][ T5846] Bluetooth: hci0: command tx timeout [ 219.621798][T12483] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 219.647951][T12483] mac80211_hwsim hwsim11 wlan1: left allmulticast mode [ 219.685304][T12490] bridge0: port 3(ipvlan3) entered blocking state [ 219.699740][T12490] bridge0: port 3(ipvlan3) entered disabled state [ 219.716778][T12490] ipvlan3: entered allmulticast mode [ 219.722161][T12490] bridge0: entered allmulticast mode [ 219.730140][T12490] ipvlan3: left allmulticast mode [ 219.735691][T12490] bridge0: left allmulticast mode [ 219.745490][T12491] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1741'. [ 219.772312][T12417] chnl_net:caif_netlink_parms(): no params data found [ 219.832126][T12502] ip6gre1: entered allmulticast mode [ 220.200112][T12518] netlink: 'syz.3.1748': attribute type 12 has an invalid length. [ 220.227577][T12526] openvswitch: netlink: Key type 31 is not supported [ 220.235296][T12518] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1748'. [ 220.539073][T12417] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.557322][T12417] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.593996][T12417] bridge_slave_0: entered allmulticast mode [ 220.608945][T12417] bridge_slave_0: entered promiscuous mode [ 220.646262][T12417] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.695349][T12417] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.724982][T12417] bridge_slave_1: entered allmulticast mode [ 220.743431][T12417] bridge_slave_1: entered promiscuous mode [ 220.866453][T12417] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 220.886331][T12417] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 221.034482][T12417] team0: Port device team_slave_0 added [ 221.076191][T12417] team0: Port device team_slave_1 added [ 221.184028][T12417] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 221.206598][T12417] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 221.274485][T12417] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 221.310926][T12417] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 221.320615][T12417] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 221.365372][T12579] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1765'. [ 221.443293][T12417] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 221.554051][T12598] netlink: del zone limit has 4 unknown bytes [ 221.574716][T12597] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1767'. [ 221.604846][T12597] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1767'. [ 221.613392][ T5846] Bluetooth: hci0: command tx timeout [ 221.686623][T12417] hsr_slave_0: entered promiscuous mode [ 221.703431][T12417] hsr_slave_1: entered promiscuous mode [ 221.932148][T12619] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1770'. [ 222.679270][T12653] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1780'. [ 222.704018][T12652] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1779'. [ 222.718510][T12655] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 222.727739][T12657] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 222.935688][T12667] netlink: 'syz.0.1783': attribute type 6 has an invalid length. [ 223.151808][T12682] netlink: 'syz.2.1788': attribute type 2 has an invalid length. [ 223.181493][T12417] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 223.207946][T12417] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 223.258943][T12417] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 223.296148][T12417] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 223.441802][T12417] 8021q: adding VLAN 0 to HW filter on device bond0 [ 223.501671][T12417] 8021q: adding VLAN 0 to HW filter on device team0 [ 223.537832][T10997] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.545063][T10997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 223.637112][T10997] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.644315][T10997] bridge0: port 2(bridge_slave_1) entered forwarding state [ 223.697551][ T5846] Bluetooth: hci0: command tx timeout [ 223.849749][T12710] netlink: 'syz.3.1795': attribute type 10 has an invalid length. [ 223.916788][T12714] netlink: 'syz.3.1795': attribute type 10 has an invalid length. [ 224.165839][T12417] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 224.219147][T12732] IPv6: NLM_F_CREATE should be specified when creating new route [ 224.245928][T12734] openvswitch: netlink: Missing valid actions attribute. [ 224.253624][T12734] openvswitch: netlink: Actions may not be safe on all matching packets [ 224.719015][T12757] __nla_validate_parse: 1 callbacks suppressed [ 224.719037][T12757] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1805'. [ 224.838235][T12417] veth0_vlan: entered promiscuous mode [ 224.901501][T12417] veth1_vlan: entered promiscuous mode [ 224.960728][T12417] veth0_macvtap: entered promiscuous mode [ 224.990907][T12417] veth1_macvtap: entered promiscuous mode [ 225.046676][T12417] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 225.076390][T12417] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 225.097239][T12776] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 225.120043][T12417] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 225.178422][T12417] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 225.200957][T12417] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 225.281348][T12417] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 225.292164][T12417] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 225.312617][T12417] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 225.342495][T12417] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 225.364407][T12417] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 225.393602][T12417] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.408379][T12417] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.437779][T12417] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.464492][T12417] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.739237][T11001] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 225.754566][T11001] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 225.772895][ T5846] Bluetooth: hci0: command tx timeout [ 225.849099][T12823] netlink: 'syz.1.1818': attribute type 11 has an invalid length. [ 225.880427][ T8200] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 225.916858][ T8200] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 226.194127][T12846] ------------[ cut here ]------------ [ 226.199861][T12846] WARNING: CPU: 0 PID: 12846 at kernel/workqueue.c:2257 __queue_work+0xcd3/0xf50 [ 226.209034][T12846] Modules linked in: [ 226.212940][T12846] CPU: 0 UID: 0 PID: 12846 Comm: syz.3.1821 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 226.223707][T12846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 226.233796][T12846] RIP: 0010:__queue_work+0xcd3/0xf50 [ 226.239106][T12846] Code: ff e8 d1 ad 38 00 90 0f 0b 90 e9 b2 fe ff ff e8 c3 ad 38 00 eb 13 e8 bc ad 38 00 eb 0c e8 b5 ad 38 00 eb 05 e8 ae ad 38 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc [ 226.258731][T12846] RSP: 0018:ffffc90004effca8 EFLAGS: 00010087 [ 226.264812][T12846] RAX: ffffffff818909a4 RBX: ffff88807b9b5a00 RCX: 0000000000080000 [ 226.272789][T12846] RDX: ffffc9000f38a000 RSI: 000000000000006b RDI: 000000000000006c [ 226.280760][T12846] RBP: 0000000000000000 R08: ffffffff8188fe04 R09: 0000000000000000 [ 226.288761][T12846] R10: ffffc90004effd80 R11: fffff520009dffb1 R12: ffff8880286f1000 [ 226.296745][T12846] R13: ffff8880286f11c0 R14: dffffc0000000000 R15: 0000000000000008 [ 226.304724][T12846] FS: 00007f23babe66c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 226.313661][T12846] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 226.320242][T12846] CR2: 0000400000000040 CR3: 000000006c490000 CR4: 00000000003526f0 [ 226.328221][T12846] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 226.336194][T12846] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 226.344168][T12846] Call Trace: [ 226.347448][T12846] [ 226.350377][T12846] ? __warn+0x165/0x4d0 [ 226.354543][T12846] ? __queue_work+0xcd3/0xf50 [ 226.359327][T12846] ? report_bug+0x2b3/0x500 [ 226.363839][T12846] ? __queue_work+0xcd3/0xf50 [ 226.368525][T12846] ? handle_bug+0x60/0x90 [ 226.372858][T12846] ? exc_invalid_op+0x1a/0x50 [ 226.377560][T12846] ? asm_exc_invalid_op+0x1a/0x20 [ 226.382685][T12846] ? __queue_work+0x124/0xf50 [ 226.387362][T12846] ? __queue_work+0xcc4/0xf50 [ 226.392049][T12846] ? __queue_work+0xcd3/0xf50 [ 226.396731][T12846] ? __queue_work+0xcc4/0xf50 [ 226.401415][T12846] ? __queue_delayed_work+0xeb/0x300 [ 226.406706][T12846] ? queue_delayed_work_on+0x1b4/0x390 [ 226.412166][T12846] queue_delayed_work_on+0x1ca/0x390 [ 226.417463][T12846] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 226.423280][T12846] ? do_raw_spin_lock+0x14f/0x370 [ 226.428318][T12846] ? __pfx_lock_release+0x10/0x10 [ 226.433357][T12846] ? hci_conn_drop+0x152/0x280 [ 226.438144][T12846] sco_conn_put+0x145/0x210 [ 226.442653][T12846] sco_chan_del+0xa3/0x180 [ 226.447072][T12846] sco_sock_shutdown+0x164/0x3f0 [ 226.452014][T12846] __x64_sys_shutdown+0x13f/0x1a0 [ 226.457096][T12846] do_syscall_64+0xf3/0x230 [ 226.461694][T12846] ? clear_bhb_loop+0x35/0x90 [ 226.466397][T12846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.472297][T12846] RIP: 0033:0x7f23b9d8cde9 [ 226.476712][T12846] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 226.496335][T12846] RSP: 002b:00007f23babe6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000030 [ 226.504756][T12846] RAX: ffffffffffffffda RBX: 00007f23b9fa6080 RCX: 00007f23b9d8cde9 [ 226.512734][T12846] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 226.520699][T12846] RBP: 00007f23b9e0e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 226.528672][T12846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 226.536644][T12846] R13: 0000000000000000 R14: 00007f23b9fa6080 R15: 00007ffeea7d2d88 [ 226.544637][T12846] [ 226.547674][T12846] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 226.554966][T12846] CPU: 0 UID: 0 PID: 12846 Comm: syz.3.1821 Not tainted 6.14.0-rc2-syzkaller-00175-ga92c32287664 #0 [ 226.565725][T12846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 226.575779][T12846] Call Trace: [ 226.579055][T12846] [ 226.582004][T12846] dump_stack_lvl+0x241/0x360 [ 226.586693][T12846] ? __pfx_dump_stack_lvl+0x10/0x10 [ 226.591977][T12846] ? __pfx__printk+0x10/0x10 [ 226.596571][T12846] ? _printk+0xd5/0x120 [ 226.600732][T12846] ? __init_begin+0x41000/0x41000 [ 226.605786][T12846] ? vscnprintf+0x5d/0x90 [ 226.610130][T12846] panic+0x349/0x880 [ 226.614051][T12846] ? __warn+0x174/0x4d0 [ 226.618219][T12846] ? __pfx_panic+0x10/0x10 [ 226.622648][T12846] __warn+0x344/0x4d0 [ 226.626653][T12846] ? __queue_work+0xcd3/0xf50 [ 226.631365][T12846] report_bug+0x2b3/0x500 [ 226.635715][T12846] ? __queue_work+0xcd3/0xf50 [ 226.640412][T12846] handle_bug+0x60/0x90 [ 226.644582][T12846] exc_invalid_op+0x1a/0x50 [ 226.649097][T12846] asm_exc_invalid_op+0x1a/0x20 [ 226.653962][T12846] RIP: 0010:__queue_work+0xcd3/0xf50 [ 226.659263][T12846] Code: ff e8 d1 ad 38 00 90 0f 0b 90 e9 b2 fe ff ff e8 c3 ad 38 00 eb 13 e8 bc ad 38 00 eb 0c e8 b5 ad 38 00 eb 05 e8 ae ad 38 00 90 <0f> 0b 90 48 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc [ 226.678875][T12846] RSP: 0018:ffffc90004effca8 EFLAGS: 00010087 [ 226.684952][T12846] RAX: ffffffff818909a4 RBX: ffff88807b9b5a00 RCX: 0000000000080000 [ 226.692953][T12846] RDX: ffffc9000f38a000 RSI: 000000000000006b RDI: 000000000000006c [ 226.700938][T12846] RBP: 0000000000000000 R08: ffffffff8188fe04 R09: 0000000000000000 [ 226.708919][T12846] R10: ffffc90004effd80 R11: fffff520009dffb1 R12: ffff8880286f1000 [ 226.716892][T12846] R13: ffff8880286f11c0 R14: dffffc0000000000 R15: 0000000000000008 [ 226.724874][T12846] ? __queue_work+0x124/0xf50 [ 226.729585][T12846] ? __queue_work+0xcc4/0xf50 [ 226.734279][T12846] ? __queue_work+0xcc4/0xf50 [ 226.738975][T12846] ? __queue_delayed_work+0xeb/0x300 [ 226.744276][T12846] ? queue_delayed_work_on+0x1b4/0x390 [ 226.749748][T12846] queue_delayed_work_on+0x1ca/0x390 [ 226.755047][T12846] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 226.760865][T12846] ? do_raw_spin_lock+0x14f/0x370 [ 226.765899][T12846] ? __pfx_lock_release+0x10/0x10 [ 226.770938][T12846] ? hci_conn_drop+0x152/0x280 [ 226.775707][T12846] sco_conn_put+0x145/0x210 [ 226.780216][T12846] sco_chan_del+0xa3/0x180 [ 226.784635][T12846] sco_sock_shutdown+0x164/0x3f0 [ 226.789583][T12846] __x64_sys_shutdown+0x13f/0x1a0 [ 226.794637][T12846] do_syscall_64+0xf3/0x230 [ 226.799148][T12846] ? clear_bhb_loop+0x35/0x90 [ 226.803858][T12846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.809765][T12846] RIP: 0033:0x7f23b9d8cde9 [ 226.814186][T12846] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 226.833889][T12846] RSP: 002b:00007f23babe6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000030 [ 226.842317][T12846] RAX: ffffffffffffffda RBX: 00007f23b9fa6080 RCX: 00007f23b9d8cde9 [ 226.850291][T12846] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 226.858266][T12846] RBP: 00007f23b9e0e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 226.866237][T12846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 226.874212][T12846] R13: 0000000000000000 R14: 00007f23b9fa6080 R15: 00007ffeea7d2d88 [ 226.882200][T12846] [ 226.885579][T12846] Kernel Offset: disabled [ 226.889966][T12846] Rebooting in 86400 seconds..