last executing test programs: 6.721939597s ago: executing program 0 (id=9376): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xe, &(0x7f0000000fc0)=ANY=[@ANYBLOB="b7020000f10d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340)={0x0, 0xa}, 0x10}, 0x94) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000a, 0x50, 0xffffffffffffffff, 0x2fd15000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet6(r3, &(0x7f0000005ec0)=[{{&(0x7f0000000280)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1890dcbc08240000009300fb7c6939002900020039000001000002820002000043afb34701dc88082c680fe5569d4d5e2e75a0367e3260cfd836e7b199abb258ad7f7f9de2097c1acf1e4b1d72123e3240e00a98ea70d7dc99a18c12a6722ea20355b41d0a6805be7bfe5c8b53912dc9ac0ab63d5b31cc216ece8f77ea59f9d363094ff8d5d4ddb840d99e8ce90fa296a6c11e35cb56c78bd31ddde522ea6cbcde5213d57f495808ce2795732718da988eebd5196eb81db26e4806440c012f1b643e6e9b06e1bd3eaa9ee43c28a16b9b6830d4eab2a3ed759484b514c59802b910b2c71c3557d0173f189394bb003627f9c7223c14a2"], 0x18}}], 0x1, 0x0) sendmsg$nl_route(r2, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="340000001800010028bd7000fbdbdf00000000000000000002000040041c0000fcd9bc0c50141217c4870b82c6e6b650c8a777000000000023000000000000406ada44a3af80248045db7b007ec18edbd94f9419398030ad2ae778e56569eaf04446163b2d49b75b0b4704d2b882722a29efb87a527943a7e7a8f2f619edd292645f3952dde580"], 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x5b, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3df], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_MAX_RATE64={0x4}]}}}]}, 0x8c}}, 0x20000000) r7 = socket$pppoe(0x18, 0x1, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r8, 0x6, 0xd, &(0x7f0000000240)='H', 0x1) setsockopt$sock_int(r8, 0x1, 0x9, &(0x7f0000000440)=0xa0, 0x4) r9 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000180)='io.pressure\x00', 0x2, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r7, 0xc028660f, &(0x7f00000001c0)={0x0, r9, 0xa4, 0xdca, 0x9}) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x8, 0x8012, r1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r0, 0x2000012, 0xffffffffffffffca, 0x0, &(0x7f0000000c40), 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) epoll_pwait(0xffffffffffffffff, &(0x7f00000000c0)=[{}, {}], 0x2, 0x1, &(0x7f0000000140), 0x8) r10 = socket(0x2, 0x80805, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r11, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r10, 0x84, 0x7c, &(0x7f0000000000)={r12, 0x101, 0x9}, &(0x7f00000000c0)=0x8) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000010000107000040000000001a0a0000000600010011"], 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$sock(r14, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000400)="c2", 0x1}], 0x1}, 0x20000000) close(0x4) 6.29863996s ago: executing program 0 (id=9380): syz_emit_ethernet(0x32, &(0x7f00000002c0)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) (async) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x0) (async) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) setsockopt$inet_int(r1, 0x0, 0x1, &(0x7f0000000000)=0x8, 0x4) (async) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000000)={0x67, 0x1, 0xb, 0x85, 0x7f, 0x81}) unshare(0x6a040000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000002000010027bd70000009000002"], 0x38}, 0x1, 0x0, 0x0, 0x24048844}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) 6.202224108s ago: executing program 2 (id=9382): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) socket$packet(0x11, 0x2, 0x300) r2 = socket$unix(0x1, 0x1, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 64) r4 = socket(0x400000000010, 0x3, 0x0) (rerun: 64) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70ad2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) r7 = socket$kcm(0x11, 0x3, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x6fc84b579dfed949, 0x0) close(r8) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (rerun: 32) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accb", 0x26}], 0x1}, 0x4) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYRES32=0x0], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r12 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r10}, &(0x7f0000000280), &(0x7f0000000340)=r11}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r11, r13, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newtfilter={0x60, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0xe}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x30, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @remote}, @TCA_FLOWER_KEY_IPV4_SRC={0x8, 0xa, @multicast1}]}}]}, 0x60}}, 0x24044000) 5.755640032s ago: executing program 2 (id=9384): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="09000000040000000c0000000b"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r1}, 0xc) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f00000003c0)=0x6, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x0, @loopback}, @in6={0xa, 0x0, 0xffffffff, @private0}], 0x38) r3 = socket$inet(0x2, 0x5, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x7d, 0x0, &(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x3}], 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006a001b0c2bbd7000fbccdf2502000000ebffffff070001"], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x24000804) 5.465211702s ago: executing program 2 (id=9387): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x8, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0xb, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x1, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x808, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x4, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$unix(0x1, 0x2, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000000), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)={[{0x2b, 'hugetlb'}, {0x2d, 'cpuset'}, {0x2b, 'rlimit'}, {0x6, 'io'}, {0x2d, 'devices'}, {0x2d, 'rlimit'}, {0x2d, 'io'}, {0x2b, 'rdma'}]}, 0x38) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 5.236850296s ago: executing program 4 (id=9389): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000fffffff800000000850000002e000000180100000000372500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.009742415s ago: executing program 4 (id=9390): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "09cccd075ca3ee56", "30d20b6e1a8040f366e18c5f8fb6435b", "8f3e1f18", "895f7f3c0fbea491"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "09cccd075ca3ee56", "30d20b6e1a8040f366e18c5f8fb6435b", "8f3e1f18", "895f7f3c0fbea491"}, 0x28) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x8, @loopback}}, 0x0, 0x0, 0x41, 0x0, "b208405cce4456e4fc8f2dabd194ff3763f799f91cf7e5e8260998f956ec57c24451db07550335ebf4a3d0168ccaa268e928f39cd7494c2b19ebef230a3373685fbacfcf3b6e9633bd997a9bfcf08f67"}, 0xd8) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xce21, 0x4, @empty, 0x4}, 0x1c) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0xfe55, 0xfffffffffffffffc}) (async) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0xfe55, 0xfffffffffffffffc}) socket$unix(0x1, 0x5, 0x0) (async) r2 = socket$unix(0x1, 0x5, 0x0) unshare(0x2c020400) ioctl$FIOCLEX(r2, 0x5451) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r3, 0x0, 0x0}, 0xe) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0xe8, r5, 0x902, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0xa}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x780}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x6}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x119}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1a10}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x28}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x15}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xffffffff}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x310}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x38c}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x303811a77753797e}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1000}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) (async) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0xe8, r5, 0x902, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0xa}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x780}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x6}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x119}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1a10}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x28}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x15}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xffffffff}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x310}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x38c}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x303811a77753797e}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1000}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r5, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) ioctl$AUTOFS_IOC_CATATONIC(r4, 0x9362, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan1\x00'}) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x600, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x600, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r6, 0x89e4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x15, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) (async) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x15, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) socket$inet6_icmp(0xa, 0x2, 0x3a) (async) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$sock_attach_bpf(r9, 0x1, 0x34, &(0x7f0000000040)=r8, 0x4) (async) setsockopt$sock_attach_bpf(r9, 0x1, 0x34, &(0x7f0000000040)=r8, 0x4) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000005c0)={0x6, 0x5, 0x40, 0x4, 0xf, 0xe, 0xf, 0x52, 0x3, 0x1, 0x81, 0x3, 0x1, 0x2}, 0xe) 2.25523549s ago: executing program 2 (id=9392): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) unshare(0x22020600) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000ac0)={r1, r2}, 0xc) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000)={r1, r0}, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x70000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0xa4, r4, 0x400, 0x70bd26, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'vlan1\x00'}, @NLBL_UNLABEL_A_SECCTX={0x2a, 0x7, 'system_u:object_r:initrc_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010100}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x34}}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010101}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'macsec0\x00'}]}, 0xa4}, 0x1, 0x0, 0x0, 0x10}, 0x8040) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000100)=@caif=@util={0x25, "4352649a38f9f87bbe095fd12b127228"}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000440)="17358bcbd9e6ed78f44bf418e441596bad631616d8947ee5d7c486e1eda7793134e8e2f281e5fb0c2ec540f394105457bfdbcee1b5b22b61c860e85349b64f89a8c3ec67", 0x44}, {&(0x7f00000004c0)="d1ecafaa208a09e4aa3fb0e414a43cac6b0de90305375a8aa62c35abb4d4afefabe58a5c82310d6b69b42dee9740220c47193efb78aeaf13364899de3435dbaaac004da1205264cb9fa338579c67bf3ac9d8674818bc1b8a9a097b5999f3225d63efedf96423642d230d0c02e64e4ce653a8b7015f516d1339d9ae2830ebd425a752dd332684c59e8e560b9e7a6f7dfa3424a37b2cdc096eb064e616249cf6f1f6c683789fbb726f99c69cde8751491423b552566d4e04dcb0cde07c74e8b956eb8cf6f5bc2f6ad7069ed78e3b4abc146e015d738d34729e0eac5a3b28de5afcaa3b7c13f6d7901d8d9ecf9232f4164c48c22c3665edd7f0", 0xf8}, {&(0x7f00000005c0)="0804d689581c90f9ed656ff30a51a6d250a6b66b7506fa527960", 0x1a}], 0x3, &(0x7f0000000640)}, 0x40000) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a28000000000a01040000000000000000010080030900010073797a3000000000080002400000000320000000030a01020000000000000000010000000900010073797a300000000014000000110001000000000000f5ffff0600000a99aa234042e5ab54ed2416"], 0x70}, 0x1, 0x0, 0x0, 0x811}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a73300008000200000000000800070026093a0014000600626f6e64300000000000000000000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x0) 2.096169541s ago: executing program 4 (id=9395): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$tcp_mem(r2, &(0x7f0000000140)={0x5, 0x20, 0x6, 0x20, 0xe4bb}, 0x48) (async) write$cgroup_subtree(r2, &(0x7f00000002c0)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) write$tcp_mem(r1, &(0x7f00000003c0)={0x0, 0x20, 0x80000001, 0x20, 0x8000000000006}, 0xfeb0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r5, 0x1, 0x70bd26, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4040000) (async) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)=ANY=[@ANYRESDEC=r6], 0x114}], 0x1}, 0x24044010) recvmmsg(r7, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}, 0x7fffffff}], 0x1, 0x14022, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0), r0) (async) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010018"], 0x1c}}, 0x0) 2.032380396s ago: executing program 2 (id=9396): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0xffffffffffffffff, &(0x7f00000002c0)=0x4b) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x2, 0x4, 0x4, 0x1}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r1}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f00000015c0)=@raw=[@exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7ff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x8}], &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000202000000000000000000000b030000000000000000000002"], 0x0, 0x3e}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r2, 0x20, &(0x7f00000002c0)={&(0x7f0000000140)=""/74, 0x4a, 0x0, &(0x7f00000001c0)=""/50, 0x32}}, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) 1.816399951s ago: executing program 4 (id=9399): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000ac0)={0xffffffffffffffff}) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000b00), &(0x7f0000000b40)=0x4) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x15, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000000000b702000014000000b7060000000000008500000005000000bf0900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b5090000000000807baaf0ff00000000ae8900000000000007080000f8ffffffbf8400000000000007040000f0ffffffc70200000800000018260000", @ANYBLOB="180800006bcd0001000000000000000018110000", @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r0, @ANYBLOB="d78b1bcc8ff37cdf5a2d034fbe8a52364de9ffa0cc57781171bd89c48d43aec424ed09bdcd26f2c121ef178492371b2e197001bfbdb24ba7dc26bb4fd3e269f7243a58c6"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = accept$alg(r3, 0x0, 0x0) recvmmsg(r4, &(0x7f0000000a00)=[{{&(0x7f0000000000)=@alg, 0x80, &(0x7f00000001c0)=[{&(0x7f00000003c0)=""/244, 0xf4}, {&(0x7f0000000080)=""/65, 0x41}], 0x2, &(0x7f00000004c0)=""/136, 0x88}, 0x2}, {{&(0x7f0000000580)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000200)=""/9, 0x9}], 0x1, &(0x7f0000000640)=""/158, 0x9e}, 0x10000}, {{&(0x7f0000000700)=@sco={0x1f, @none}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000840)=""/142, 0x8e}, {&(0x7f0000000780)=""/48, 0x30}, {&(0x7f0000000900)=""/27, 0x1b}, {&(0x7f0000000940)=""/6, 0x6}], 0x4}, 0x3c}], 0x3, 0x10000, 0x0) 1.6310792s ago: executing program 1 (id=9400): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000f3ffffff00000000850000002e000000180100000000372500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.619602829s ago: executing program 4 (id=9401): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@ipmr_delroute={0x24, 0x19, 0x1, 0x70bd2b, 0x25dfdbff, {0x80, 0x20, 0x90, 0x0, 0x0, 0x4, 0x0, 0x5, 0x5100}, [@RTA_DST={0x8, 0x1, @broadcast}]}, 0x24}, 0x1, 0x0, 0x0, 0x24044801}, 0x4000004) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x800) sendto$inet(r6, &(0x7f0000000000)='\x00\x00', 0x2, 0x24008800, 0x0, 0x0) accept4$tipc(r6, 0x0, 0x0, 0x800) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r7, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r9, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x1, 0x8000004) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f0000000740)={0x5, {{0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x2}}, 0x1, 0x5, [{{0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x300}}, {{0xa, 0x4e22, 0xffffffff, @loopback, 0xffff37a2}}, {{0xa, 0x4e23, 0x6, @rand_addr=' \x01\x00', 0xd6ea}}, {{0xa, 0x4e24, 0x7, @empty, 0x401}}, {{0xa, 0x4e21, 0x5, @private1, 0x4}}]}, 0x310) 1.568793111s ago: executing program 2 (id=9402): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x42}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000003c0)={0x14, r2, 0x70d, 0x70bd26, 0x2ddfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x8000) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r7, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f0000000b00)={0x38, r8, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_VALUE={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x38}}, 0x4040004) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x54, 0x2, [@TCA_FW_ACT={0x50, 0x4, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x3513, 0x6, 0xffffffffffffffff, 0xb6b9, 0x3}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40000) r9 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r9, 0x8983, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$rds(r9, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x5e24, @multicast1}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000200)=""/257, 0x101}], 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000180)={r3, &(0x7f0000000040)=' ', 0x8000, &(0x7f00000000c0)={@align=0x30000, {0xf, 0x681, 0xfffffffe, 0xf}}, 0xe00, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000400)=0x974}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000380)={r10, 0x20, &(0x7f0000000340)={&(0x7f00000001c0)=""/234, 0xea, 0x0, &(0x7f00000002c0)=""/79, 0x4f}}, 0x10) 1.451904259s ago: executing program 1 (id=9404): socket$xdp(0x2c, 0x3, 0x0) unshare(0x2c060000) unshare(0x24020400) r0 = socket(0x2, 0x2, 0x1) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = epoll_create(0x3ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) r6 = openat$cgroup_ro(r5, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r6, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)=ANY=[@ANYBLOB="020300020c00000000000000001900000200080000000000d600000000000000030006000000000002004e23ffffffff000000000000000002000100000004d50000080300000000020005000000000002"], 0x60}, 0x1, 0x7}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r9, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r10 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r9, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000f40)=ANY=[], 0x138}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(0x3) bind$xdp(r9, &(0x7f0000000100)={0x2c, 0x0, r11}, 0x10) bind$xdp(r2, &(0x7f0000000240)={0x2c, 0x1, r11, 0x0, r9}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xe}, {}, {0x7}}}, 0x24}}, 0x0) 1.309716945s ago: executing program 3 (id=9405): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000001000ffff26bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000f8a1e3503ff409053295f5e9be387d2a9e97f01d3b199688d99423f4b4ea3a"], 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f00000002c0), &(0x7f0000000300)=0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000080)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x22}}}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x40}}, 0x0) (async) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'dummy0\x00'}) (async) r7 = socket$netlink(0x10, 0x3, 0x10) r8 = socket$netlink(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000811239000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) getsockopt$inet_opts(r4, 0x0, 0x9, &(0x7f0000000340)=""/27, &(0x7f0000000380)=0x1b) (async) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="4cdfc84b35ed1ed9e9209570003d000000e800"/30, @ANYRES32=0x0, @ANYBLOB="a5fdad88000000002c0012800b00010067656e65766500001c00028005000d0001000000080001000300000005000c0000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r8, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r10, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) (async) r11 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)={0x64, r11, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r12}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0xe, 0x2, 0x200}, {0x804, 0x7, 0x3, 0x3}]}}}]}}]}, 0x64}, 0x1, 0x1000000, 0x0, 0x24004000}, 0x24040840) ioctl$sock_ifreq(r5, 0x891f, &(0x7f0000000400)={'veth0\x00', @ifru_ivalue=0x5}) 1.165387054s ago: executing program 4 (id=9406): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x28) socket$netlink(0x10, 0x3, 0x13) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) close(0x3) r2 = socket$kcm(0xa, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x28, 0x2, 0xb7, 0xfffff014}, {0x6, 0x6, 0x5, 0xfffffffb}]}, 0x10) unshare(0x66000080) sendmsg$kcm(r2, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0xbd, &(0x7f0000000340)=[{&(0x7f00000003c0)='`', 0x1}], 0x1}, 0x41) setsockopt$sock_attach_bpf(r0, 0x84, 0x1e, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r5, &(0x7f0000000180)={0x11, 0x17, r6, 0x1, 0x40, 0x6, @broadcast}, 0x14) getsockname$packet(r5, &(0x7f00000018c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000000100)=ANY=[@ANYBLOB="38000000540001000000000000c4000007008209", @ANYRES32=r7, @ANYBLOB="20000100", @ANYRES32=r6, @ANYBLOB="00000001e000030000000000000000000000000008"], 0x38}, 0x1, 0x0, 0x0, 0x881}, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8916, &(0x7f0000000040)={'wlan1\x00', @random="0200ac7f7f00"}) close(0x3) ioctl$SIOCSIFHWADDR(r1, 0x8916, &(0x7f0000000040)={'veth0_to_bond\x00', @remote}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r9, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) ioctl$sock_netrom_SIOCADDRT(r5, 0x890b, &(0x7f0000000080)={0x1, @bcast, @bpq0, 0x0, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, 0x8, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r11 = syz_init_net_socket$x25(0x9, 0x5, 0x0) read(r11, &(0x7f00000044c0)=""/22, 0x16) sendmsg$nl_route(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000440)=ANY=[@ANYBLOB="b00200006d0000032cbd700014dcdf25000000008d4894b7d096aedc65b91735c09ce96de3e699817c980a3993d42fc92206abdf032e995816930a6fd56311ce662b", @ANYRES32=r10], 0x2b0}, 0x1, 0x0, 0x0, 0x40005}, 0x40000) r12 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r12, 0x1) 932.026431ms ago: executing program 0 (id=9407): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x17, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8b}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x86}}, {}, [@printk={@lld}], {{}, {}, {0x85, 0x0, 0xf3, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0xa, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000}, 0x94) 931.685429ms ago: executing program 1 (id=9408): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="500100001a0001000000000000000000020000000000000b002f000005001b001100000006001d004e21000008000200e0"], 0x150}}, 0x4) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4809, 0x801}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x4}}}]}, 0x8}}, 0x0) 929.240849ms ago: executing program 3 (id=9409): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xc00}, [@RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_DIR={0x5, 0x3, 0xda}}}}]}, 0x30}}, 0x0) r0 = socket$kcm(0x11, 0x200000000000003, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@gettclass={0x24, 0x2a, 0x20, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xb, 0x6}, {0x9, 0xd}, {0xc, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x8004001}, 0x40) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="2539000020000365f507f62aa6172f7881"], 0x33fe0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) epoll_create1(0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0), 0x60}, 0x0) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x80, 0x24, 0xf0b, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x54, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x9, 0x0, 0x7, 0x3, 0x34, 0x1}, {0x8, 0x1, 0x7fff, 0x0, 0x5}, 0x4000, 0x58d0, 0x1665}}, @TCA_TBF_PARMS={0x28, 0x1, {{0xf7, 0x2, 0x35, 0x3, 0x8, 0x3}, {0x77, 0x0, 0x7f, 0x8000, 0x4}, 0x2, 0x9ccd, 0x1941}}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x4004001}, 0x4000010) r12 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r12, 0x29, 0xcb, 0x0, 0x0) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r10) sendmsg$TIPC_CMD_SET_LINK_TOL(r10, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="68000000ee22e62dd0c52a6c80", @ANYRES16=r13, @ANYBLOB="000027bd7000fddbdf25010000000000000007410000004c001800000007696200"/98], 0x68}, 0x1, 0x0, 0x0, 0x4014}, 0x1004) 789.906789ms ago: executing program 0 (id=9410): syz_emit_ethernet(0x5a, &(0x7f00000010c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x24, 0x6, 0x0, @remote, @local, {[@hopopts={0x8, 0x0, '\x00', [@generic={0x7, 0x3, "801a8f"}]}], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x11, 0x0, 0x3}}}}}}}, 0x0) (async) syz_emit_ethernet(0x5a, &(0x7f00000010c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x24, 0x6, 0x0, @remote, @local, {[@hopopts={0x8, 0x0, '\x00', [@generic={0x7, 0x3, "801a8f"}]}], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x11, 0x0, 0x3}}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)) sendfile(r0, r1, 0x0, 0x0) (async) sendfile(r0, r1, 0x0, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xbf4d, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2}, 0x50) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={0xffffffffffffffff}, 0x4) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket(0x23, 0x800, 0x9) sendmsg$nl_xfrm(r5, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@getspdinfo={0x14, 0x25, 0x800, 0x70bd28, 0x25dfdbfe, 0x9, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x400}, 0x800) (async) sendmsg$nl_xfrm(r5, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@getspdinfo={0x14, 0x25, 0x800, 0x70bd28, 0x25dfdbfe, 0x9, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x400}, 0x800) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000900)=ANY=[@ANYBLOB="030000000000000002004e24000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000067be00000000000000000000000000000000000000000000000200000003"], 0x210) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r2}, &(0x7f0000000080), &(0x7f0000000100)=r3}, 0x20) 754.832032ms ago: executing program 1 (id=9411): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000002c00)=@buf={0x500, &(0x7f0000002bc0)}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) close(r1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = gettid() sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_PID={0x8, 0x13, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) sendmsg$inet_sctp(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)="be6f88e904006dd2bd0117c586023380ec289d6c15d3fc0fb99d7337093227523ac2fe6bc9040e01b630dcecf43a9dc2ec73ca8323adbd5e3a0b91ebec615dfb1a23c01b1977a0b14dc32cafe1a70aaa8fb8a3683c7a114b56dd7f22da4178ffd809abddedaa6dfd4637286f12610033f3a62b203f7432b1ce1d701f3b38d77f0fd821733693a34566fd7aba12f7c8f6ff8092e2028fafa4bf4fa980508d371217af62f17c4eac6032968e543fd5a565b8efc372aa05a1b5add6c58ac7d8f828a9bfcb1081ffaecb10e29000"/219, 0xfe98}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="2000000000000000840000000200000006000400280100000b008002", @ANYRES32=r3], 0x20, 0x6044}, 0x6) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x7ffffffffffffffe, 0x3ff}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x74}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x8f}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) 648.710139ms ago: executing program 3 (id=9412): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf, 0x9}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) (async) r2 = socket(0x2, 0x3, 0xff) setsockopt$sock_int(r2, 0x1, 0x5, &(0x7f0000000180)=0x5, 0x4) (async) sendmmsg$inet(r2, &(0x7f0000000100)=[{{&(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10, 0x0}}], 0x1, 0x4800) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}]}, 0x38}, 0x1, 0xfffc}, 0x4000800) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x44080) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 546.497771ms ago: executing program 0 (id=9413): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9b61}, [@call={0x85, 0x0, 0x0, 0x27}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x11000000}, 0x94) 511.722286ms ago: executing program 3 (id=9414): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/cgroup\x00') unshare(0x6a040000) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_QUANTUM={0x8, 0x6, 0x2000007}]}}]}, 0x40}}, 0x4000010) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, 0x0, 0x0) listen(r3, 0xa1) socket$inet_udp(0x2, 0x2, 0x0) r4 = socket(0x22, 0x2, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r4) accept4$bt_l2cap(r3, 0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f0000000080), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, {0x3, 0x1}, {0x4, 0xffff}, {0xe, 0xfff3}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x9, 0x0, 0x0, 0x200, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000050) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x40, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x40}, @val={0x8, 0x3, r8}, @val={0xc}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1374}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}]}, 0x40}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)="d80000001e0081054e81f782db4cb9040a1d080006007c095dd2086518000a800d00000003600e1208000f0000000406a80016c0080009", 0x37}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) r9 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0xfe33) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r5, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x38, 0x140f, 0x400, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000010}, 0x810) 364.801661ms ago: executing program 1 (id=9415): close(0xffffffffffffffff) socket$kcm(0x2d, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 337.351136ms ago: executing program 0 (id=9416): r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x18, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x88f, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffc}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [@printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @jmp={0x5, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffff4, 0xfffffffffffffff0}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0xa, 0xffe, &(0x7f0000000cc0)=""/4094, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffb}, 0x94) (async, rerun: 64) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) (rerun: 64) sendto$packet(r1, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x4a, 0x40, 0x5, 0x4, 0x7c, 0x19, 0x9, 0x40, 0x4, 0x7, 0x4, 0x0, 0x9a, 0x8}, 0xe) (async) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e24, 0xdcdf, @loopback, 0xffff}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000180)={r4, @in={{0x2, 0x4e21, @empty}}, 0x9, 0x3}, &(0x7f0000000080)=0x90) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000018000000000000001000000850000009300000095"], &(0x7f0000000140)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) recvmsg(r5, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async, rerun: 32) recvmmsg(r5, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000780)=""/212, 0xd4}], 0x1}, 0x3ff}], 0x4000300, 0x2, 0x0) (rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001800dd8d0000000000000000020020000000000517000000060015000200000014001680100008800c0002800800010007000000"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) 243.544475ms ago: executing program 3 (id=9417): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00', 0x0, 0x2}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x4008032, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) r1 = socket$key(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xb, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000730186000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmmsg(r1, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r1, 0x1, 0x4b, &(0x7f0000000040)=0xfd87, 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00', 0x0, 0x2}, 0x50) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x4008032, 0xffffffffffffffff, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) (async) socket$key(0xf, 0x3, 0x2) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xb, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000730186000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) recvmmsg(r1, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) (async) setsockopt$sock_int(r1, 0x1, 0x4b, &(0x7f0000000040)=0xfd87, 0x4) (async) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) (async) 191.732242ms ago: executing program 1 (id=9418): syz_emit_ethernet(0x7a, &(0x7f0000000900)={@empty, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "5f1060", 0x44, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {0x8, 0x88be, 0x86ddffff, {{0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x1, 0xfe}}}, {0x8, 0x22eb, 0x2, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7}}}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) getpeername(r0, &(0x7f0000000340)=@pptp={0x18, 0x2, {0x0, @dev}}, &(0x7f0000000040)=0x80) r1 = socket(0x10, 0x803, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x40000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x100}, 0x0) select(0x2a, 0x0, 0x0, &(0x7f0000000400)={0xfefdffffffffffff, 0x1, 0x2, 0x300}, &(0x7f0000000440)={0x0, 0x2710}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r5 = socket(0x10, 0x803, 0x2) syz_emit_ethernet(0xc1, &(0x7f0000000680)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x31}, @void, {@ipv4={0x800, @udp={{0x24, 0x4, 0x0, 0x0, 0xb3, 0xfffd, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1e}, {[@generic={0x48, 0x5, "63b212"}, @cipso={0x86, 0x28, 0x3, [{0x1, 0x7, "2dbddb7b16"}, {0x5, 0x2}, {0x6, 0x12, "000000006c628e7caf4934950100adaa"}, {0x2, 0x7, "76ec652f1f"}]}, @timestamp={0x44, 0x20, 0x13, 0x0, 0x2, [0x9, 0x2, 0x401, 0x1, 0x1, 0x3ed6, 0x0]}, @rr={0x7, 0xb, 0x35, [@rand_addr=0x64010100, @empty]}, @cipso={0x86, 0x23, 0x3, [{0x1, 0x2}, {0x7, 0x9, "80e657e84556c2"}, {0x6, 0x12, "4b0bb40148d64d9bb0b1a57eb02a76cc"}]}]}}, {0x0, 0x17c1, 0x23, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}, "d40500000000000000043cb2931fff78cdd6f50782449a"}}}}}}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r4}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r9, 0x0, &(0x7f0000001780)=""/4096}, 0x20) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r6}) setsockopt$inet_tcp_int(r1, 0x6, 0x6, &(0x7f00000001c0)=0x5b7e, 0x4) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="680000001000030500000000f406000000000000", @ANYRES32=0x0, @ANYBLOB="000000000610000040001280080001006772650034000280060010004e200000080004000200000005000a0000000000060018000e000000080006007f00000108000700e000000108000a00", @ANYRES32=r4, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) bind$bt_l2cap(r5, &(0x7f0000000140)={0x1f, 0x9, @none, 0x7, 0x1}, 0xe) 0s ago: executing program 3 (id=9419): openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @initdev}, &(0x7f0000000180)=0x10) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a1", 0x4}], 0x1}, 0x9fc) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x18, 0x0, 0x1, 0x70bd2b, 0x0, {0x1a}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0101fffd000000000000010000000c000440000000000000000240000000160a010000000000000000000100fffd0900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000038000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000000900020073797a3200000000140000001000010000000000000000000000000a"], 0xc0}}, 0x800) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000d30000000800000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r6, 0xffffffffffffffff}, &(0x7f0000001d80), &(0x7f0000001d40)=r4}, 0x20) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xc, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b705000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r7, &(0x7f0000000040)="ef223d71454d1f70d16aff6d6a0a91d28a719de7da349ba2aa1399997be621fdf59883e9cc", 0x0}, 0x20) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYRES32=r9, @ANYRES16=0xffffffffffffffff, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x24, &(0x7f0000000200)={&(0x7f0000001640)=ANY=[@ANYRES64=0x0, @ANYRES16=r0, @ANYRESOCT=r11], 0x14}}, 0x0) readv(r12, &(0x7f0000000080)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) bind$bt_hci(r10, &(0x7f0000000280)={0x1f, 0xfffc, 0x1}, 0xffffffffffffff1f) write(r10, &(0x7f0000000140)="41000200010001", 0x7) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES64, @ANYBLOB="010029bd7080000000000200000008000300", @ANYRES32=r3, @ANYBLOB="0c00990041000000600000000800270002000000080026009a03"], 0x40}}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r13, 0x8935, &(0x7f0000000000)={'veth0\x00'}) kernel console output (not intermixed with test programs): x1bd/0x2a0 [ 1102.169148][ T5431] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1102.169185][ T5431] ? __pfx_ksys_write+0x10/0x10 [ 1102.169224][ T5431] do_syscall_64+0x14d/0xf80 [ 1102.169249][ T5431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.169268][ T5431] ? trace_irq_disable+0x37/0x100 [ 1102.169290][ T5431] ? clear_bhb_loop+0x40/0x90 [ 1102.169315][ T5431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.169334][ T5431] RIP: 0033:0x7f1cd2f9c629 [ 1102.169353][ T5431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1102.169370][ T5431] RSP: 002b:00007f1cd3e09028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1102.169392][ T5431] RAX: ffffffffffffffda RBX: 00007f1cd3216180 RCX: 00007f1cd2f9c629 [ 1102.169407][ T5431] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000008 [ 1102.169420][ T5431] RBP: 00007f1cd3e09090 R08: 0000000000000000 R09: 0000000000000000 [ 1102.169432][ T5431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1102.169444][ T5431] R13: 00007f1cd3216218 R14: 00007f1cd3216180 R15: 00007ffd3d3fff08 [ 1102.169479][ T5431] [ 1102.717502][ T5419] ip6_vti0 speed is unknown, defaulting to 1000 [ 1102.816645][ T5434] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8192'. [ 1102.932364][ T5438] ip6_vti0: Caught tx_queue_len zero misconfig [ 1103.762688][ C0] bridge0: port 3(.`) entered forwarding state [ 1103.769061][ C0] bridge0: topology change detected, propagating [ 1103.888491][ T5457] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1103.990679][ T5459] macsec1: entered promiscuous mode [ 1104.012896][ T5459] bond5: entered promiscuous mode [ 1104.023485][ T5459] bond5: left promiscuous mode [ 1104.281341][ T5472] x_tables: unsorted underflow at hook 3 [ 1104.310448][ T5473] netlink: 'syz.3.8202': attribute type 1 has an invalid length. [ 1104.519748][ T5473] __nla_validate_parse: 2 callbacks suppressed [ 1104.519771][ T5473] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8202'. [ 1104.551069][ T5488] sch_tbf: burst 19 is lower than device syzkaller0 mtu (1514) ! [ 1104.571527][ T5473] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8202'. [ 1104.642041][ T5473] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8202'. [ 1104.756294][ T5493] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8207'. [ 1104.766023][ T3668] net_ratelimit: 18 callbacks suppressed [ 1104.766045][ T3668] bond0: (slave bridge5): failed to get link speed/duplex [ 1104.893029][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.014998][ T5506] lo speed is unknown, defaulting to 1000 [ 1105.035341][ T5499] lo speed is unknown, defaulting to 1000 [ 1105.042520][ T5506] ip6_vti0 speed is unknown, defaulting to 1000 [ 1105.051387][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.172992][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.293024][ T3668] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.383842][ T5499] ip6_vti0 speed is unknown, defaulting to 1000 [ 1105.403020][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.490010][ T5531] netlink: 'syz.1.8217': attribute type 10 has an invalid length. [ 1105.542854][ T3668] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.596540][ T5534] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8218'. [ 1105.645337][ T5534] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8218'. [ 1105.653036][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.886061][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1105.910287][ T5549] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8222'. [ 1105.970327][ T5545] lo speed is unknown, defaulting to 1000 [ 1106.051350][ T5545] ip6_vti0 speed is unknown, defaulting to 1000 [ 1106.062176][ T5562] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8221'. [ 1106.303089][ T3677] bond0: (slave bridge5): failed to get link speed/duplex [ 1106.873020][ T5587] netlink: 'syz.0.8225': attribute type 1 has an invalid length. [ 1107.216829][ T5603] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8230'. [ 1107.228742][ T5600] netlink: 'syz.3.8229': attribute type 3 has an invalid length. [ 1107.245094][ T5602] mac80211_hwsim hwsim64 ªªªªª;: renamed from wlan0 [ 1107.281532][ T5600] bond1: entered allmulticast mode [ 1107.289164][ T5600] vti0: entered allmulticast mode [ 1107.333657][ T5600] siw: device registration error -23 [ 1107.388638][ T5598] bond1: left allmulticast mode [ 1107.416611][ T5598] vti0: left allmulticast mode [ 1107.495792][ T5613] netlink: 'syz.2.8231': attribute type 1 has an invalid length. [ 1107.610653][ T5620] netlink: 'syz.3.8233': attribute type 1 has an invalid length. [ 1107.627394][ T5620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8233'. [ 1107.817214][ T5629] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1108.334037][ T5645] syzkaller0: entered promiscuous mode [ 1108.339572][ T5645] syzkaller0: entered allmulticast mode [ 1108.568614][ T5646] lo speed is unknown, defaulting to 1000 [ 1108.595818][ T5660] netem: incorrect gi model size [ 1108.601285][ T5660] netem: change failed [ 1108.642502][ T5646] ip6_vti0 speed is unknown, defaulting to 1000 [ 1109.965954][ T5694] lo speed is unknown, defaulting to 1000 [ 1110.014349][ T5694] ip6_vti0 speed is unknown, defaulting to 1000 [ 1110.032748][ T3662] net_ratelimit: 21 callbacks suppressed [ 1110.032773][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1110.164314][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1110.291050][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1110.435581][ T5712] __nla_validate_parse: 7 callbacks suppressed [ 1110.435601][ T5712] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8255'. [ 1110.622777][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1110.676779][ T5721] FAULT_INJECTION: forcing a failure. [ 1110.676779][ T5721] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1110.691033][ T5721] CPU: 1 UID: 0 PID: 5721 Comm: syz.2.8257 Not tainted syzkaller #0 PREEMPT(full) [ 1110.691062][ T5721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1110.691074][ T5721] Call Trace: [ 1110.691081][ T5721] [ 1110.691091][ T5721] dump_stack_lvl+0xe8/0x150 [ 1110.691125][ T5721] should_fail_ex+0x412/0x560 [ 1110.691157][ T5721] _copy_from_user+0x2d/0xb0 [ 1110.691179][ T5721] do_sock_getsockopt+0x165/0x3f0 [ 1110.691229][ T5721] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1110.691251][ T5721] ? __fget_files+0x3a0/0x420 [ 1110.691269][ T5721] ? __fget_files+0x2a/0x420 [ 1110.691294][ T5721] __x64_sys_getsockopt+0x1a4/0x240 [ 1110.691325][ T5721] do_syscall_64+0x14d/0xf80 [ 1110.691349][ T5721] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.691368][ T5721] ? trace_irq_disable+0x37/0x100 [ 1110.691396][ T5721] ? clear_bhb_loop+0x40/0x90 [ 1110.691420][ T5721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.691437][ T5721] RIP: 0033:0x7f6b41f9c629 [ 1110.691457][ T5721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1110.691473][ T5721] RSP: 002b:00007f6b42e46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1110.691495][ T5721] RAX: ffffffffffffffda RBX: 00007f6b42215fa0 RCX: 00007f6b41f9c629 [ 1110.691510][ T5721] RDX: 0000000000000085 RSI: 0000000000000084 RDI: 0000000000000003 [ 1110.691521][ T5721] RBP: 00007f6b42e46090 R08: 00002000000010c0 R09: 0000000000000000 [ 1110.691534][ T5721] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 1110.691545][ T5721] R13: 00007f6b42216038 R14: 00007f6b42215fa0 R15: 00007fffada5edc8 [ 1110.691579][ T5721] [ 1110.912989][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.123067][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.389128][ T5728] lo speed is unknown, defaulting to 1000 [ 1111.397613][ T5728] ip6_vti0 speed is unknown, defaulting to 1000 [ 1111.410052][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.567086][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.734185][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.842721][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1111.940792][ T5748] lo speed is unknown, defaulting to 1000 [ 1112.101160][ T5748] ip6_vti0 speed is unknown, defaulting to 1000 [ 1112.749697][ T5772] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8270'. [ 1113.502189][ T5795] tunl0: Caught tx_queue_len zero misconfig [ 1113.988675][ T5815] lo speed is unknown, defaulting to 1000 [ 1114.077197][ T5815] ip6_vti0 speed is unknown, defaulting to 1000 [ 1114.283373][ T5824] xt_hashlimit: size too large, truncated to 1048576 [ 1114.416887][ T5830] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1114.487337][ T5830] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1114.582453][ T5832] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1114.618877][ T5832] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1114.671481][ T5832] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1114.727265][ T5832] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8280'. [ 1115.072792][ T3670] net_ratelimit: 15 callbacks suppressed [ 1115.072814][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.126704][ T5842] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8283'. [ 1115.180614][ T5847] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8283'. [ 1115.265565][ T5842] netlink: 'syz.2.8283': attribute type 1 has an invalid length. [ 1115.272824][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.382732][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.492818][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.603610][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.681901][ T5861] tipc: Enabled bearer , priority 28 [ 1115.700340][ T5854] __nla_validate_parse: 1 callbacks suppressed [ 1115.700392][ T5854] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8286'. [ 1115.733216][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.862877][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1115.972784][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1116.103239][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1116.212935][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1116.719853][ T5896] netlink: 48 bytes leftover after parsing attributes in process `syz.2.8293'. [ 1116.873715][ T5891] bond9: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1116.953371][ T5891] bond9 (unregistering): Released all slaves [ 1117.057324][ T5904] tipc: Enabled bearer , priority 14 [ 1117.074628][ T5904] netlink: 3 bytes leftover after parsing attributes in process `syz.4.8297'. [ 1117.121570][ T5904] 0ªX¹¦À: renamed from caif0 [ 1117.146628][ T5904] tipc: Disabling bearer [ 1117.194483][ T5904] 0ªX¹¦À: entered allmulticast mode [ 1117.338091][ T5910] sctp: [Deprecated]: syz.3.8299 (pid 5910) Use of int in max_burst socket option. [ 1117.338091][ T5910] Use struct sctp_assoc_value instead [ 1118.017135][ T5925] block nbd5: Unsupported socket: should be TCP or UNIX. [ 1118.270001][ T5937] lo speed is unknown, defaulting to 1000 [ 1118.278329][ T5937] ip6_vti0 speed is unknown, defaulting to 1000 [ 1118.664877][ T5950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1118.794754][ T5952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8311'. [ 1118.834994][ T5952] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8311'. [ 1118.863178][ T5952] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1118.870581][ T5952] IPv6: NLM_F_CREATE should be set when creating new route [ 1119.558256][ T5977] netlink: 'syz.3.8317': attribute type 1 has an invalid length. [ 1119.575300][ T5977] netlink: 244 bytes leftover after parsing attributes in process `syz.3.8317'. [ 1119.958102][ T5985] xt_CONNSECMARK: invalid mode: 253 [ 1120.008597][ T5990] netlink: 'syz.3.8323': attribute type 4 has an invalid length. [ 1120.113379][ T3671] net_ratelimit: 29 callbacks suppressed [ 1120.113401][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1120.243491][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1120.310476][ T6002] dummy0: entered promiscuous mode [ 1120.353038][ T6002] macsec1: entered allmulticast mode [ 1120.376619][ T6002] dummy0: entered allmulticast mode [ 1120.393985][ T6002] dummy0: left allmulticast mode [ 1120.412991][ T6002] dummy0: left promiscuous mode [ 1120.475462][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1120.586218][ T6019] lo speed is unknown, defaulting to 1000 [ 1120.670531][ T6019] ip6_vti0 speed is unknown, defaulting to 1000 [ 1120.772419][ T6025] veth0_to_bond: entered promiscuous mode [ 1120.779007][ T6025] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check. [ 1120.796200][ T3662] bond0: (slave bridge5): failed to get link speed/duplex [ 1120.972936][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1121.005655][ T6034] netlink: 'syz.4.8334': attribute type 2 has an invalid length. [ 1121.034146][ T6034] netlink: 'syz.4.8334': attribute type 1 has an invalid length. [ 1121.041940][ T6034] netlink: 108 bytes leftover after parsing attributes in process `syz.4.8334'. [ 1121.334959][ T3677] bond0: (slave bridge5): failed to get link speed/duplex [ 1121.417333][ T6056] lo speed is unknown, defaulting to 1000 [ 1121.425369][ T6056] ip6_vti0 speed is unknown, defaulting to 1000 [ 1121.453024][ T3677] bond0: (slave bridge5): failed to get link speed/duplex [ 1121.519233][ T6060] x_tables: duplicate underflow at hook 1 [ 1121.554279][ T6064] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1121.562740][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1122.685653][ T6093] lo speed is unknown, defaulting to 1000 [ 1122.757522][ T6093] ip6_vti0 speed is unknown, defaulting to 1000 [ 1122.915345][ T6110] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 1123.290947][ T6121] syzkaller0: entered promiscuous mode [ 1123.313075][ T6121] syzkaller0: entered allmulticast mode [ 1123.971688][ T6135] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1123.975637][ T6134] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8364'. [ 1124.215807][ T6132] lo speed is unknown, defaulting to 1000 [ 1124.292107][ T6132] ip6_vti0 speed is unknown, defaulting to 1000 [ 1124.701959][ T6149] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1124.719798][ T6149] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1124.847957][ T6150] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8366'. [ 1124.956503][ T6158] syzkaller0: entered promiscuous mode [ 1124.962291][ T6158] syzkaller0: entered allmulticast mode [ 1125.045869][ T6149] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1125.083430][ T6149] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1125.235037][ T6149] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1125.263097][ T6149] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1125.456861][ T6149] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1125.506217][ T6149] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1125.682818][ T3669] net_ratelimit: 21 callbacks suppressed [ 1125.682842][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1125.772674][ T3669] batman_adv: batadv1: IGMP Querier appeared [ 1125.778771][ T3669] batman_adv: batadv1: MLD Querier appeared [ 1125.872109][ T3669] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1125.890750][ T3669] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1125.904278][ T6178] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8374'. [ 1125.932802][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.060150][ T3669] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1126.077417][ T3669] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.132754][ T3669] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1126.161525][ T3669] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.185460][ T6184] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8375'. [ 1126.202781][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.319032][ T3671] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1126.328377][ T3671] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.415056][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.535314][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.642947][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.776575][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1126.784944][ T6197] lo speed is unknown, defaulting to 1000 [ 1126.795727][ T6197] ip6_vti0 speed is unknown, defaulting to 1000 [ 1126.892670][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1127.002727][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1127.024528][ T6210] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8383'. [ 1127.076666][ T6210] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8383'. [ 1127.123062][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1127.509383][ T6218] lo speed is unknown, defaulting to 1000 [ 1127.615598][ T6218] ip6_vti0 speed is unknown, defaulting to 1000 [ 1127.773578][ T6223] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8387'. [ 1128.095595][ T6231] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8390'. [ 1128.228595][ T6235] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8391'. [ 1129.207243][ T6264] lo speed is unknown, defaulting to 1000 [ 1129.218640][ T6264] ip6_vti0 speed is unknown, defaulting to 1000 [ 1129.287671][ T6262] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8399'. [ 1129.388463][ T6262] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8399'. [ 1129.423976][ T6262] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8399'. [ 1129.511274][ T6275] netlink: 'syz.2.8403': attribute type 9 has an invalid length. [ 1129.521519][ T6275] netlink: 'syz.2.8403': attribute type 11 has an invalid length. [ 1129.540926][ T6275] netlink: 'syz.2.8403': attribute type 12 has an invalid length. [ 1129.562797][ T6280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8401'. [ 1130.273695][ T6311] netlink: 'syz.2.8412': attribute type 13 has an invalid length. [ 1130.575674][ T6310] lo speed is unknown, defaulting to 1000 [ 1130.623828][ T6310] ip6_vti0 speed is unknown, defaulting to 1000 [ 1130.694402][ T3671] net_ratelimit: 16 callbacks suppressed [ 1130.694434][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1130.832719][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1130.944742][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.122868][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.305665][ T6336] __nla_validate_parse: 4 callbacks suppressed [ 1131.305688][ T6336] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8417'. [ 1131.328500][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.464861][ T3677] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.605281][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.733128][ T3674] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.862711][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1131.973396][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1132.170691][ T6374] lo speed is unknown, defaulting to 1000 [ 1132.265821][ T6374] ip6_vti0 speed is unknown, defaulting to 1000 [ 1132.384575][ T6390] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8433'. [ 1132.597215][ T6397] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8436'. [ 1132.610556][ T6398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8435'. [ 1133.566699][ T6443] netlink: 'syz.2.8449': attribute type 1 has an invalid length. [ 1133.760488][ T6454] netlink: 'syz.1.8453': attribute type 1 has an invalid length. [ 1133.778648][ T6454] netlink: 'syz.1.8453': attribute type 3 has an invalid length. [ 1133.786543][ T6454] netlink: 224 bytes leftover after parsing attributes in process `syz.1.8453'. [ 1133.950276][ T6466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8456'. [ 1133.960493][ T6466] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8456'. [ 1134.374906][ T6497] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8465'. [ 1134.433528][ T6494] lo speed is unknown, defaulting to 1000 [ 1134.498803][ T6494] ip6_vti0 speed is unknown, defaulting to 1000 [ 1135.119665][ T6528] bond8: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1135.139648][ T6533] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8478'. [ 1135.155412][ T6533] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8478'. [ 1135.163912][ T6528] bond8 (unregistering): Released all slaves [ 1135.694178][ T6557] vlan2: entered promiscuous mode [ 1135.710072][ T6557] bridge0: entered promiscuous mode [ 1135.752697][ T3672] net_ratelimit: 26 callbacks suppressed [ 1135.752719][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1135.899398][ T6575] lo speed is unknown, defaulting to 1000 [ 1135.905963][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1135.937440][ T6575] ip6_vti0 speed is unknown, defaulting to 1000 [ 1136.071560][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1136.195628][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1136.269230][ T6594] lo speed is unknown, defaulting to 1000 [ 1136.273290][ T6597] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1136.282473][ T6597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1136.312683][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1136.422679][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1136.511281][ T6605] lo speed is unknown, defaulting to 1000 [ 1136.535822][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1136.576261][ T6605] ip6_vti0 speed is unknown, defaulting to 1000 [ 1136.979089][ T6614] bond1: option min_links: invalid value (18446744073709551612) [ 1136.992727][ T6614] bond1: option min_links: allowed values 0 - 2147483647 [ 1137.007263][ T6614] bond1 (unregistering): Released all slaves [ 1137.107004][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1137.153806][ T6594] ip6_vti0 speed is unknown, defaulting to 1000 [ 1137.505666][ T6624] __nla_validate_parse: 4 callbacks suppressed [ 1137.505690][ T6624] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8505'. [ 1137.612099][ T6624] 8021q: adding VLAN 0 to HW filter on device .` [ 1137.641002][ T6624] 8021q: adding VLAN 0 to HW filter on device team0 [ 1137.870136][ T6636] lo speed is unknown, defaulting to 1000 [ 1138.013391][ T6636] ip6_vti0 speed is unknown, defaulting to 1000 [ 1138.015348][ T6644] netlink: 'syz.1.8508': attribute type 8 has an invalid length. [ 1138.101086][ T6638] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8506'. [ 1138.147884][ T6627] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8506'. [ 1138.203190][ T6644] syzkaller0: entered promiscuous mode [ 1138.222800][ T6644] syzkaller0: entered allmulticast mode [ 1138.304754][ T6648] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8508'. [ 1138.449439][ T6651] x_tables: unsorted underflow at hook 2 [ 1138.709621][ T6653] lo speed is unknown, defaulting to 1000 [ 1138.738717][ T6653] ip6_vti0 speed is unknown, defaulting to 1000 [ 1138.841484][ T6659] tipc: Enabling of bearer rejected, failed to enable media [ 1139.486020][ T6654] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8510'. [ 1139.732225][ T6679] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1140.347463][ T6695] FAULT_INJECTION: forcing a failure. [ 1140.347463][ T6695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1140.378610][ T6695] CPU: 0 UID: 0 PID: 6695 Comm: syz.0.8518 Not tainted syzkaller #0 PREEMPT(full) [ 1140.378641][ T6695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1140.378653][ T6695] Call Trace: [ 1140.378661][ T6695] [ 1140.378670][ T6695] dump_stack_lvl+0xe8/0x150 [ 1140.378704][ T6695] should_fail_ex+0x412/0x560 [ 1140.378737][ T6695] _copy_from_user+0x2d/0xb0 [ 1140.378760][ T6695] __copy_msghdr+0x3c5/0x5b0 [ 1140.378790][ T6695] ___sys_sendmsg+0x213/0x360 [ 1140.378812][ T6695] ? __lock_acquire+0x6b5/0x2cf0 [ 1140.378839][ T6695] ? __pfx____sys_sendmsg+0x10/0x10 [ 1140.378868][ T6695] ? kstrtouint+0x6e/0xe0 [ 1140.378922][ T6695] ? __fget_files+0x2a/0x420 [ 1140.378940][ T6695] ? __fget_files+0x3a0/0x420 [ 1140.378970][ T6695] __sys_sendmmsg+0x27c/0x4e0 [ 1140.379000][ T6695] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1140.379022][ T6695] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1140.379086][ T6695] ? ksys_write+0x242/0x270 [ 1140.379113][ T6695] ? __pfx_ksys_write+0x10/0x10 [ 1140.379143][ T6695] __x64_sys_sendmmsg+0xa0/0xc0 [ 1140.379168][ T6695] do_syscall_64+0x14d/0xf80 [ 1140.379191][ T6695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.379209][ T6695] ? trace_irq_disable+0x37/0x100 [ 1140.379231][ T6695] ? clear_bhb_loop+0x40/0x90 [ 1140.379254][ T6695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.379273][ T6695] RIP: 0033:0x7fe86179c629 [ 1140.379291][ T6695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1140.379307][ T6695] RSP: 002b:00007fe86269a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1140.379329][ T6695] RAX: ffffffffffffffda RBX: 00007fe861a15fa0 RCX: 00007fe86179c629 [ 1140.379344][ T6695] RDX: 0000000000000002 RSI: 0000200000000b00 RDI: 0000000000000004 [ 1140.379356][ T6695] RBP: 00007fe86269a090 R08: 0000000000000000 R09: 0000000000000000 [ 1140.379369][ T6695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1140.379381][ T6695] R13: 00007fe861a16038 R14: 00007fe861a15fa0 R15: 00007ffeb7b075b8 [ 1140.379415][ T6695] [ 1140.692995][ T6697] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8520'. [ 1140.720232][ T6704] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8523'. [ 1140.794542][ T6710] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8524'. [ 1140.892743][ T3669] net_ratelimit: 23 callbacks suppressed [ 1140.892767][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.032734][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.214884][ T6727] lo speed is unknown, defaulting to 1000 [ 1141.281151][ T6727] ip6_vti0 speed is unknown, defaulting to 1000 [ 1141.447462][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.572653][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.693327][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.745211][ T6748] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8533'. [ 1141.755478][ T6750] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8534'. [ 1141.802657][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1141.963673][ T3668] bond0: (slave bridge5): failed to get link speed/duplex [ 1142.192752][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1142.294468][ T6774] delete_channel: no stack [ 1142.318004][ T3672] bond0: (slave bridge5): failed to get link speed/duplex [ 1142.452777][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1142.638646][ T6798] __nla_validate_parse: 1 callbacks suppressed [ 1142.638667][ T6798] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8546'. [ 1142.781984][ T6801] bond8: Unable to set up delay as MII monitoring is disabled [ 1142.876435][ T6801] bond8 (unregistering): Released all slaves [ 1142.893017][ T6811] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1142.921312][ T6805] pimreg: entered allmulticast mode [ 1142.931350][ T6809] pimreg: left allmulticast mode [ 1142.945143][ T6817] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1142.954945][ T6807] ªªªªªª: renamed from wg2 [ 1143.036294][ T6811] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1143.081718][ T6811] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1143.094301][ T6810] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8549'. [ 1143.094926][ T6811] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1143.117789][ T6824] netlink: 'syz.0.8552': attribute type 3 has an invalid length. [ 1143.118930][ T6810] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8549'. [ 1143.126498][ T6811] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1143.126841][ T6811] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8550'. [ 1143.626346][ T6835] tipc: Resetting bearer [ 1143.737219][ T3671] netdevsim netdevsim1 ÿÿÿÿÿÿ: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.760680][ T3671] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.779900][ T3671] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.807883][ T3671] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.846918][ T6842] lo speed is unknown, defaulting to 1000 [ 1143.858941][ T6842] ip6_vti0 speed is unknown, defaulting to 1000 [ 1143.904517][ T6852] lo speed is unknown, defaulting to 1000 [ 1143.941252][ T6862] sch_tbf: burst 1 is lower than device syzkaller0 mtu (1500) ! [ 1143.961157][ T6862] syzkaller0: entered promiscuous mode [ 1143.971426][ T6862] syzkaller0: entered allmulticast mode [ 1143.995119][ T6862] netlink: 'syz.2.8562': attribute type 13 has an invalid length. [ 1144.185498][ T6852] ip6_vti0 speed is unknown, defaulting to 1000 [ 1145.012354][ T6864] xt_hashlimit: max too large, truncated to 1048576 [ 1145.637719][ T6914] xt_limit: Overflow, try lower: 271964/0 [ 1145.894400][ T6929] netlink: 'syz.4.8583': attribute type 2 has an invalid length. [ 1145.912464][ T6929] net_ratelimit: 19 callbacks suppressed [ 1145.912487][ T6929] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1145.993178][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1146.021736][ T6943] atomic_op ffff88807b14b998 conn xmit_atomic 0000000000000000 [ 1146.112728][ T3670] bond0: (slave bridge5): failed to get link speed/duplex [ 1146.131071][ T6953] ªªªªª9: renamed from lo (while UP) [ 1146.246628][ T3669] bond0: (slave bridge5): failed to get link speed/duplex [ 1146.300604][ T6957] geneve4: entered promiscuous mode [ 1146.309855][ T3671] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1146.388505][ T3671] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1146.398137][ T3671] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1146.462124][ T3671] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1146.492778][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1146.603282][ T3671] bond0: (slave bridge5): failed to get link speed/duplex [ 1146.686891][ T6977] lo speed is unknown, defaulting to 1000 [ 1146.703121][ T3668] bridge_slave_1: left promiscuous mode [ 1146.708951][ T3668] bridge0: port 2(bridge_slave_1) entered disabled state [ 1146.749986][ T3668] bridge_slave_0: left allmulticast mode [ 1146.755784][ T3668] bridge_slave_0: left promiscuous mode [ 1146.761605][ T3668] bridge0: port 1(bridge_slave_0) entered disabled state [ 1146.779102][ T6987] openvswitch: netlink: IP tunnel dst address not specified [ 1147.519772][ T3668] bond0 (unregistering): (slave bridge5): Removing an active aggregator [ 1147.539771][ T3668] bond0 (unregistering): (slave bridge5): Releasing backup interface [ 1147.559597][ T3668] bridge5 (unregistering): left promiscuous mode [ 1147.574511][ T3668] bridge5 (unregistering): left allmulticast mode [ 1147.797538][ T3668] bond6 (unregistering): (slave bridge8): Releasing backup interface [ 1147.805937][ T3668] bridge8 (unregistering): left promiscuous mode [ 1147.857464][ T3668] .` (unregistering): (slave 30): Releasing backup interface [ 1147.866959][ T3668] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1147.876402][ T3668] .` (unregistering): Released all slaves [ 1147.886637][ T3668] bond1 (unregistering): Released all slaves [ 1147.907432][ T3668] bond2 (unregistering): Released all slaves [ 1147.932972][ T3668] bond3 (unregistering): Released all slaves [ 1147.952323][ T3668] bond4 (unregistering): Released all slaves [ 1148.004342][ T3668] bond0 (unregistering): Released all slaves [ 1148.028097][ T3668] bond5 (unregistering): Released all slaves [ 1148.084141][ T3668] bond6 (unregistering): Released all slaves [ 1148.121719][ T3668] bond7 (unregistering): Released all slaves [ 1148.146017][ T6977] ip6_vti0 speed is unknown, defaulting to 1000 [ 1148.168377][ T6995] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1148.202371][ T6995] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1148.282044][ T7001] team_slave_1: Caught tx_queue_len zero misconfig [ 1148.393350][ T7017] syzkaller0: entered promiscuous mode [ 1148.398994][ T7017] syzkaller0: entered allmulticast mode [ 1148.422047][ T3668] tipc: Disabling bearer [ 1148.446045][ T3668] tipc: Left network mode [ 1148.534706][ T6996] lo speed is unknown, defaulting to 1000 [ 1150.690779][ T6996] ip6_vti0 speed is unknown, defaulting to 1000 [ 1151.271695][ T7060] __nla_validate_parse: 78 callbacks suppressed [ 1151.271717][ T7060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8609'. [ 1151.328681][ T7066] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8610'. [ 1151.605411][ T7074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8611'. [ 1151.725906][ T7079] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8613'. [ 1152.180334][ T7083] netlink: 76 bytes leftover after parsing attributes in process `syz.4.8614'. [ 1152.374614][ T7093] tipc: Enabled bearer , priority 26 [ 1152.408312][ T7091] xt_CT: No such helper "snmp_trap" [ 1152.431981][ T7098] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 1152.462019][ T7097] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 1152.520120][ T3668] hsr_slave_0: left promiscuous mode [ 1152.527695][ T3668] hsr_slave_1: left promiscuous mode [ 1152.534194][ T3668] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1152.552414][ T7106] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8620'. [ 1152.797448][ T3668] lo (unregistering): left allmulticast mode [ 1153.162094][ T7131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8625'. [ 1153.191263][ T7133] netlink: 'syz.4.8628': attribute type 1 has an invalid length. [ 1153.199332][ T7131] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8625'. [ 1153.386832][ T7133] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8628'. [ 1153.462342][ T7140] bond7: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1153.467930][ T7144] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8630'. [ 1153.498483][ T7150] netlink: 'syz.2.8627': attribute type 1 has an invalid length. [ 1153.524423][ T7140] bond7: (slave vxcan5): Error -95 calling set_mac_address [ 1153.577709][ T7133] bond7: (slave bridge6): Enslaving as an active interface with a down link [ 1153.592131][T18726] tipc: Node number set to 640502008 [ 1153.606710][ T7147] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1154.151568][ T7176] sctp: [Deprecated]: syz.1.8636 (pid 7176) Use of int in maxseg socket option. [ 1154.151568][ T7176] Use struct sctp_assoc_value instead [ 1154.295362][ T7176] netlink: 'syz.1.8636': attribute type 3 has an invalid length. [ 1154.303792][ T7191] syz_tun: entered allmulticast mode [ 1154.331202][ T7173] syz_tun: left allmulticast mode [ 1154.426338][ T7200] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1154.812091][ T7219] netlink: 'syz.1.8648': attribute type 1 has an invalid length. [ 1154.940110][ T7219] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1154.987220][ T7227] bond1: (slave dummy0): making interface the new active one [ 1155.022884][ T7227] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 1155.128174][ T7236] tipc: Enabling of bearer rejected, failed to enable media [ 1155.160858][ T7236] tipc: Enabling of bearer rejected, failed to enable media [ 1155.321464][ T7247] tipc: Enabling of bearer rejected, already enabled [ 1155.675147][ T7269] openvswitch: netlink: Flow actions attr not present in new flow. [ 1155.909478][ T7271] netlink: 'syz.4.8662': attribute type 33 has an invalid length. [ 1155.990477][ T7276] lo speed is unknown, defaulting to 1000 [ 1156.032014][ T7276] ip6_vti0 speed is unknown, defaulting to 1000 [ 1156.351510][ T7287] __nla_validate_parse: 12 callbacks suppressed [ 1156.351603][ T7287] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8668'. [ 1156.406241][ T7287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8668'. [ 1156.699856][ T7297] block nbd4: NBD_DISCONNECT [ 1156.739478][ T7297] block nbd4: Send disconnect failed -32 [ 1156.792262][ T7297] block nbd4: shutting down sockets [ 1156.956280][ T7304] netlink: 'syz.1.8672': attribute type 21 has an invalid length. [ 1156.989659][ T7304] netlink: 128 bytes leftover after parsing attributes in process `syz.1.8672'. [ 1157.237195][ T7304] netlink: 'syz.1.8672': attribute type 4 has an invalid length. [ 1157.254173][ T7304] netlink: 'syz.1.8672': attribute type 5 has an invalid length. [ 1157.323876][ T7304] netlink: 3 bytes leftover after parsing attributes in process `syz.1.8672'. [ 1157.461936][ T7315] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8673'. [ 1158.200708][ T7339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8677'. [ 1158.238161][ T7339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8677'. [ 1158.264285][ T7339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8677'. [ 1158.285302][ T7339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8677'. [ 1158.333711][ T7339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8677'. [ 1158.383433][ T7345] netlink: 'syz.2.8678': attribute type 1 has an invalid length. [ 1158.468423][ T7349] lo speed is unknown, defaulting to 1000 [ 1158.504712][ T7349] ip6_vti0 speed is unknown, defaulting to 1000 [ 1158.755618][ T7362] bridge7: entered promiscuous mode [ 1158.760880][ T7362] bridge7: entered allmulticast mode [ 1158.779070][ T7362] team0: Port device bridge7 added [ 1158.787127][ T7359] bridge0: port 1(team0) entered blocking state [ 1158.803196][ T7359] bridge0: port 1(team0) entered disabled state [ 1158.809676][ T7359] team0: entered allmulticast mode [ 1158.855074][ T7359] team0: entered promiscuous mode [ 1158.905346][ T7367] tipc: Enabled bearer , priority 0 [ 1158.924242][ T7367] syzkaller0: entered promiscuous mode [ 1158.929767][ T7367] syzkaller0: entered allmulticast mode [ 1159.167353][ T7365] tipc: Resetting bearer [ 1159.235791][ T7365] tipc: Disabling bearer [ 1159.258854][ T7378] netlink: 'syz.3.8687': attribute type 4 has an invalid length. [ 1159.308663][ T7383] netlink: 'syz.3.8687': attribute type 4 has an invalid length. [ 1159.340146][ T7376] lo speed is unknown, defaulting to 1000 [ 1159.344744][ T7378] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1159.355742][ T7376] ip6_vti0 speed is unknown, defaulting to 1000 [ 1159.371047][ T7378] smc: ib device syz2 ibport 2 applied user defined pnetid SYZ1 [ 1159.450045][ T7387] tipc: Enabled bearer , priority 0 [ 1159.481319][ T7386] tipc: Disabling bearer [ 1159.712429][ T7402] bond5: option tlb_dynamic_lb: invalid value (5) [ 1159.739391][ T7402] bond5 (unregistering): Released all slaves [ 1160.032922][ T7407] tipc: Enabled bearer , priority 0 [ 1160.052327][ T7401] syzkaller0: entered promiscuous mode [ 1160.058061][ T7401] syzkaller0: entered allmulticast mode [ 1160.073150][ T7400] tipc: Resetting bearer [ 1160.109930][ T7400] tipc: Disabling bearer [ 1160.121063][ T7412] syzkaller0: entered promiscuous mode [ 1160.126656][ T7412] syzkaller0: entered allmulticast mode [ 1161.009114][T30281] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1161.021490][T30281] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1161.030689][T30281] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1161.039402][T30281] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1161.052869][T30281] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1161.118920][ T5821] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1161.143575][ T5821] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1161.163640][ T5821] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1161.185857][ T5821] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1161.196857][ T5821] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1161.448981][ T7446] lo speed is unknown, defaulting to 1000 [ 1161.479829][ T7446] ip6_vti0 speed is unknown, defaulting to 1000 [ 1161.589620][ T6775] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1161.598116][ T6775] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1161.619446][ T7462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1161.658151][ T7462] nbd: must specify at least one socket [ 1162.093364][ T7495] FAULT_INJECTION: forcing a failure. [ 1162.093364][ T7495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1162.141157][ T7495] CPU: 1 UID: 0 PID: 7495 Comm: syz.2.8717 Not tainted syzkaller #0 PREEMPT(full) [ 1162.141186][ T7495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1162.141198][ T7495] Call Trace: [ 1162.141207][ T7495] [ 1162.141216][ T7495] dump_stack_lvl+0xe8/0x150 [ 1162.141250][ T7495] should_fail_ex+0x412/0x560 [ 1162.141285][ T7495] _copy_from_user+0x2d/0xb0 [ 1162.141308][ T7495] __sys_bpf+0x229/0x950 [ 1162.141335][ T7495] ? __pfx___sys_bpf+0x10/0x10 [ 1162.141376][ T7495] ? ksys_write+0x242/0x270 [ 1162.141403][ T7495] ? __pfx_ksys_write+0x10/0x10 [ 1162.141436][ T7495] __x64_sys_bpf+0x7c/0x90 [ 1162.141459][ T7495] do_syscall_64+0x14d/0xf80 [ 1162.141486][ T7495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1162.141505][ T7495] ? trace_irq_disable+0x37/0x100 [ 1162.141527][ T7495] ? clear_bhb_loop+0x40/0x90 [ 1162.141551][ T7495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1162.141570][ T7495] RIP: 0033:0x7f6b41f9c629 [ 1162.141590][ T7495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1162.141607][ T7495] RSP: 002b:00007f6b42e25028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1162.141630][ T7495] RAX: ffffffffffffffda RBX: 00007f6b42216090 RCX: 00007f6b41f9c629 [ 1162.141646][ T7495] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 1162.141660][ T7495] RBP: 00007f6b42e25090 R08: 0000000000000000 R09: 0000000000000000 [ 1162.141672][ T7495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1162.141685][ T7495] R13: 00007f6b42216128 R14: 00007f6b42216090 R15: 00007fffada5edc8 [ 1162.141719][ T7495] [ 1162.430942][ T7446] chnl_net:caif_netlink_parms(): no params data found [ 1162.520277][ T7509] tipc: Enabling of bearer rejected, already enabled [ 1162.615891][ T7446] bridge0: port 1(bridge_slave_0) entered blocking state [ 1162.623502][ T7446] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.630822][ T7446] bridge_slave_0: entered allmulticast mode [ 1162.647563][ T7446] bridge_slave_0: entered promiscuous mode [ 1162.657724][ T7446] bridge0: port 2(bridge_slave_1) entered blocking state [ 1162.665806][ T7446] bridge0: port 2(bridge_slave_1) entered disabled state [ 1162.673556][ T7446] bridge_slave_1: entered allmulticast mode [ 1162.685460][ T7446] bridge_slave_1: entered promiscuous mode [ 1162.714844][ T7521] netlink: 'syz.3.8725': attribute type 21 has an invalid length. [ 1162.751151][ T7523] __nla_validate_parse: 6 callbacks suppressed [ 1162.751171][ T7523] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8726'. [ 1162.797288][ T7446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1162.828265][ T7446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1162.911138][ T7446] team0: Port device team_slave_0 added [ 1162.934402][ T7446] team0: Port device team_slave_1 added [ 1162.988041][ T7446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1162.995889][ T7446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1163.025286][ T7446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1163.060609][ T7446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1163.069081][ T7446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1163.116635][ T7446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1163.158477][ T7530] lo speed is unknown, defaulting to 1000 [ 1163.211444][ T7530] ip6_vti0 speed is unknown, defaulting to 1000 [ 1163.230804][ T7533] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8729'. [ 1163.233082][ T7446] hsr_slave_0: entered promiscuous mode [ 1163.257799][ T7446] hsr_slave_1: entered promiscuous mode [ 1163.282975][ T5821] Bluetooth: hci0: command tx timeout [ 1163.390793][ T7538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8731'. [ 1163.538909][ T7542] lo speed is unknown, defaulting to 1000 [ 1163.679860][ T7446] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1163.706686][ T7446] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.806016][ T7446] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1163.821445][ T7446] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.868397][ T7554] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8734'. [ 1163.884402][ T7553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8734'. [ 1163.947992][ T7446] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1163.965530][ T7446] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.034133][ T7558] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8736'. [ 1164.049531][ T7446] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1164.060882][ T7446] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.081481][ T7542] ip6_vti0 speed is unknown, defaulting to 1000 [ 1164.153214][ T7564] netlink: 277 bytes leftover after parsing attributes in process `syz.2.8737'. [ 1164.280431][ T7567] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8738'. [ 1164.289979][ T7567] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8738'. [ 1164.295888][ T7568] netlink: 536 bytes leftover after parsing attributes in process `syz.2.8737'. [ 1165.331508][ T7446] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1165.363293][ T5821] Bluetooth: hci0: command tx timeout [ 1165.381928][ T7446] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1165.430242][ T7446] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1165.462721][ T7446] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1165.704762][ T7606] gretap0: entered promiscuous mode [ 1165.726706][ T7606] netlink: 'syz.2.8747': attribute type 1 has an invalid length. [ 1165.848988][ T7606] gre0: left allmulticast mode [ 1165.861045][ T7606] gretap0: left promiscuous mode [ 1165.871662][ T7606] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1165.986491][ T7446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1166.036437][ T7446] 8021q: adding VLAN 0 to HW filter on device team0 [ 1166.056045][ T2889] bridge0: port 1(bridge_slave_0) entered blocking state [ 1166.063411][ T2889] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1166.130783][ T6780] bridge0: port 2(bridge_slave_1) entered blocking state [ 1166.138006][ T6780] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1166.139009][ T7623] FAULT_INJECTION: forcing a failure. [ 1166.139009][ T7623] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1166.159698][ T7623] CPU: 0 UID: 0 PID: 7623 Comm: syz.0.8750 Not tainted syzkaller #0 PREEMPT(full) [ 1166.159725][ T7623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1166.159737][ T7623] Call Trace: [ 1166.159745][ T7623] [ 1166.159755][ T7623] dump_stack_lvl+0xe8/0x150 [ 1166.159785][ T7623] should_fail_ex+0x412/0x560 [ 1166.159818][ T7623] _copy_from_user+0x2d/0xb0 [ 1166.159840][ T7623] __copy_msghdr+0x3c5/0x5b0 [ 1166.159871][ T7623] ___sys_sendmsg+0x213/0x360 [ 1166.159894][ T7623] ? __lock_acquire+0x6b5/0x2cf0 [ 1166.159921][ T7623] ? __pfx____sys_sendmsg+0x10/0x10 [ 1166.159943][ T7623] ? __lock_acquire+0x6b5/0x2cf0 [ 1166.159968][ T7623] ? kstrtouint+0x6e/0xe0 [ 1166.160048][ T7623] __sys_sendmmsg+0x27c/0x4e0 [ 1166.160080][ T7623] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1166.160102][ T7623] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1166.160157][ T7623] ? ksys_write+0x242/0x270 [ 1166.160191][ T7623] ? __pfx_ksys_write+0x10/0x10 [ 1166.160223][ T7623] __x64_sys_sendmmsg+0xa0/0xc0 [ 1166.160250][ T7623] do_syscall_64+0x14d/0xf80 [ 1166.160275][ T7623] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.160293][ T7623] ? trace_irq_disable+0x37/0x100 [ 1166.160315][ T7623] ? clear_bhb_loop+0x40/0x90 [ 1166.160340][ T7623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.160358][ T7623] RIP: 0033:0x7fe86179c629 [ 1166.160377][ T7623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1166.160395][ T7623] RSP: 002b:00007fe86269a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1166.160416][ T7623] RAX: ffffffffffffffda RBX: 00007fe861a15fa0 RCX: 00007fe86179c629 [ 1166.160431][ T7623] RDX: 0000000000000002 RSI: 0000200000000b00 RDI: 0000000000000004 [ 1166.160443][ T7623] RBP: 00007fe86269a090 R08: 0000000000000000 R09: 0000000000000000 [ 1166.160455][ T7623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1166.160467][ T7623] R13: 00007fe861a16038 R14: 00007fe861a15fa0 R15: 00007ffeb7b075b8 [ 1166.160499][ T7623] [ 1166.774665][ T7643] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.3.8755:7643 [ 1166.785562][ T7446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1166.799368][ T7649] lo speed is unknown, defaulting to 1000 [ 1166.834769][ T7646] lo speed is unknown, defaulting to 1000 [ 1166.841841][ T7649] ip6_vti0 speed is unknown, defaulting to 1000 [ 1167.191602][ T7646] ip6_vti0 speed is unknown, defaulting to 1000 [ 1167.451376][T30281] Bluetooth: hci0: command tx timeout [ 1167.730392][ T7446] veth0_vlan: entered promiscuous mode [ 1167.770543][ T7674] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1167.998248][ T7446] veth1_vlan: entered promiscuous mode [ 1168.309774][ T7688] lo speed is unknown, defaulting to 1000 [ 1168.346896][ T7688] ip6_vti0 speed is unknown, defaulting to 1000 [ 1168.349847][ T7446] veth0_macvtap: entered promiscuous mode [ 1168.445952][ T7446] veth1_macvtap: entered promiscuous mode [ 1168.525195][ T7446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1168.555499][ T7446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1168.593578][ T7705] __nla_validate_parse: 5 callbacks suppressed [ 1168.593599][ T7705] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8766'. [ 1168.613984][ T1162] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.643848][ T1162] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.672783][ T2889] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.737013][ T2889] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1169.019815][ T6780] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1169.033099][ T6780] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1169.115357][ T6773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1169.151590][ T6773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1169.525016][T30281] Bluetooth: hci0: command 0x0419 tx timeout [ 1169.881328][ T7736] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1170.168521][ T7750] netlink: 708 bytes leftover after parsing attributes in process `syz.0.8774'. [ 1170.197811][ T7750] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 1170.311732][ T7759] tipc: Enabling of bearer rejected, already enabled [ 1170.590740][ T7771] bond0: (slave rose0): Error: Device type is different from other slaves [ 1170.717535][ T7776] lo speed is unknown, defaulting to 1000 [ 1170.722369][ T7778] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8780'. [ 1170.741281][ T7776] ip6_vti0 speed is unknown, defaulting to 1000 [ 1170.760092][ T7783] netlink: 7076 bytes leftover after parsing attributes in process `syz.4.8781'. [ 1170.775402][ T7783] openvswitch: netlink: Flow key attr not present in new flow. [ 1170.900820][ T7787] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1171.606010][T30281] Bluetooth: hci0: command 0x0419 tx timeout [ 1171.743470][ T7809] lo speed is unknown, defaulting to 1000 [ 1171.747882][ T7823] IPVS: set_ctl: invalid protocol: 1 100.1.1.2:20001 [ 1171.856749][ T7809] ip6_vti0 speed is unknown, defaulting to 1000 [ 1172.190906][T18732] IPVS: starting estimator thread 0... [ 1172.196789][ T7845] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:8060 [ 1172.219093][ T7847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8797'. [ 1172.332713][ T7848] IPVS: using max 30 ests per chain, 72000 per kthread [ 1172.419388][ T7845] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.767984][ T7845] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.975274][ T7845] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1173.178140][ T7845] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1173.277885][ T7876] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.8800'. [ 1173.297106][ T7881] batadv_slave_0: entered promiscuous mode [ 1173.367196][ T7881] batadv1: entered promiscuous mode [ 1173.491212][ T7880] batadv_slave_0: left promiscuous mode [ 1173.499113][ T1162] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1173.569716][ T1162] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1173.671366][ T6780] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1173.730710][ T2889] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1173.796295][ T7893] netlink: 'syz.1.8804': attribute type 8 has an invalid length. [ 1173.890741][ T7898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8805'. [ 1173.910674][ T7898] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8805'. [ 1173.942825][ T7898] netlink: 'syz.4.8805': attribute type 14 has an invalid length. [ 1173.982760][ T7898] netlink: 'syz.4.8805': attribute type 12 has an invalid length. [ 1174.131608][ T7912] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8809'. [ 1174.236723][ T7918] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8810'. [ 1174.400851][ T7920] lo speed is unknown, defaulting to 1000 [ 1174.446750][ T7920] ip6_vti0 speed is unknown, defaulting to 1000 [ 1174.772864][ T7936] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8817'. [ 1175.241741][ T7946] netem: change failed [ 1175.261196][ T7946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8820'. [ 1175.286743][ T7946] bridge0: port 2(bridge_slave_1) entered disabled state [ 1175.315377][ T7946] bridge_slave_1 (unregistering): left allmulticast mode [ 1175.323576][ T7946] bridge_slave_1 (unregistering): left promiscuous mode [ 1175.330829][ T7946] bridge0: port 2(bridge_slave_1) entered disabled state [ 1175.866336][ T7970] netlink: 'syz.1.8827': attribute type 10 has an invalid length. [ 1175.877678][ T7970] netlink: 2 bytes leftover after parsing attributes in process `syz.1.8827'. [ 1175.877826][ T7968] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8825'. [ 1175.887069][ T7970] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1175.907478][ T7970] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1175.919040][ T7970] hsr0: entered promiscuous mode [ 1175.927598][ T7970] bridge0: port 3(hsr0) entered blocking state [ 1175.935182][ T7970] bridge0: port 3(hsr0) entered disabled state [ 1175.941646][ T7970] hsr0: entered allmulticast mode [ 1175.947167][ T7970] hsr_slave_0: entered allmulticast mode [ 1175.955290][ T7970] hsr_slave_1: entered allmulticast mode [ 1176.114100][ T7976] syzkaller0: entered allmulticast mode [ 1176.156728][ T7974] syzkaller0: left allmulticast mode [ 1176.253101][ T7989] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8834'. [ 1176.286064][ T7989] vlan0: entered promiscuous mode [ 1176.291265][ T7989] bond0: entered promiscuous mode [ 1176.328998][ T7990] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8834'. [ 1176.352481][ T7995] tipc: Resetting bearer [ 1176.432833][ T7998] 8021q: VLANs not supported on ip6gre0 [ 1176.540911][ T8003] siw: device registration error -23 [ 1176.607483][ T8005] lo speed is unknown, defaulting to 1000 [ 1176.622373][ T8005] ip6_vti0 speed is unknown, defaulting to 1000 [ 1177.117102][ T7995] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1177.127923][ T7995] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 1177.213633][ T8019] bond2: (slave ªªªªª9): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1177.232909][ T8019] A link change request failed with some changes committed already. Interface ªªªªª9 may have been left with an inconsistent configuration, please check. [ 1177.949934][ T8039] lo speed is unknown, defaulting to 1000 [ 1177.957822][ T8039] ip6_vti0 speed is unknown, defaulting to 1000 [ 1178.226286][ T8068] syzkaller0: entered promiscuous mode [ 1178.272950][ T8068] syzkaller0: entered allmulticast mode [ 1178.539657][ T8077] xt_CONNSECMARK: invalid mode: 0 [ 1178.595701][ T8070] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1178.876065][ T8085] tipc: Enabled bearer , priority 0 [ 1178.986909][ T8085] tipc: Resetting bearer [ 1179.174335][ T8091] gretap0: entered promiscuous mode [ 1179.180243][ T8091] vlan2: entered promiscuous mode [ 1179.210639][ T8100] __nla_validate_parse: 2 callbacks suppressed [ 1179.210661][ T8100] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8859'. [ 1179.247232][ T8097] netlink: 248 bytes leftover after parsing attributes in process `syz.0.8858'. [ 1179.484940][ T8107] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8860'. [ 1179.889182][ T8126] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8866'. [ 1179.912949][ T8126] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8866'. [ 1179.992849][ T8130] bridge8: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1180.079622][ T8126] erspan0: entered promiscuous mode [ 1180.137138][T18732] tipc: Node number set to 3498978271 [ 1180.369653][ T8148] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1180.381927][ T8151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8872'. [ 1180.415223][ T8151] sctp: [Deprecated]: syz.4.8872 (pid 8151) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1180.415223][ T8151] Use struct sctp_sack_info instead [ 1180.711347][ T8171] syzkaller1: entered promiscuous mode [ 1180.720762][ T8171] syzkaller1: entered allmulticast mode [ 1180.889131][ T8188] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8879'. [ 1181.214426][ T8193] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8883'. [ 1181.238602][ T8193] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 1181.276263][ T8193] IPVS: set_ctl: invalid protocol: 58 224.0.0.2:0 [ 1181.336736][ T8193] gretap4: entered promiscuous mode [ 1181.383013][ T8202] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8885'. [ 1181.410901][ T5821] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1181.422013][ T5821] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1181.433699][ T5821] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1181.445590][ T5821] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1181.462135][ T5821] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1181.556634][T30281] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1181.564215][T30281] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1181.571673][T30281] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1181.581063][T30281] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1181.588898][T30281] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1181.671937][ T8201] lo speed is unknown, defaulting to 1000 [ 1181.773298][ T8201] ip6_vti0 speed is unknown, defaulting to 1000 [ 1182.059485][T18722] syz1: Port: 1 Link DOWN [ 1182.330579][ T8218] lo speed is unknown, defaulting to 1000 [ 1182.370650][ T8218] ip6_vti0 speed is unknown, defaulting to 1000 [ 1182.592143][ T8246] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8895'. [ 1182.698913][ T8201] chnl_net:caif_netlink_parms(): no params data found [ 1183.120049][ T8201] bridge0: port 1(bridge_slave_0) entered blocking state [ 1183.136215][ T8201] bridge0: port 1(bridge_slave_0) entered disabled state [ 1183.280144][ T8201] bridge_slave_0: entered allmulticast mode [ 1183.291088][ T8201] bridge_slave_0: entered promiscuous mode [ 1183.311958][ T8201] bridge0: port 2(bridge_slave_1) entered blocking state [ 1183.328876][ T8201] bridge0: port 2(bridge_slave_1) entered disabled state [ 1183.346423][ T8201] bridge_slave_1: entered allmulticast mode [ 1183.492027][ T8201] bridge_slave_1: entered promiscuous mode [ 1183.603894][ T5821] Bluetooth: hci2: command tx timeout [ 1183.730616][ T8201] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1183.769964][ T8201] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1183.797127][ T8272] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.996875][ T8276] syzkaller0: entered promiscuous mode [ 1184.002905][ T8276] syzkaller0: entered allmulticast mode [ 1184.025965][ T8272] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1184.085809][ T8201] team0: Port device team_slave_0 added [ 1184.101161][ T8201] team0: Port device team_slave_1 added [ 1184.170643][ T8272] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1184.193097][ T8287] vlan2: entered allmulticast mode [ 1184.198302][ T8287] bond0: entered allmulticast mode [ 1184.203741][ T8287] veth5: entered allmulticast mode [ 1184.208881][ T8287] bond3: entered allmulticast mode [ 1184.217704][ T8201] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1184.224838][ T8201] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1184.257700][ T8201] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1184.273468][ T8201] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1184.280812][ T8201] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1184.307059][ T8201] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1184.325364][ T8289] .` (unregistering): left allmulticast mode [ 1184.331393][ T8289] bond_slave_0: left allmulticast mode [ 1184.338320][ T8289] bond_slave_1: left allmulticast mode [ 1184.344126][ T8289] .` (unregistering): left promiscuous mode [ 1184.350204][ T8289] bond_slave_0: left promiscuous mode [ 1184.373329][ T8289] bond_slave_1: left promiscuous mode [ 1184.379206][ T8289] bridge0: port 2(.`) entered disabled state [ 1184.391240][ T8289] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1184.408091][ T8289] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1184.422293][ T8289] .` (unregistering): Released all slaves [ 1184.448323][ T8272] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1184.540424][ T8201] hsr_slave_0: entered promiscuous mode [ 1184.547049][ T8201] hsr_slave_1: entered promiscuous mode [ 1184.555749][ T8201] debugfs: 'hsr0' already exists in 'hsr' [ 1184.561588][ T8201] Cannot create hsr debugfs directory [ 1185.696260][ T5821] Bluetooth: hci2: command tx timeout [ 1186.553202][ T8297] bridge0: port 2(veth0_to_bridge) entered blocking state [ 1186.560510][ T8297] bridge0: port 2(veth0_to_bridge) entered disabled state [ 1186.568160][ T8297] veth0_to_bridge: entered allmulticast mode [ 1186.576826][ T8297] veth0_to_bridge: entered promiscuous mode [ 1186.648741][ T1162] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1186.726942][ T8312] netlink: 'syz.0.8912': attribute type 12 has an invalid length. [ 1186.736213][ T8312] __nla_validate_parse: 1 callbacks suppressed [ 1186.736233][ T8312] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8912'. [ 1186.784946][ T1162] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1186.894426][ T2889] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1187.031953][ T8330] macsec1: entered allmulticast mode [ 1187.038984][ T8330] macsec0: entered allmulticast mode [ 1187.051231][ T8330] veth1_macvtap: entered allmulticast mode [ 1187.060933][ T2889] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1187.304721][ T8201] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1187.338235][ T8342] netlink: 'syz.0.8919': attribute type 1 has an invalid length. [ 1187.356532][ T8342] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8919'. [ 1187.405769][ T8321] lec:lec_atm_close: lec0: Shut down! [ 1187.458418][ T8201] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1187.510242][ T8347] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8920'. [ 1187.534752][ T8349] syzkaller1: entered promiscuous mode [ 1187.555150][ T8349] syzkaller1: entered allmulticast mode [ 1187.635180][ T8201] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1187.762966][ T5821] Bluetooth: hci2: command tx timeout [ 1187.828305][ T8201] netdevsim netdevsim1 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1187.890906][ T8362] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8924'. [ 1188.311198][ T8380] lo speed is unknown, defaulting to 1000 [ 1188.340037][ T8201] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1188.374603][ T8201] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1188.402312][ T8380] ip6_vti0 speed is unknown, defaulting to 1000 [ 1188.411296][ T8381] syzkaller0: entered promiscuous mode [ 1188.432249][ T8381] syzkaller0: entered allmulticast mode [ 1188.446713][ T8201] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1188.471963][ T8201] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1188.504113][ T8381] pimreg: tun_chr_ioctl cmd 1074025677 [ 1188.509812][ T8381] pimreg: linktype set to 774 [ 1188.527682][ T8381] netlink: 'syz.0.8927': attribute type 21 has an invalid length. [ 1188.891214][ T8404] sctp: [Deprecated]: syz.3.8929 (pid 8404) Use of int in max_burst socket option deprecated. [ 1188.891214][ T8404] Use struct sctp_assoc_value instead [ 1188.910989][ T8201] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1188.963705][T18722] lec:lec_start_xmit: lec0:No lecd attached [ 1189.010661][ T8201] 8021q: adding VLAN 0 to HW filter on device team0 [ 1189.079775][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 1189.087051][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1189.132004][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 1189.139238][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1189.193604][ T8409] tipc: Enabled bearer , priority 0 [ 1189.778148][ T8431] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1189.845851][ T5821] Bluetooth: hci2: command tx timeout [ 1189.878746][ T8431] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1189.982137][ T8201] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1190.018193][ T8413] tipc: Disabling bearer [ 1190.062324][ T8439] tipc: Enabled bearer , priority 14 [ 1190.146327][ T8201] veth0_vlan: entered promiscuous mode [ 1190.198470][ T8201] veth1_vlan: entered promiscuous mode [ 1190.315514][ T8201] veth0_macvtap: entered promiscuous mode [ 1190.362257][ T8201] veth1_macvtap: entered promiscuous mode [ 1190.370877][ T8452] netlink: 76 bytes leftover after parsing attributes in process `syz.3.8939'. [ 1190.432227][ T8201] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1190.465649][ T8458] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8939'. [ 1190.490418][ T8201] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1190.554528][ T3663] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.585825][ T3663] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.610022][ T3663] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.633028][ T3663] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.815287][ T6775] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1190.839415][ T6775] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1190.889678][ T3663] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1190.911966][ T3663] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1190.980424][ T8470] lo: entered allmulticast mode [ 1190.987038][ T8470] tunl0: entered allmulticast mode [ 1190.993911][ T8470] gre0: entered allmulticast mode [ 1191.001691][ T8470] gretap0: entered allmulticast mode [ 1191.008675][ T8470] erspan0: entered allmulticast mode [ 1191.021001][ T8470] ip_vti0: entered allmulticast mode [ 1191.028204][ T8470] ip6_vti0: entered allmulticast mode [ 1191.028288][ T8472] netlink: 96 bytes leftover after parsing attributes in process `syz.2.8943'. [ 1191.035632][ T8470] sit0: entered allmulticast mode [ 1191.051403][ T8470] ip6tnl0: entered allmulticast mode [ 1191.058527][ T8470] ip6gre0: entered allmulticast mode [ 1191.064769][ T8470] syz_tun: entered allmulticast mode [ 1191.070510][ T8470] ip6gretap0: entered allmulticast mode [ 1191.077464][ T8470] bridge0: entered allmulticast mode [ 1191.083880][ T8470] vcan0: entered allmulticast mode [ 1191.089519][ T8470] bond0: entered allmulticast mode [ 1191.095126][ T8470] bond_slave_0: entered allmulticast mode [ 1191.100894][ T8470] bond_slave_1: entered allmulticast mode [ 1191.107692][ T8470] team0: entered allmulticast mode [ 1191.113714][ T8470] team_slave_0: entered allmulticast mode [ 1191.119466][ T8470] team_slave_1: entered allmulticast mode [ 1191.126442][ T8470] dummy0: entered allmulticast mode [ 1191.132965][ T8470] nlmon0: entered allmulticast mode [ 1191.138583][ T8470] caif0: entered allmulticast mode [ 1191.144887][ T8470] batadv0: entered allmulticast mode [ 1191.150881][ T8470] vxcan0: entered allmulticast mode [ 1191.157399][ T8470] vxcan1: entered allmulticast mode [ 1191.163802][ T8470] veth0: entered allmulticast mode [ 1191.169603][ T8470] veth1: entered allmulticast mode [ 1191.176882][ T8470] wg0: entered allmulticast mode [ 1191.186259][ T8470] wg1: entered allmulticast mode [ 1191.191855][ T8470] wg2: entered allmulticast mode [ 1191.197951][ T8470] veth0_to_bridge: entered allmulticast mode [ 1191.211939][ T8470] veth0_to_bond: entered allmulticast mode [ 1191.219829][ T8470] veth1_to_bond: entered allmulticast mode [ 1191.227770][ T8470] veth0_to_team: entered allmulticast mode [ 1191.235887][ T8470] veth1_to_team: entered allmulticast mode [ 1191.242742][ T8470] veth0_to_batadv: entered allmulticast mode [ 1191.249187][ T8470] batadv_slave_0: entered allmulticast mode [ 1191.256342][ T8470] veth1_to_batadv: entered allmulticast mode [ 1191.263818][ T8470] batadv_slave_1: entered allmulticast mode [ 1191.270255][ T8470] xfrm0: entered allmulticast mode [ 1191.277030][ T8470] veth0_to_hsr: entered allmulticast mode [ 1191.283921][ T8470] hsr_slave_0: entered allmulticast mode [ 1191.290262][ T8470] veth1_to_hsr: entered allmulticast mode [ 1191.297935][ T8470] hsr_slave_1: entered allmulticast mode [ 1191.305389][ T8470] hsr0: entered allmulticast mode [ 1191.310864][ T8470] veth1_virt_wifi: entered allmulticast mode [ 1191.318323][ T8470] veth0_virt_wifi: entered allmulticast mode [ 1191.325207][ T8470] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1191.333797][ T8470] veth1_vlan: entered allmulticast mode [ 1191.340113][ T8470] veth0_vlan: entered allmulticast mode [ 1191.348177][ T8470] vlan0: entered allmulticast mode [ 1191.354720][ T8470] vlan1: entered allmulticast mode [ 1191.360542][ T8470] macvlan0: entered allmulticast mode [ 1191.367921][ T8470] macvlan1: entered allmulticast mode [ 1191.375068][ T8470] ipvlan0: entered allmulticast mode [ 1191.380546][ T8470] ipvlan1: entered allmulticast mode [ 1191.386975][ T8470] veth1_macvtap: entered allmulticast mode [ 1191.395329][ T8470] veth0_macvtap: entered allmulticast mode [ 1191.401636][ T8470] macvtap0: entered allmulticast mode [ 1191.408362][ T8470] macsec0: entered allmulticast mode [ 1191.414700][ T8470] geneve0: entered allmulticast mode [ 1191.420427][ T8470] geneve1: entered allmulticast mode [ 1191.427247][ T8470] mac80211_hwsim hwsim90 wlan0: entered allmulticast mode [ 1191.435328][ T8470] mac80211_hwsim hwsim91 wlan1: entered allmulticast mode [ 1191.443107][ T8470] mac80211_hwsim hwsim92 wlan2: entered allmulticast mode [ 1191.450381][ T8470] vxlan0: entered allmulticast mode [ 1191.459584][ T8470] netdevsim netdevsim4 eth0: entered allmulticast mode [ 1191.467479][ T8470] netdevsim netdevsim4 eth1: entered allmulticast mode [ 1191.475633][ T8470] netdevsim netdevsim4 eth2: entered allmulticast mode [ 1191.482761][ T8470] netdevsim netdevsim4 eth3: entered allmulticast mode [ 1191.679443][ T8484] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 1191.899436][ T8497] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8951'. [ 1191.932848][ T8496] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8950'. [ 1191.939093][ T8497] batadv_slave_1: entered promiscuous mode [ 1191.951354][ T8496] openvswitch: netlink: Flow actions attr not present in new flow. [ 1191.959633][ T8497] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8951'. [ 1191.978688][ T8505] hsr0: left allmulticast mode [ 1191.984660][ T8505] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1192.013117][T30281] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1192.023970][T30281] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1192.032478][ T8506] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1192.053817][T30281] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1192.066016][T30281] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1192.085088][T30281] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1192.161245][ T8508] lo speed is unknown, defaulting to 1000 [ 1192.174722][ T8508] ip6_vti0 speed is unknown, defaulting to 1000 [ 1192.340177][ T8517] syzkaller0: entered promiscuous mode [ 1192.353663][ T8517] syzkaller0: entered allmulticast mode [ 1192.458496][ T8517] tipc: Started in network mode [ 1192.485861][ T8517] tipc: Node identity a69f96e93f21, cluster identity 4711 [ 1192.523373][ T8517] tipc: Enabled bearer , priority 0 [ 1192.564869][ T8513] tipc: Resetting bearer [ 1192.605259][ T8532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1192.615035][ T8531] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8961'. [ 1192.664469][ T8513] tipc: Disabling bearer [ 1192.731207][ T8533] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8960'. [ 1192.789574][ T8535] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8962'. [ 1192.853799][ T8536] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8960'. [ 1193.278458][ T8550] tipc: Enabling of bearer rejected, media not registered [ 1193.391028][ T8553] netlink: 'syz.1.8967': attribute type 29 has an invalid length. [ 1193.413537][ T8553] netlink: 'syz.1.8967': attribute type 29 has an invalid length. [ 1193.439702][ T8553] netlink: 500 bytes leftover after parsing attributes in process `syz.1.8967'. [ 1193.555882][ T8556] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8968'. [ 1193.578424][ T8508] chnl_net:caif_netlink_parms(): no params data found [ 1193.611024][ T8557] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8968'. [ 1193.857872][ T8508] bridge0: port 1(bridge_slave_0) entered blocking state [ 1193.872774][ T8508] bridge0: port 1(bridge_slave_0) entered disabled state [ 1193.884779][ T8508] bridge_slave_0: entered allmulticast mode [ 1193.924663][ T8508] bridge_slave_0: entered promiscuous mode [ 1193.952201][ T8508] bridge0: port 2(bridge_slave_1) entered blocking state [ 1193.969573][ T8508] bridge0: port 2(bridge_slave_1) entered disabled state [ 1193.987204][ T8508] bridge_slave_1: entered allmulticast mode [ 1193.995961][ T8508] bridge_slave_1: entered promiscuous mode [ 1194.002553][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5040 ms [ 1194.011282][ C0] lec:lec_tx_timeout: lec0 [ 1194.022914][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1194.032078][ T8570] x_tables: unsorted entry at hook 3 [ 1194.057469][ T8569] tipc: Enabling of bearer rejected, already enabled [ 1194.120322][ T8508] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1194.152725][ T8508] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1194.163286][T30281] Bluetooth: hci1: command tx timeout [ 1194.295558][ T8508] team0: Port device team_slave_0 added [ 1194.314064][ T8508] team0: Port device team_slave_1 added [ 1194.336480][ T8582] netlink: 'syz.1.8978': attribute type 13 has an invalid length. [ 1194.375987][ T8584] xt_hashlimit: overflow, rate too high: 0 [ 1194.413630][ T8582] netlink: 'syz.1.8978': attribute type 17 has an invalid length. [ 1194.441468][ T8508] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1194.452008][ T8584] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1194.459835][ T8508] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1194.487694][ T8508] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1194.525776][ T8508] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1194.539180][ T8508] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1194.567148][ T8508] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1194.588500][ T8592] gretap2: entered promiscuous mode [ 1194.718657][ T8508] hsr_slave_0: entered promiscuous mode [ 1194.727823][ T8508] hsr_slave_1: entered promiscuous mode [ 1194.735043][ T8508] debugfs: 'hsr0' already exists in 'hsr' [ 1194.740812][ T8508] Cannot create hsr debugfs directory [ 1194.792211][ T8596] siw: device registration error -23 [ 1195.244876][ T8608] syzkaller1: entered promiscuous mode [ 1195.252151][ T8608] syzkaller1: entered allmulticast mode [ 1195.294220][ T8608] ip6erspan0: entered promiscuous mode [ 1195.369479][ T8610] tipc: Enabling of bearer rejected, already enabled [ 1195.480525][ T8508] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1195.502798][ T8508] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1195.751797][ T8508] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1195.763820][ T8508] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1195.934710][ T8508] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1195.953242][ T8508] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1195.996265][ T8624] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 1196.020109][ T8624] batman_adv: batadv0: Adding interface: gretap1 [ 1196.027252][ T8624] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1196.053972][ T8624] batman_adv: batadv0: Interface activated: gretap1 [ 1196.068579][ T8626] erspan0: entered promiscuous mode [ 1196.094150][ T8626] gretap0: entered promiscuous mode [ 1196.100891][ T8626] debugfs: 'hsr1' already exists in 'hsr' [ 1196.107043][ T8626] Cannot create hsr debugfs directory [ 1196.107092][ T8635] IPVS: length: 153 != 8 [ 1196.169807][ T8508] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1196.187341][ T8508] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.244969][T30281] Bluetooth: hci1: command tx timeout [ 1196.288496][ T8631] lo speed is unknown, defaulting to 1000 [ 1196.316965][ T8631] ip6_vti0 speed is unknown, defaulting to 1000 [ 1196.507542][ T8647] IPVS: Unknown mcast interface: macvlan0 [ 1196.571890][ T8508] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1196.592234][ T8508] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1196.618953][ T8508] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1196.640230][ T8508] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1196.720563][ T8655] netlink: 'syz.4.9000': attribute type 1 has an invalid length. [ 1196.833259][ T8508] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1196.906556][ T8508] 8021q: adding VLAN 0 to HW filter on device team0 [ 1196.924557][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 1196.931844][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1196.967979][ T6775] bridge0: port 2(bridge_slave_1) entered blocking state [ 1196.975358][ T6775] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1197.212909][ T8665] __nla_validate_parse: 5 callbacks suppressed [ 1197.212930][ T8665] netlink: 68 bytes leftover after parsing attributes in process `syz.4.9002'. [ 1197.389955][ T8508] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1197.519822][ T8676] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 1197.575348][ T8508] veth0_vlan: entered promiscuous mode [ 1197.650288][ T8508] veth1_vlan: entered promiscuous mode [ 1197.678313][ T8683] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9006'. [ 1197.719405][ T8683] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9006'. [ 1197.736249][ T8508] veth0_macvtap: entered promiscuous mode [ 1197.771909][ T8686] netlink: 'syz.1.9007': attribute type 3 has an invalid length. [ 1197.780389][ T8686] netlink: 666 bytes leftover after parsing attributes in process `syz.1.9007'. [ 1197.798407][ T8508] veth1_macvtap: entered promiscuous mode [ 1197.849113][ T8508] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1197.894436][ T8508] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1197.935600][ T6775] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.953865][ T6775] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.974735][ T8693] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9008'. [ 1197.985808][ T6775] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1197.995838][ T6775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1198.068865][ T8697] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9008'. [ 1198.099443][ T6775] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1198.118970][ T6775] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1198.155212][ T6773] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1198.168002][ T6773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1198.323022][T30281] Bluetooth: hci1: command tx timeout [ 1198.440124][ T8709] bridge9: entered allmulticast mode [ 1198.551425][ T8714] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9016'. [ 1198.624213][ T8714] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9016'. [ 1198.638330][ T8714] tipc: Enabling of bearer rejected, failed to enable media [ 1198.652589][ T8723] bridge0: port 1(bridge_slave_0) entered disabled state [ 1198.663167][ T8723] bridge0: left allmulticast mode [ 1198.715819][ T8728] bond8: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 1198.743033][ T8728] bond8 (unregistering): Released all slaves [ 1199.032635][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1199.040779][ C0] lec:lec_tx_timeout: lec0 [ 1199.045801][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1199.124743][ T8744] lo speed is unknown, defaulting to 1000 [ 1199.151010][ T8744] ip6_vti0 speed is unknown, defaulting to 1000 [ 1199.177197][ T8754] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1199.196956][ T8754] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1199.212012][ T8754] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1199.708537][ T8765] lo speed is unknown, defaulting to 1000 [ 1199.719016][ T8765] ip6_vti0 speed is unknown, defaulting to 1000 [ 1200.430988][T30281] Bluetooth: hci1: command tx timeout [ 1201.774619][ T8733] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1202.089189][ T8806] vcan0: left allmulticast mode [ 1202.128869][ T8808] xt_connbytes: Forcing CT accounting to be enabled [ 1202.192314][ T8815] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9039'. [ 1202.342982][ T8829] netlink: 36 bytes leftover after parsing attributes in process `syz.3.9040'. [ 1202.393678][ T8816] lo speed is unknown, defaulting to 1000 [ 1202.483404][T30281] Bluetooth: hci1: command tx timeout [ 1202.531151][ T8816] ip6_vti0 speed is unknown, defaulting to 1000 [ 1202.536716][ T8819] lo speed is unknown, defaulting to 1000 [ 1202.982166][ T8856] tipc: Started in network mode [ 1203.046009][ T8856] tipc: Node identity , cluster identity 4711 [ 1203.067093][ T8856] tipc: Failed to set node id, please configure manually [ 1203.093531][ T8856] tipc: Enabling of bearer rejected, failed to enable media [ 1203.189557][ T8862] bond1 (unregistering): Released all slaves [ 1203.222210][ T8819] ip6_vti0 speed is unknown, defaulting to 1000 [ 1204.052847][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1204.061042][ C0] lec:lec_tx_timeout: lec0 [ 1204.065771][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1204.110536][ T8901] netlink: 'syz.1.9055': attribute type 1 has an invalid length. [ 1204.230750][ T8894] openvswitch: netlink: Flow key attr not present in new flow. [ 1204.313315][ T8896] syzkaller0: entered promiscuous mode [ 1204.318861][ T8896] syzkaller0: entered allmulticast mode [ 1204.548865][ T8906] tipc: Enabling of bearer rejected, already enabled [ 1204.579999][ T8906] tipc: Resetting bearer [ 1204.846870][ T8928] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9058'. [ 1204.897733][ T8929] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9058'. [ 1205.001752][ T8929] bond6: entered promiscuous mode [ 1205.007505][ T8929] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1205.342842][ T8947] netlink: 'syz.2.9064': attribute type 1 has an invalid length. [ 1205.457835][ T8950] ip6gretap1: entered promiscuous mode [ 1205.612887][ T8964] sctp: [Deprecated]: syz.3.9068 (pid 8964) Use of int in max_burst socket option. [ 1205.612887][ T8964] Use struct sctp_assoc_value instead [ 1205.665625][ T8964] 8021q: VLANs not supported on ip_vti0 [ 1205.897764][ T8981] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9074'. [ 1206.000042][ T8985] lo speed is unknown, defaulting to 1000 [ 1206.035552][ T8985] ip6_vti0 speed is unknown, defaulting to 1000 [ 1206.095337][ T8990] tipc: Started in network mode [ 1206.107781][ T8990] tipc: Node identity a2732cd5f512, cluster identity 4711 [ 1206.125532][ T8990] tipc: Enabled bearer , priority 0 [ 1206.158011][ T8990] syzkaller0: entered promiscuous mode [ 1206.181555][ T8990] syzkaller0: entered allmulticast mode [ 1206.248216][ T9004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9082'. [ 1206.260638][ T8990] tipc: Resetting bearer [ 1206.277543][ T9002] block nbd4: Unsupported socket: should be TCP or UNIX. [ 1206.331265][ T8990] bond1: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1206.355986][ T8990] bond1 (unregistering): Released all slaves [ 1206.445445][ T8989] tipc: Resetting bearer [ 1206.475160][ T8989] tipc: Disabling bearer [ 1206.498643][ T9010] tipc: Enabled bearer , priority 0 [ 1206.507130][ T9010] syzkaller0: entered promiscuous mode [ 1206.513164][ T9010] syzkaller0: entered allmulticast mode [ 1206.552252][ T9012] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9085'. [ 1206.564577][ T9012] netlink: 'syz.4.9085': attribute type 1 has an invalid length. [ 1206.580905][ T9012] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9085'. [ 1206.591154][ T9010] tipc: Resetting bearer [ 1206.598742][ T9010] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1206.732725][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1206.800913][ T9020] tap0: tun_chr_ioctl cmd 35111 [ 1206.862359][ T9024] syzkaller0: entered promiscuous mode [ 1206.886748][ T9024] syzkaller0: entered allmulticast mode [ 1206.937931][ T9028] tipc: Enabling of bearer rejected, already enabled [ 1207.002701][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.232211][ T9034] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9092'. [ 1207.243420][ T9030] vti0: entered promiscuous mode [ 1207.258011][ T9008] tipc: Resetting bearer [ 1207.284623][ T9008] tipc: Disabling bearer [ 1207.529978][ T9050] syzkaller0: entered promiscuous mode [ 1207.553385][ T9050] syzkaller0: entered allmulticast mode [ 1207.581780][ T9050] netlink: 88 bytes leftover after parsing attributes in process `syz.2.9096'. [ 1207.606653][ T9055] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9095'. [ 1207.630183][ T9053] lo speed is unknown, defaulting to 1000 [ 1207.667150][ T9054] lo speed is unknown, defaulting to 1000 [ 1207.674620][ T9053] ip6_vti0 speed is unknown, defaulting to 1000 [ 1207.962262][ T9072] lo speed is unknown, defaulting to 1000 [ 1208.359515][ T9054] ip6_vti0 speed is unknown, defaulting to 1000 [ 1208.459072][ T9090] openvswitch: netlink: IP tunnel dst address not specified [ 1208.777392][ T9097] netlink: 5 bytes leftover after parsing attributes in process `syz.2.9104'. [ 1208.909913][ T9102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9104'. [ 1208.960875][ T9097] syzkaller1: entered promiscuous mode [ 1208.968017][ T9097] syzkaller1: entered allmulticast mode [ 1209.076493][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1209.084642][ C0] lec:lec_tx_timeout: lec0 [ 1209.089495][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1209.254038][ T9072] ip6_vti0 speed is unknown, defaulting to 1000 [ 1209.379439][ T9111] tap0: tun_chr_ioctl cmd 35111 [ 1209.943091][ T9134] netlink: 288 bytes leftover after parsing attributes in process `syz.4.9110'. [ 1210.069000][ T9139] sctp: [Deprecated]: syz.4.9110 (pid 9139) Use of int in max_burst socket option deprecated. [ 1210.069000][ T9139] Use struct sctp_assoc_value instead [ 1211.188553][ T9165] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9121'. [ 1211.210011][ T9165] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9121'. [ 1211.400414][ T9180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9124'. [ 1211.431281][ T9180] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9124'. [ 1211.600581][ T9192] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9127'. [ 1211.767939][ T9200] tipc: Failed to remove unknown binding: 66,0,0/640502008:975442852/975442854 [ 1211.794136][ T9200] tipc: Failed to remove unknown binding: 66,0,0/640502008:975442852/975442853 [ 1211.817678][ T9200] tipc: Failed to remove unknown binding: 66,0,0/640502008:975442852/975442854 [ 1211.847228][ T9200] tipc: Failed to remove unknown binding: 66,0,0/640502008:975442852/975442853 [ 1212.154227][ T9215] lo speed is unknown, defaulting to 1000 [ 1212.169687][ T9215] ip6_vti0 speed is unknown, defaulting to 1000 [ 1213.034666][ T9254] Cannot find set identified by id 65534 to match [ 1213.209269][ T9266] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.250794][ T9272] IPv6: NLM_F_CREATE should be specified when creating new route [ 1213.282598][ T9250] lo speed is unknown, defaulting to 1000 [ 1213.329395][ T9266] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.394789][ T5484] ip6gretap0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1213.418539][ T9277] netlink: 'syz.3.9147': attribute type 15 has an invalid length. [ 1213.462204][ T9250] ip6_vti0 speed is unknown, defaulting to 1000 [ 1213.475446][ T9266] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.558416][ T9266] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1213.785495][ T6773] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.832406][ T6773] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.896817][ T6773] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1213.919224][ T9292] syzkaller0: entered promiscuous mode [ 1213.933714][ T9292] syzkaller0: entered allmulticast mode [ 1213.979618][ T6773] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.006945][ T9292] x_tables: duplicate underflow at hook 3 [ 1214.102634][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1214.110754][ C0] lec:lec_tx_timeout: lec0 [ 1214.115849][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1214.207572][ T9305] __nla_validate_parse: 3 callbacks suppressed [ 1214.207596][ T9305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9156'. [ 1214.351961][ T9312] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9158'. [ 1214.437677][ T9290] lo speed is unknown, defaulting to 1000 [ 1214.558586][ T9290] ip6_vti0 speed is unknown, defaulting to 1000 [ 1215.037823][ T9337] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9163'. [ 1215.113368][ T9340] vlan2: entered allmulticast mode [ 1215.139277][ T9341] netlink: 14 bytes leftover after parsing attributes in process `syz.4.9164'. [ 1215.250121][ T9348] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9166'. [ 1215.261964][ T9341] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1215.306129][ T9341] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1215.336624][ T9341] bond0 (unregistering): Released all slaves [ 1215.525029][ T9355] xt_hashlimit: max too large, truncated to 1048576 [ 1215.728762][ T9368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9172'. [ 1215.748002][ T9368] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9172'. [ 1215.782222][ T6775] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1215.796668][ T6775] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1215.813642][ T6775] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1215.840938][ T6775] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1216.022228][ T9376] x_tables: duplicate underflow at hook 1 [ 1216.430419][ T9401] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9182'. [ 1216.607894][ T9412] sit1: entered promiscuous mode [ 1216.766897][ T9421] netlink: 48 bytes leftover after parsing attributes in process `syz.2.9189'. [ 1216.797646][ T9423] lo speed is unknown, defaulting to 1000 [ 1216.806114][ T9423] ip6_vti0 speed is unknown, defaulting to 1000 [ 1216.884403][ T9426] lo speed is unknown, defaulting to 1000 [ 1216.909736][ T9429] netlink: 260 bytes leftover after parsing attributes in process `syz.2.9191'. [ 1216.968435][ T9429] hsr0: entered promiscuous mode [ 1216.975544][ T9429] macvlan2: entered allmulticast mode [ 1216.981077][ T9429] hsr0: entered allmulticast mode [ 1216.990617][ T9429] hsr_slave_0: entered allmulticast mode [ 1216.996788][ T9429] hsr_slave_1: entered allmulticast mode [ 1217.155751][ T9426] ip6_vti0 speed is unknown, defaulting to 1000 [ 1217.596101][ T9436] IPVS: set_ctl: invalid protocol: 58 100.1.1.0:20004 [ 1217.824110][ T9453] openvswitch: netlink: Message has 6 unknown bytes. [ 1217.995361][ T9456] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1218.257365][ T9474] Bluetooth: MGMT ver 1.23 [ 1218.454731][ T9482] bridge19: entered allmulticast mode [ 1218.474743][ T9478] lo speed is unknown, defaulting to 1000 [ 1218.546354][ T9478] ip6_vti0 speed is unknown, defaulting to 1000 [ 1219.078438][ T9507] netlink: 'syz.1.9214': attribute type 15 has an invalid length. [ 1219.123554][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1219.131644][ C0] lec:lec_tx_timeout: lec0 [ 1219.137341][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1219.150967][ T9507] bond0: option resend_igmp: invalid value (196616) [ 1219.172031][ T9507] bond0: option resend_igmp: allowed values 0 - 255 [ 1219.296677][ T9511] netlink: 'syz.2.9215': attribute type 20 has an invalid length. [ 1219.522008][ T9518] __nla_validate_parse: 8 callbacks suppressed [ 1219.522030][ T9518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9217'. [ 1219.793929][ T9526] sctp: [Deprecated]: syz.0.9221 (pid 9526) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1219.793929][ T9526] Use struct sctp_sack_info instead [ 1219.845030][ T9530] sctp: [Deprecated]: syz.0.9221 (pid 9530) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1219.845030][ T9530] Use struct sctp_sack_info instead [ 1220.318485][ T9537] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1220.814017][ T9546] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1220.856483][ T9546] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1220.875871][T24238] IPVS: starting estimator thread 0... [ 1220.936812][ T9554] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9227'. [ 1220.965111][ T9548] netlink: 5 bytes leftover after parsing attributes in process `syz.0.9226'. [ 1220.975571][ T9550] IPVS: using max 26 ests per chain, 62400 per kthread [ 1220.984133][ T9548] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 1221.030738][ T9548] 0ªî{X¹¦: entered allmulticast mode [ 1221.060374][ T9548] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 1221.188007][ T9566] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1221.221234][ T9563] lo speed is unknown, defaulting to 1000 [ 1221.266814][ T9563] ip6_vti0 speed is unknown, defaulting to 1000 [ 1221.353466][ T9566] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9231'. [ 1221.486441][ T9580] syzkaller0: entered promiscuous mode [ 1221.514022][ T9580] syzkaller0: entered allmulticast mode [ 1221.904880][ T9595] block nbd0: Unsupported socket: should be TCP or UNIX. [ 1221.921133][ T9595] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9239'. [ 1222.048257][ T9598] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9240'. [ 1222.059225][ T9593] lo speed is unknown, defaulting to 1000 [ 1222.067139][ T9593] ip6_vti0 speed is unknown, defaulting to 1000 [ 1222.097717][ T9602] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9241'. [ 1222.257682][ T9608] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9242'. [ 1222.513433][ T9617] netlink: 68 bytes leftover after parsing attributes in process `syz.3.9243'. [ 1222.794233][ T9628] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9249'. [ 1223.404150][ T9644] IPVS: set_ctl: invalid protocol: 92 172.20.20.170:20000 [ 1224.208999][ T9667] netlink: 'syz.0.9261': attribute type 1 has an invalid length. [ 1224.217072][ T9667] netlink: 'syz.0.9261': attribute type 3 has an invalid length. [ 1224.226746][ T9667] netlink: 'syz.0.9261': attribute type 2 has an invalid length. [ 1224.266264][ T9669] siw: device registration error -23 [ 1224.458922][ T9678] nbd: socks must be embedded in a SOCK_ITEM attr [ 1224.529807][ T9686] netlink: 'syz.0.9264': attribute type 29 has an invalid length. [ 1224.608606][ T9692] __nla_validate_parse: 3 callbacks suppressed [ 1224.608627][ T9692] netlink: 388 bytes leftover after parsing attributes in process `syz.2.9265'. [ 1224.962653][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5820 ms [ 1224.970779][ C0] lec:lec_tx_timeout: lec0 [ 1224.976166][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1225.089450][ T9708] lo speed is unknown, defaulting to 1000 [ 1225.101817][ T9708] ip6_vti0 speed is unknown, defaulting to 1000 [ 1225.319792][ T9715] lo speed is unknown, defaulting to 1000 [ 1225.454783][ T9720] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9271'. [ 1225.528937][ T9715] ip6_vti0 speed is unknown, defaulting to 1000 [ 1225.830999][ T9712] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 1225.960442][ T9737] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9275'. [ 1226.076778][ T9738] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9276'. [ 1226.344639][ T9753] netlink: 'syz.0.9280': attribute type 1 has an invalid length. [ 1226.551339][ T9765] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9280'. [ 1227.332938][ T9797] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9287'. [ 1227.353013][ T9796] netlink: 280 bytes leftover after parsing attributes in process `syz.0.9287'. [ 1227.393450][ T9804] Bluetooth: MGMT ver 1.23 [ 1227.450012][ T9805] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9288'. [ 1227.452808][ T9796] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9287'. [ 1227.469155][ T9807] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9288'. [ 1227.511569][ T9805] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20004 [ 1227.896404][ T9821] syzkaller0: entered promiscuous mode [ 1227.902001][ T9821] syzkaller0: entered allmulticast mode [ 1227.981124][ T9825] tipc: Enabled bearer , priority 0 [ 1227.994937][ T9825] syzkaller0: entered promiscuous mode [ 1228.002140][ T9825] syzkaller0: entered allmulticast mode [ 1228.033892][ T9821] tipc: Enabled bearer , priority 0 [ 1228.045928][ T9820] tipc: Resetting bearer [ 1228.094204][ T9820] tipc: Disabling bearer [ 1228.150539][ T9842] : entered promiscuous mode [ 1228.191915][ T9836] tipc: Resetting bearer [ 1228.262362][ T9844] lo speed is unknown, defaulting to 1000 [ 1228.312834][ T9823] tipc: Resetting bearer [ 1228.357586][ T9823] tipc: Disabling bearer [ 1228.403672][ T9844] ip6_vti0 speed is unknown, defaulting to 1000 [ 1228.858806][ T9859] lo speed is unknown, defaulting to 1000 [ 1229.056542][ T9868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1229.277916][ T9871] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1229.490099][ T9859] ip6_vti0 speed is unknown, defaulting to 1000 [ 1229.782478][ T9898] syzkaller0: entered promiscuous mode [ 1229.788088][ T9898] syzkaller0: entered allmulticast mode [ 1229.982573][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1229.990667][ C0] lec:lec_tx_timeout: lec0 [ 1229.995768][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1230.065160][ T9906] tipc: Enabled bearer , priority 0 [ 1230.113714][ T9897] tipc: Resetting bearer [ 1230.143092][ T5821] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1230.154801][ T5821] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1230.165860][ T5821] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1230.182317][ T5821] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1230.205399][ T5821] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1230.225867][ T9897] tipc: Disabling bearer [ 1230.431739][ T9914] xt_hashlimit: overflow, try lower: 64/16140901064495857664 [ 1230.529024][ T9907] lo speed is unknown, defaulting to 1000 [ 1230.577838][ T9918] __nla_validate_parse: 4 callbacks suppressed [ 1230.577859][ T9918] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9315'. [ 1230.669791][ T9907] ip6_vti0 speed is unknown, defaulting to 1000 [ 1231.298387][ T3663] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.320738][ T3663] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.331097][ T3663] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1231.430092][ T9928] lo speed is unknown, defaulting to 1000 [ 1231.455663][ T3663] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.466086][ T3663] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.476702][ T3663] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1231.499140][ T9928] ip6_vti0 speed is unknown, defaulting to 1000 [ 1231.577921][ T3663] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.609066][ T3663] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.630542][ T3663] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1231.736509][ T9938] team_slave_0: entered promiscuous mode [ 1231.742787][ T9938] team_slave_1: entered promiscuous mode [ 1231.751956][ T9938] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1231.764942][ T9938] team0: Device macvlan2 is already an upper device of the team interface [ 1231.774843][ T9938] team_slave_0: left promiscuous mode [ 1231.780302][ T9938] team_slave_1: left promiscuous mode [ 1231.806414][ T3663] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.817638][ T3663] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.828004][ T3663] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1232.296681][ T9957] syzkaller0: entered promiscuous mode [ 1232.304270][ T9957] syzkaller0: entered allmulticast mode [ 1232.328258][T18732] IPVS: starting estimator thread 0... [ 1232.335772][T30281] Bluetooth: hci5: command tx timeout [ 1232.371296][ T9907] chnl_net:caif_netlink_parms(): no params data found [ 1232.436409][ T9962] IPVS: using max 31 ests per chain, 74400 per kthread [ 1232.471005][ T9957] tipc: Enabled bearer , priority 0 [ 1232.566869][ T9961] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1232.582334][ T9961] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1232.641712][ T9956] lo speed is unknown, defaulting to 1000 [ 1232.653318][ T9950] tipc: Resetting bearer [ 1232.685177][ T9950] tipc: Disabling bearer [ 1232.698107][ T9956] ip6_vti0 speed is unknown, defaulting to 1000 [ 1232.838227][ T3663] .`: left allmulticast mode [ 1232.852568][ T3663] bond_slave_0: left allmulticast mode [ 1232.863034][ T3663] bond_slave_1: left allmulticast mode [ 1232.873837][ T3663] .`: left promiscuous mode [ 1232.878578][ T3663] bond_slave_0: left promiscuous mode [ 1232.902467][ T3663] bond_slave_1: left promiscuous mode [ 1232.908841][ T3663] bridge0: port 3(.`) entered disabled state [ 1232.937598][ T3663] bridge_slave_1: left allmulticast mode [ 1232.950462][ T3663] bridge_slave_1: left promiscuous mode [ 1232.967023][ T3663] bridge0: port 2(bridge_slave_1) entered disabled state [ 1232.989774][ T3663] bridge_slave_0: left allmulticast mode [ 1233.005657][ T3663] bridge_slave_0: left promiscuous mode [ 1233.017444][ T3663] bridge0: port 1(bridge_slave_0) entered disabled state [ 1233.402871][ T3663] bond1 (unregistering): (slave vti0): Releasing backup interface [ 1233.410838][ T3663] vti0 (unregistering): left promiscuous mode [ 1233.436329][ T3663] erspan0 (unregistering): left promiscuous mode [ 1233.461089][ T3663] gretap0 (unregistering): left promiscuous mode [ 1233.496459][ T3663] bond0 (unregistering): (slave gre2): Releasing backup interface [ 1233.504438][ T3663] gre2 (unregistering): left promiscuous mode [ 1234.358158][ T3663] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1234.367906][ T3663] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1234.377637][ T3663] .` (unregistering): Released all slaves [ 1234.401115][ T3663] bond0 (unregistering): Released all slaves [ 1234.413147][T30281] Bluetooth: hci5: command tx timeout [ 1234.422053][ T3663] bond1 (unregistering): Released all slaves [ 1234.437103][ T3663] bond2 (unregistering): Released all slaves [ 1234.451877][ T3663] bond3 (unregistering): Released all slaves [ 1234.473061][ T3663] bond4 (unregistering): Released all slaves [ 1234.487478][ T3663] bond5 (unregistering): Released all slaves [ 1234.500813][ T3663] bond6 (unregistering): Released all slaves [ 1234.537303][ T9961] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1234.547860][ T9961] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1234.785120][ T9961] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1234.796218][ T9961] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1234.812422][ T3663] tipc: Disabling bearer [ 1234.818754][ T3663] tipc: Disabling bearer [ 1234.825264][ T3663] tipc: Disabling bearer [ 1234.830929][ T3663] tipc: Left network mode [ 1234.866280][ T9990] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9326'. [ 1234.903662][ T9961] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1234.915010][ T9961] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1235.002532][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1235.010647][ C0] lec:lec_tx_timeout: lec0 [ 1235.015536][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1235.019018][ T9907] bridge0: port 1(bridge_slave_0) entered blocking state [ 1235.038504][ T9907] bridge0: port 1(bridge_slave_0) entered disabled state [ 1235.046506][ T9907] bridge_slave_0: entered allmulticast mode [ 1235.064056][ T9907] bridge_slave_0: entered promiscuous mode [ 1235.148563][ T9907] bridge0: port 2(bridge_slave_1) entered blocking state [ 1235.183482][ T9907] bridge0: port 2(bridge_slave_1) entered disabled state [ 1235.190916][ T9907] bridge_slave_1: entered allmulticast mode [ 1235.203625][ T9907] bridge_slave_1: entered promiscuous mode [ 1235.311559][T10001] netlink: 'syz.2.9328': attribute type 1 has an invalid length. [ 1235.330227][T10001] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9328'. [ 1235.509084][ T9907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1235.740462][ T9907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1235.781432][ T1162] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1235.796243][ T1162] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1235.919281][ T1162] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1235.930662][ T1162] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1235.968612][ T9907] team0: Port device team_slave_0 added [ 1236.020744][ T9907] team0: Port device team_slave_1 added [ 1236.089116][ T6780] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1236.099637][ T6780] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1236.172111][ T9907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1236.194673][ T9907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1236.235403][ T9907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1236.305806][ T9907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1236.316419][ T9907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1236.354944][ T9907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1236.366416][ T6775] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1236.383118][T10027] netlink: 'syz.2.9332': attribute type 1 has an invalid length. [ 1236.391325][ T6775] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1236.482771][T30281] Bluetooth: hci5: command tx timeout [ 1236.655378][T10032] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 1236.678532][T10032] bond1 (unregistering): Released all slaves [ 1236.873182][ T9907] hsr_slave_0: entered promiscuous mode [ 1236.880323][ T9907] hsr_slave_1: entered promiscuous mode [ 1236.897983][ T9907] debugfs: 'hsr0' already exists in 'hsr' [ 1236.908435][ T9907] Cannot create hsr debugfs directory [ 1237.010043][ T3663] hsr_slave_0: left promiscuous mode [ 1237.016783][ T3663] hsr_slave_1: left promiscuous mode [ 1237.039521][ T3663] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1237.048325][T10058] netlink: 56 bytes leftover after parsing attributes in process `syz.4.9336'. [ 1237.073195][ T3663] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1237.148560][ T3663] pim6reg99999999 (unregistering): left allmulticast mode [ 1237.291844][ T3663] team0 (unregistering): Port device team_slave_1 removed [ 1237.311891][ T3663] team0 (unregistering): Port device team_slave_0 removed [ 1237.563757][T10039] syzkaller0: entered promiscuous mode [ 1237.572966][T10039] syzkaller0: entered allmulticast mode [ 1237.649454][T10069] syzkaller0: entered promiscuous mode [ 1237.656441][T10069] syzkaller0: entered allmulticast mode [ 1238.133639][T10096] netlink: 100 bytes leftover after parsing attributes in process `syz.0.9345'. [ 1238.144853][T10095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9344'. [ 1238.163940][T10095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9344'. [ 1238.193871][T10095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9344'. [ 1238.229761][T10095] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9344'. [ 1238.525347][T10117] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9349'. [ 1238.565398][T30281] Bluetooth: hci5: command tx timeout [ 1238.643845][T10106] lo speed is unknown, defaulting to 1000 [ 1238.658038][T10106] ip6_vti0 speed is unknown, defaulting to 1000 [ 1238.735486][ T3663] IPVS: stop unused estimator thread 0... [ 1238.757544][T10128] netlink: 'syz.2.9351': attribute type 2 has an invalid length. [ 1239.321949][T10131] xt_addrtype: ipv6 does not support BROADCAST matching [ 1239.421758][T10149] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1240.022598][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1240.030779][ C0] lec:lec_tx_timeout: lec0 [ 1240.035483][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1240.077319][ T9907] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1240.149580][ T9907] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1240.176956][ T9907] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1240.227996][ T9907] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1241.016668][ T9907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1241.060600][T10221] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9364'. [ 1241.120367][ T9907] 8021q: adding VLAN 0 to HW filter on device team0 [ 1241.169849][ T6780] bridge0: port 1(bridge_slave_0) entered blocking state [ 1241.177192][ T6780] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1241.255408][ T6780] bridge0: port 2(bridge_slave_1) entered blocking state [ 1241.262665][ T6780] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1241.825602][T10252] lo speed is unknown, defaulting to 1000 [ 1241.858552][T10252] ip6_vti0 speed is unknown, defaulting to 1000 [ 1241.925750][T10263] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9370'. [ 1242.338952][ T9907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1242.438520][T10274] syzkaller1: entered allmulticast mode [ 1242.768873][ T9907] veth0_vlan: entered promiscuous mode [ 1242.853836][ T9907] veth1_vlan: entered promiscuous mode [ 1243.006641][ T9907] veth0_macvtap: entered promiscuous mode [ 1243.035610][ T9907] veth1_macvtap: entered promiscuous mode [ 1243.157454][ T9907] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1243.195600][ T9907] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1243.332328][ T2889] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.354404][ T2889] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.395869][ T2889] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.485079][ T2889] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1243.498242][T10327] syzkaller1: entered promiscuous mode [ 1243.504311][T10327] syzkaller1: entered allmulticast mode [ 1243.640159][T10317] lo speed is unknown, defaulting to 1000 [ 1243.663904][T10317] ip6_vti0 speed is unknown, defaulting to 1000 [ 1243.812725][T10336] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1243.853271][T10336] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1243.874013][T10336] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1243.891734][T10336] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1243.968292][T10340] netlink: 'syz.2.9384': attribute type 1 has an invalid length. [ 1243.986517][ T6775] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1244.008459][ T6775] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1244.135004][ T3663] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1244.161823][ T3663] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1244.187036][T10349] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9386'. [ 1244.447360][T10354] syzkaller0: entered promiscuous mode [ 1244.453393][T10354] syzkaller0: entered allmulticast mode [ 1244.591271][T10356] xt_hashlimit: overflow, try lower: 64/16140901064495857664 [ 1245.050597][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1245.058911][ C0] lec:lec_tx_timeout: lec0 [ 1245.063997][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1247.401866][T10405] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9392'. [ 1248.077279][T10443] syzkaller0: entered promiscuous mode [ 1248.105417][T10443] syzkaller0: entered allmulticast mode [ 1248.281648][T10456] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9404'. [ 1248.290970][T10456] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1248.365301][T10456] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1248.445428][T10453] lo speed is unknown, defaulting to 1000 [ 1248.454347][T10453] ip6_vti0 speed is unknown, defaulting to 1000 [ 1248.644405][T10470] lo speed is unknown, defaulting to 1000 [ 1248.717761][T10478] netlink: 284 bytes leftover after parsing attributes in process `syz.1.9408'. [ 1248.729661][T10477] netlink: 'syz.3.9409': attribute type 13 has an invalid length. [ 1248.752951][T10477] netlink: 14233 bytes leftover after parsing attributes in process `syz.3.9409'. [ 1248.935230][T10490] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9412'. [ 1249.029437][T10495] veth7: entered promiscuous mode [ 1249.244160][T10505] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9415'. [ 1249.352916][T10470] ip6_vti0 speed is unknown, defaulting to 1000 [ 1249.570421][T10524] netlink: 'syz.1.9418': attribute type 1 has an invalid length. [ 1249.659431][T10524] bond2: entered promiscuous mode [ 1249.685583][T10524] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1249.787951][T10524] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1249.814560][T10524] bond2: (slave gre1): The slave device specified does not support setting the MAC address [ 1249.844010][T10524] bond2: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 1249.866778][T10524] bond2: (slave gre1): making interface the new active one [ 1249.888587][T10524] gre1: entered promiscuous mode [ 1249.900570][T10524] bond2: (slave gre1): Enslaving as an active interface with an up link [ 1249.933424][ T2889] ------------[ cut here ]------------ [ 1249.939625][ T2889] kernel BUG at net/core/skbuff.c:2306! [ 1249.957832][ T2889] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 1249.964146][ T2889] CPU: 0 UID: 0 PID: 2889 Comm: kworker/u8:26 Not tainted syzkaller #0 PREEMPT(full) [ 1249.973719][ T2889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1249.983814][ T2889] Workqueue: ipv6_addrconf addrconf_dad_work [ 1249.989837][ T2889] RIP: 0010:pskb_expand_head+0x12da/0x1320 [ 1249.995692][ T2889] Code: f8 e9 81 f3 ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c e0 f3 ff ff 4c 89 ff e8 b1 e7 c4 f8 e9 d3 f3 ff ff e8 27 c1 5b f8 90 <0f> 0b e8 1f c1 5b f8 90 0f 0b 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 1250.015422][ T2889] RSP: 0018:ffffc9000b9b74d0 EFLAGS: 00010293 [ 1250.021529][ T2889] RAX: ffffffff896879a9 RBX: ffff88805eb90780 RCX: ffff88802c818000 [ 1250.029622][ T2889] RDX: 0000000000000000 RSI: 0000000093c5bdc0 RDI: 0000000000000000 [ 1250.037628][ T2889] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000038 [ 1250.045632][ T2889] R10: dffffc0000000000 R11: ffffffff8a263ad0 R12: dffffc0000000000 [ 1250.053633][ T2889] R13: 0000000000000820 R14: 0000000093c5bdc0 R15: 0000000000000180 [ 1250.061640][ T2889] FS: 0000000000000000(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 [ 1250.070608][ T2889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1250.077228][ T2889] CR2: 00007fa9ed6a4d40 CR3: 000000009ea44000 CR4: 00000000003526f0 [ 1250.085239][ T2889] Call Trace: [ 1250.088545][ T2889] [ 1250.091500][ T2889] ? neigh_connected_output+0x1ea/0x460 [ 1250.097083][ T2889] ? neigh_connected_output+0x1ea/0x460 [ 1250.102671][ T2889] ipgre_header+0xd5/0x350 [ 1250.107130][ T2889] ? __pfx_ipgre_header+0x10/0x10 [ 1250.112192][ T2889] neigh_connected_output+0x286/0x460 [ 1250.117592][ T2889] ? ip6_output+0x126/0x550 [ 1250.122106][ T2889] ip6_output+0x340/0x550 [ 1250.126443][ T2889] ndisc_send_skb+0xbaa/0x14e0 [ 1250.131225][ T2889] ? ndisc_send_skb+0x1fd/0x14e0 [ 1250.136193][ T2889] ? ndisc_alloc_skb+0x1a6/0x480 [ 1250.141154][ T2889] ? __pfx_ndisc_send_skb+0x10/0x10 [ 1250.146375][ T2889] ? __pfx_dst_output+0x10/0x10 [ 1250.151675][ T2889] ? __asan_memset+0x22/0x50 [ 1250.156273][ T2889] addrconf_dad_completed+0x909/0xe60 [ 1250.161656][ T2889] ? __pfx_addrconf_dad_completed+0x10/0x10 [ 1250.167561][ T2889] ? __local_bh_enable_ip+0xd0/0x130 [ 1250.172871][ T2889] addrconf_dad_work+0xc5e/0x14c0 [ 1250.177909][ T2889] ? lock_acquire+0x106/0x330 [ 1250.182589][ T2889] ? __pfx_addrconf_dad_work+0x10/0x10 [ 1250.188136][ T2889] ? process_scheduled_works+0xa0f/0x17a0 [ 1250.193947][ T2889] ? process_scheduled_works+0xa0f/0x17a0 [ 1250.199680][ T2889] ? process_scheduled_works+0xa0f/0x17a0 [ 1250.205400][ T2889] process_scheduled_works+0xaec/0x17a0 [ 1250.210956][ T2889] ? __pfx_process_scheduled_works+0x10/0x10 [ 1250.216997][ T2889] ? assign_work+0x3d5/0x5e0 [ 1250.221626][ T2889] worker_thread+0xa50/0xfc0 [ 1250.226229][ T2889] kthread+0x388/0x470 [ 1250.230330][ T2889] ? __pfx_worker_thread+0x10/0x10 [ 1250.235451][ T2889] ? __pfx_kthread+0x10/0x10 [ 1250.240047][ T2889] ret_from_fork+0x51e/0xb90 [ 1250.244731][ T2889] ? __pfx_ret_from_fork+0x10/0x10 [ 1250.249868][ T2889] ? __switch_to+0xc7d/0x1400 [ 1250.254547][ T2889] ? __pfx_kthread+0x10/0x10 [ 1250.259228][ T2889] ret_from_fork_asm+0x1a/0x30 [ 1250.264008][ T2889] [ 1250.267027][ T2889] Modules linked in: [ 1250.271784][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5200 ms [ 1250.279853][ C0] lec:lec_tx_timeout: lec0 [ 1250.287292][ T2889] ---[ end trace 0000000000000000 ]--- [ 1250.292905][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1250.311816][ T2889] RIP: 0010:pskb_expand_head+0x12da/0x1320 [ 1250.317882][ T2889] Code: f8 e9 81 f3 ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c e0 f3 ff ff 4c 89 ff e8 b1 e7 c4 f8 e9 d3 f3 ff ff e8 27 c1 5b f8 90 <0f> 0b e8 1f c1 5b f8 90 0f 0b 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 1250.341247][ T2889] RSP: 0018:ffffc9000b9b74d0 EFLAGS: 00010293 [ 1250.349743][ T2889] RAX: ffffffff896879a9 RBX: ffff88805eb90780 RCX: ffff88802c818000 [ 1250.358038][ T2889] RDX: 0000000000000000 RSI: 0000000093c5bdc0 RDI: 0000000000000000 [ 1250.366336][ T2889] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000038 [ 1250.374807][ T2889] R10: dffffc0000000000 R11: ffffffff8a263ad0 R12: dffffc0000000000 [ 1250.383255][ T2889] R13: 0000000000000820 R14: 0000000093c5bdc0 R15: 0000000000000180 [ 1250.391642][ T2889] FS: 0000000000000000(0000) GS:ffff8881255b0000(0000) knlGS:0000000000000000 [ 1250.403793][ T2889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1250.426546][ T2889] CR2: 00007fd017fe82f8 CR3: 0000000048aee000 CR4: 00000000003526f0 [ 1250.434827][ T2889] Kernel panic - not syncing: Fatal exception [ 1250.441377][ T2889] Kernel Offset: disabled [ 1250.445707][ T2889] Rebooting in 86400 seconds..