last executing test programs: 3.334438408s ago: executing program 3 (id=4392): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40008}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYRES64=r1, @ANYRES32=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r4, @ANYBLOB="40000e0080000000ff1f0dffffff080211000000080211000001f0ff000000000000000064000101030128040600fa01040b10050305a9037206030320f1539f08000c008c20518dd720e33a66d88c6400000008000d003f0000000500faa80ca30000000000", @ANYRESOCT=r2], 0x74}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x10, r5, 0x80000000}, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r10, {0x10, 0xffe0}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x22040028}, 0x40040) r11 = accept4(r6, 0x0, 0x0, 0x80800) sendmsg$kcm(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000780)="5b34307b5d5ab4d0da618c917d17d72617b51de3b058db3741c1ad288ab3d41b6393e90e9c35c278107469c5069f9af1b6cce3add48acf544e1ea61e9706b8311fde34712a361da44539559336541173354d63a7443c34bf3956a7d39dfde18f0ef3f45b4a695e6663524020e87c5f94e4bb4fd9243eb345fc806b6a763acb8b0debff7f96696466798cc6d40471c26cf1cd03a40d72ba67c831a1ab417eeedf86904ac662460a2ee7f9830f6ff1e15957580ae75bbcb393ed98850dd00a952a931584869bc3da8f9054dfc58d7309c1d5024afd7c862d21ce", 0xd9}, {&(0x7f0000000880)="90045127107781b2802972e8d927a800a56c62861f6a44957e17a30de6f8e1a6c1fe3056d3cf94594169a8284764158bdbec8292978798", 0x37}], 0x2}, 0x40000000) recvmmsg$unix(r11, &(0x7f0000005980)=[{{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000001040)=""/31, 0x56}, {&(0x7f0000001080)=""/215, 0xd7}], 0x2}}], 0x1, 0x200, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) close(0x3) 2.835995534s ago: executing program 1 (id=4396): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r2, &(0x7f0000000240)={0x24, @none={0x0, 0x1}}, 0x370a3e077a6d5772) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x34}}, 0x0) 1.460317968s ago: executing program 1 (id=4397): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010000104000000000000000000000500", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYRES32], 0x40}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1284c7fbb0efff5f4d218a000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r3, &(0x7f0000000500), &(0x7f0000000280)=@udp=r2}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x94a, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x810, 0xffffffffffffffff, 0xfc7d2000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, 0x0, &(0x7f00000000c0)) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c0004802800018007000100637400001c0002800800014000000002080002400000000b05000300000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x80}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x0, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ffe8d65f0d39f5eac5da0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="a3", 0x2}, 0x50) socket$inet6_udplite(0xa, 0x2, 0x88) syz_emit_ethernet(0x346, &(0x7f0000000b80)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000f86dd6100272403103afffc000000000000000000000000000001ff0200000000000000000000000000018f0090780700000806000001ff010000000000000000000000000001fe8000000000000000000000000000bb01090003fe80000000000000000000000000002920010000000000000000000000000001ff020000000000000000000000000001fc020000000000000000000000000001120000000900000008000000f7ffffff3c28000008000000010000000d0000000900000006040006fc00000000000000000000000000000000000000000000000000ffff0000000000000000000000000000ffffac1414bbff010000000000000000000000000001fe80000000000000000000000000001dff010000000000000000000000000001fe80000000000000000000000000000e9400000001000000050000000200000003020007ff020000000000000000000000000001fc13d56f4d777117000000000000000000000000000001fc000000000000000000000000000001fe8000000000000000000000000000aa00000000000000000000000000000001fe880000000000000000000000000001fc020000000000000000000000000000fc020000000000000000000000000001ffff00000900000003030000fe8000000000000000000000000000bbcb000000090000000200000009090006ff020000000000000000000000000001fc000000000000000000000000000001fc010000000000000000000000000001ff010000000000000000000000000001fc020000000000000000000000000000fe88000000000000000000000000000100000000000000000000ffff0a01010204000000090000000d00000009000000a20500005806000006000000000200000700000004030001fc02000000000000000000000000000100000000000000000000000000000001e2090000000000000100000003040006fc020000000000000000000000000001fe8000000000000000000000000000bb00000000000000000000000000000000ff020000000000000000000000000001fe880000000000000000000000000101fc02000000000000000000000000000100000000000000000000ffffac141438000100000100000001"], 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r10, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(r10, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r10, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(r10, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) shutdown(r10, 0x0) splice(r10, 0x0, r9, 0x0, 0x100000003, 0xa) 1.351608843s ago: executing program 0 (id=4399): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newsa={0x150, 0x10, 0x413, 0x70bd28, 0x40, {{@in=@remote, @in=@multicast1, 0x4e20, 0x7, 0x4e23, 0x0, 0xa, 0x20, 0x20, 0x67}, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @local}, {0x800, 0x17d, 0x0, 0x440000000000000, 0xffffffffffffffff, 0x7, 0x7f, 0x2}, {0x0, 0x21fd, 0x4, 0xffffffffffeffffc}, {0xf6, 0x4, 0x8}, 0x0, 0x34ff, 0xa, 0x4, 0xbe, 0x33}, [@algo_aead={0x5f, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x98, 0x60, "3e3be75104dd10a77d37f405a10d83b6d6209f"}}]}, 0x150}}, 0x4000804) (async) r1 = socket$l2tp6(0xa, 0x2, 0x73) recvmmsg(r1, &(0x7f0000007000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x1, 0x0) (async) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r2, 0x0, 0x0) (async) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000140)=0x3) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r3}, 0x8) (async) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000fb000000000000000000e500020000000000e500fcff00000000060000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a80)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}, 0x50) (async) getsockopt$inet6_mptcp_buf(r3, 0x11c, 0x1, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 1.33243427s ago: executing program 2 (id=4400): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@can_delroute={0x154, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_CS_XOR={0x8, 0x5, {0xfffffffffffffff7}}, @CGW_CS_CRC8={0x11e, 0x6, {0x0, 0x0, 0x1, 0x0, 0x0, "b4541ad8a719cce5b93390ffad119a9404ac75b6e76ffc40cd6cfca1e687ae4a5f6c45837f98c5b34fc0d75f81fba139a766f9329afdcdd828f6be7660e836c8bbbef6bdb946eee07a1baceb6cc5a31bbb9e74ced70674dca9251ebb0a639b0b01dfcd7055ac30cc78c567183410c70697781aea3b8f4b0e24aaa1538cce11f60ceac8341f6a803203a099f0a22d74224299d23fc8db20da8bec380ebbfdaad08cc2aa77cfeb986111181ca1fed46e32d8f1f3dffe14220bf67a40f3eb218081df885b8d8bc945cb2e26931e1b81fc48dacc77ab9fd4f4ef65f5fc185b6277df124525d82654e156682fe19d731de3978f71bb85f85daef3a1513a89bd25911d", 0x1, "2353a2ad8f792337b3610a014feea22617c1ecea"}}, @CGW_MOD_AND={0x15, 0x1, {{{}, 0x0, 0x0, 0x0, 0x0, "e292ac39b9d3382f"}, 0xb}}]}, 0x154}}, 0x50) r1 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, &(0x7f0000000300)=0x54) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) 1.279724939s ago: executing program 4 (id=4401): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) ioctl$TUNSETLINK(r0, 0x400454cd, 0x304) (async, rerun: 64) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf250501f2800f0018007d3a2e9c5bc85c23277d000014000200fc02000000000000000000000000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b10808000000000000004734be31d750000000000000000808a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d9767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c0400e900000000000000000000573d36ff50a5bdae5a5d4526d0a1dd69f600000000000000097df7536e2e10c33e2bc05c4e259f98fbd644cf9f108ea16c466dd3432759e19161cf130c7d2a4e51742dfbe54ee7994f4c6dd76f6443a20e118cab888610f557355f7a392e52a90d529737d6e5ae395f4f1e6abb08fb417ce677e5243e988acd299d09b89dfd601249f772766684d7e12845e6ab47eba151e9a84fdad7789abf4580add81310c3fa88da3d936432afcf1825504d8ab26a6ee7d50e1b3f87c2f204b907ced94fd85d25c449084414ebb04df346e90d2bfea349bd0e2e55f540fc6fcfb7afbb8dec1c7c45035726a46357527597b5814881b50eabf352831311d79dc3f501c9931ef7019909fccee9d0a9f2a1c5e0853c97de2c0021e3a6e550401177ded544443c3c5e899f1e82232e1d6b1c421073f83ba2d0a87ebfd03ea766e4b8642441000000000000"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 64) r3 = socket$netlink(0x10, 0x3, 0x10) (rerun: 64) syz_emit_ethernet(0x4d, &(0x7f0000000380)={@broadcast, @multicast, @val={@void, {0x8100, 0x4, 0x1, 0x1}}, {@ipv4={0x800, @tipc={{0x6, 0x4, 0x0, 0x28, 0x3b, 0x66, 0x0, 0xb9, 0x6, 0x0, @loopback, @remote, {[@end]}}, @payload_direct={{{{0x23, 0x0, 0x0, 0x0, 0x1, 0x8, 0x0, 0x2, 0x5, 0x0, 0x3, 0x6, 0x2, 0x3, 0x2, 0x7, 0x3, 0x4e22, 0x4e20}, 0x1}}, [0x0, 0x0, 0x0]}}}}}, &(0x7f0000000440)={0x0, 0x4, [0xddc, 0xbc7, 0x7e3, 0x9be]}) (async) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), r3) sendmsg$SEG6_CMD_GET_TUNSRC(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x28, r4, 0x223, 0x0, 0x0, {0x3}, [@SEG6_ATTR_DST={0x14, 0x1, @loopback={0xe0ffff00000000}}]}, 0x28}}, 0x0) (async) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x4c, r4, 0x20, 0x70bd2a, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x33}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9c}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x3, 0x80000001]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x9}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xe}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x24000080) 1.219950134s ago: executing program 0 (id=4402): r0 = socket(0x2, 0x3, 0xff) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000380)=0x2, 0x4) recvmmsg(r1, &(0x7f00000098c0)=[{{0x0, 0x0, 0x0}, 0x80}], 0x1, 0x10002, 0x0) sendto$inet(r0, &(0x7f0000000040)="b401fcc8070000090000008e052af9c34b7d7494", 0xffffffe1, 0x4085, &(0x7f0000000000)={0x2, 0x4e21, @private=0xa010102}, 0x10) (async) sendto$inet(r0, &(0x7f0000000040)="b401fcc8070000090000008e052af9c34b7d7494", 0xffffffe1, 0x4085, &(0x7f0000000000)={0x2, 0x4e21, @private=0xa010102}, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) recvfrom$inet(r0, &(0x7f0000000280)=""/109, 0x6d, 0x40000102, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) (async) recvfrom$inet(r0, &(0x7f0000000280)=""/109, 0x6d, 0x40000102, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10) socket$packet(0x11, 0x3, 0x300) sendmmsg$sock(r3, &(0x7f000000bb40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4000011) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.219713783s ago: executing program 3 (id=4403): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x30, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}}, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000040)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x0, 0x0, @empty}}, 0x24) connect$rxrpc(r0, &(0x7f00000002c0)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x24) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe02001085000000070000"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) 1.124009393s ago: executing program 2 (id=4404): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) write(r1, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030004000500e1000c04001e001a030700", 0x33a) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56741, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xfffffffffffffd06}}]}, 0x30}}, 0x0) (async) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000000)='kmem_cache_free\x00', r4, 0x0, 0xd4}, 0x18) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede-generic)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r7 = accept$alg(r6, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000140)="125cf3780c7aa953", 0x8}], 0x1, 0x0, 0x0, 0x8000}], 0x1, 0x4008000) (async) bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000004440)=@base={0x14, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)={0x60, r9, 0x405, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r10}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000431}, 0x4040084) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000030806000000000000000000000000000400fb800500030006000000fc9df968c19eb3b9394aaccee398c1878bf4152dadf1c2524e7ac9b4e190c4c85c3cfde5ea76ef61e4be331bd11a093db08f35a3fc9fdc7a1e66d8d7379a2d690e095d2e71030073342353750ef70182ad933f1b04ce412c8b7538d36e6b89bc9665da00000023a623085684bb8c6e63428c974f5e13a9f89d081b589e91ded0b1"], 0x20}}, 0xa1b6cd101cd47d81) 1.099671129s ago: executing program 3 (id=4405): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000000000000000000033644d944d4c2a960085000000300000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b000000"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x30}}, 0x0) (async) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000100001042dbd70000000000000000000", @ANYRES32=r4, @ANYBLOB="000000000000000030001280080001007369740024000280080014002f00000008000300ac"], 0x50}}, 0x0) (async) syz_genetlink_get_family_id$nl80211(0x0, r3) (async) sendmsg$key(r3, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000180)=ANY=[], 0x80}}, 0x0) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r1, &(0x7f00000005c0)="04", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffff9, @rand_addr=' \x01\x00'}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 983.277212ms ago: executing program 1 (id=4406): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a1f00b3dd0008000a40fffffffc140000001100010000000000000000000100000a"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf, 0x9}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, 0x0, &(0x7f0000000100)) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800dd8d00000040000000000200000000000005000000000600150003e00f0000001680100008800c0003800500010081000000"], 0x38}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r3}, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r6, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r7, 0x3}, 0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f00000003c0)={0x6, 0x35, 0x8205, 0x7, 0xd, 0x9b45, 0x4, 0xfffffff8, r7}, 0x20) setsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f0000000340), 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000002000000000000000200000d"], 0x0, 0x3a, 0x0, 0x8}, 0x20) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100004008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020007000000380001800c0001006269747769736500280002800800034000000002080001400000001408000240000000120800044000000004040004800900010073797a3000"], 0x10c}}, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 927.552178ms ago: executing program 0 (id=4407): r0 = socket(0x1e, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$bt_hci(r2, 0x84, 0x80, &(0x7f0000000000)=""/4102, &(0x7f0000001080)=0x1006) r5 = accept4$alg(r1, 0x0, 0x0, 0x800) sendmsg$alg(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="f5a9496032", 0x5}], 0x1}, 0x55) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x1c) listen(r0, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_mtu(r6, 0x29, 0x4e, &(0x7f0000000400)=0x2, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1}, 0x1c) accept4$nfc_llcp(r0, 0x0, 0x0, 0x0) bind$rose(r0, &(0x7f0000000000)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @default]}, 0x40) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000380), 0x10, &(0x7f0000000440)=[{&(0x7f00000003c0)='P', 0x1}], 0x1}, 0x0) 842.139076ms ago: executing program 4 (id=4408): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000380), 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = epoll_create1(0x0) r3 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000240), 0x2, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000280)={0x1a}) write(r1, &(0x7f0000000300)="2400f4f901000501009f0000000020001000", 0x12) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 840.927386ms ago: executing program 0 (id=4409): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}]}}]}, 0x45c}}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000000c0)={@loopback, 0x0}, &(0x7f0000000100)=0x14) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x60, r1, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2df369a448ca7ec1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x22008010}, 0x44) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x7, 0x0, 0x20040000, 0x0, 0x2, 0x10004000, 0x7, 0x400, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="b601000000000000bd110000000000008510000002000000850000007600000095000000000000009500a5050000000077d8f3b4000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f68a7d06d75357f21699cdc6751dfb265a0e3ccae669e173a649c1cfd6587d472d64e7cc955d77578f4c35235138d5421f9453559c35da860e8ef14142b2a3e314422b854421eed734ceb1efeecb9c66854c3b3ffe1b4ce25d7c983c005c03bf3a48dfe3e26e7a23129d6606fd28a697a9d552af6d9a9df2c3af333e2008e11bbec0727cb3f647535deb6277f5696833a71011a7d06602e2fd5234712596b696418f163d1a13ed38a682f87925bfa753f631cd027edd68149ee99eebc6f7d6dd4ae59af7588c8e1f4efab57644ccb1973d7879b70a70001040000000000000000d7900a820b63278f4e9a217b98ef7042ad2a923132f208fd8289eaf8cd00000000000009d27d753a300800000000000000a5686f2fccc33e3e34c3969c5ad781302d40e97a8ad10ce0cbe17366d5ac6af2fca2360a15b80400d52040ef7b28d300747877e176fe4c4b8e40dbf260f5a9f7eee30293c1b163b795d0aef4deb851a30000f569dc8f39943f889008e1ec914faa9e6cd0b3b4b3b5db666ebeb49d6a62019d76459e70b459543c4ac42e53b4ad4c77cff373ebd95848f01864e456969cd28000170996016aceb583df5ee4dd722e8c350af489f9a900000000a0dcc36b3d7c734a9cce0439f832a20d7cbdcda5dff3ba92dd66afb9d74aa222038994dcd3e7784dbea1e51a15b0f1a040cc63177f8fafa3192fc8e5552da1a982ab8dfe31ad1a0968faa47c2069d6bf09c3aa4f0fc128cb578d99b08a150b4cc4b22f6a464c6398c952519818a44a1b223ff502df87865c276588ea478e328e8277e811b99ce1acfecaf8e2c55ccc4b8eae0a61635514e99ffd438784060f23ba74c0b30b1180d935832deb686d789ba1d436d116394534e88492a42b8bf050c719661a2dc50b3a1dcfbc871e5c27e3d7260f6fa589e40000b89db451ff994845f6b49c12e89291398bcb3c06ef1289f74e0b0e2cab592d35f82a69e7284223a171c616b1f0fee6c4711d7aecb69746064d2c096554975d605ebe646302bf3d5cf32a9a09915ae3f3d4eb96615d7b237da56cd5e9904a19e145f25b6d98eb2c019967f553b61d0e80d6913cee9f8d18469a654a239a84a85debbc02846ac5791278f18c6759e3b513a68284d2efc30587e433431b2896a3bd48020af67e9ac071b2dd6dc3b9efae4ff03558fa619aea909c7f2416e7e7da1c51ccc7e6ac27412f728dc6d80da8adf317ca863ed683897321f8c8bb5a5d953d6783b7a06353ee496bbdff418de3e53234df87756eb99e330253cf5da4aa1a9648a38f07e2d302b4165983db4f7b8972923fffa8c03c288512a3a38fbd7c816a44634f7a03fab30811b7b93257bea4369ba46024dee5e9b0b2c3d3324e9b7c1f99ab9bb3f498b1485373b79ec84a67dad4e37575dab87ce55a9a69ed856a4c4410d1242ac1bd1539094a641cc086c2c53e363beafc74ab4e9ff320373705cbf5644586ffe60d293944fa2d9dc18b55f1af5c42f27747bef1ffd0c1766f062d47d61bf9f64e6ee288fa7fc12d48da526527b9f5c318c93ec447cb8b5eee7aa8a1e85696af3dfef96657c0545c8ebd96528d9c28828e5befd80d684b03b6d153da3e3cbd3bfbf4a9375b8ad04a1d241bcb5d5505cb6cc7a44e2e24bd0b1ca4879caaff59d0ce39dc7f3fea447f4e46967855208e63ec988bd2692afefbed2b001205e4b30ee8fe417defa566a73ace8f01f7181de0ef25f1744896a3c38859e6148c42454949cd64b1a888e7fe9c2d86bb01023b6ddeb67f5eb038af3e460c771518a4126c338b0390d459361e03adf6e6b558b3651a0e33d101b5febfff82794203da18db6fcf89715c2d338f78d8b9220171b41f528f857a7cb79ca990de1208777e13faaa9b9cb9e67797b07d9eb9e909410b50c5d981d9a72aa36498b630519d1530ef0000000000000000000037fcffffffffffffff8db8379bd2044c652dff399a9f8bfa4e9c507f049d18837464276830461ee203ba51f6102d262fc9a26bc3638ecce24e65c55da6efaa462f03d0e119c963a8c7a522b59f5a7b44d018cb2648383073d9e032492cae44350bc0a85697f431392eb22cae093e85954af97d6d7b2e6e8f43353062275ad1578a431594243452a2bfb89f91d8eaac038e9e17136e7c698f73faaabb3d00000000000080014573789425c4c32da528d89356aa6d2ae6da082e756c80cf39053431080ea6cbf9997a5a0ddad0b9d12bc3f880476ab32f0feaac5f16e61f7b72b8c9082eec423c6b3eaecfdcc9ec72795e7696421c83b76c2d6bac19bc875d009679778d8ef97d7e05329649d97b0dc54bea9b650873de2d3d702690176e0b23ee5cb5e469a8d1612d611722e6200e3a297d92f8e1de98326c5ef2b89d4e2d47767cd755783e5d865e373338e96ceb8399f296c59b2d70ca27735ecaff62982616d3ac1ab041733bce119d8002a6c8a2b08b32551b2313b1a2ff41b3f04af61c69c85cb2da48215727271bac2ffdeb62d9f5dc4845f1c3f63dc806e615ee8d28d6d7f181e30807afa27f41d0364c746a65a47464db68f3c433d88dd625db35fded2c86d75af88efaf20c8b37c644b6c4e773a9589200faa553bc92f916b75ddbfa18ab73979f46947b35914286d2499a0b8c970000000000000000f4fe74e0c26ab52329bd600627b256ca44dd121ffc8dbb6e5f70cbe03efccac70375b30cc927574d254d1b46c607e8b1ca7d1511568c3ef4b6b885f4582bdcef74e5e010627fc8e4fe00000000000000000000869d9640f06b11df2971909b90133983308ea4f033de613763f32d913bcbe9dd082a6fff197a20730269e6cfd31275395833f1c2b8a50a94c30cceae2a11fe9b9b835d0da73891c0b3ce22dea6bf31e7f51808cf72f44b4455b77a778440795e152dc1b7bb0a5636aa4742ce4d331a47de5836539cdf289176527277b70c8162aaf6f9475418b478329f3565450acfaf07000000eab8cabfa97e35081967bb92a264b07e8003d2f15537e72a1e4ca5ec1e2aaaf8236ecdefbaf512c75e636b6b6f518ad20521f909b12e9bc97e408e0dc82f950d12705f35708bc862196abb27e8d7991b5273987f38c4706289ff4f6130cee76465d487a07a74452f87da2029bd3debd9870335d58d3fe1ac80574fa3ea312997ab81bc6f569ffdb10ba3f20a86d95128d13e0c778998d3b3114bfb07bd61e4bff8a5e2ce4aa572c63e09b44ca4a181bcfe4eec3ce843c65c4948169fe639a186acc2b4a96c6b8d4d2e6d53ab97bea01eab953e6e89e3af34d4ada217bc6fda0fb2095c49195d0d6f365ca80a955b9ec81240a84ef672afa369fc8e3d444ba35d0f51a0065a3b982d09dfc6874fc0d8079b185447cb8a695e132d4d613a529d9c77e2a8f7320ecf698e8a2b170fd601dc1a9767a38b10788e92d1356f6a6c1bcfb2d31b46e735db13f1be80bac1b6be04fd98610000000000000000000000000000139af5493f74751c5e2501a4936bc4a0fa516117f4ccadc692003adee0a080eba2f1059660c0ee0e9aec72d4d0fe095632e4f641b0e34c611c5b3e0ba05fa36542d40837dda323910672a9097d68398fd3539686e4288db0d6bf7cb8a1835f46dfe11865a66ef47e736dada06677a5bca133d6cbc8fe5c4557e51b006bdccd7c5f32ff1d9e8b130f77df09236870fb3de5b87b4f8acc13df534eba329b86670000000000000000b27a2616c03cdf6c009447a652bca9b325e73c0737d5b717945e4fe7a169c5e2c54fc71a4104aa7cf0f5d30e2fcd9503650edbd8a5971a9a1fde5e5df37469ae204a6e899eacc1e63034cbabc5604739881cb82604bed3e53696a0606b26b879ef232a1a038291389593d1575cb79aa8284cf01a7e1a456acab9d8d608ad69d4c4b56492af7004e7ed9d47c5db3d76a00bea7c804f3a3638408bc1636f1009b7f185f51606918eaa0ab6bef11ae3d300"], &(0x7f0000000080)='GPL\x00', 0x9, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}]}}]}, 0x45c}}, 0x0) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000000c0)={@loopback}, &(0x7f0000000100)=0x14) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x60, r1, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2df369a448ca7ec1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x22008010}, 0x44) (async) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x7, 0x0, 0x20040000, 0x0, 0x2, 0x10004000, 0x7, 0x400, 0x7}}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="b601000000000000bd110000000000008510000002000000850000007600000095000000000000009500a5050000000077d8f3b4000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f68a7d06d75357f21699cdc6751dfb265a0e3ccae669e173a649c1cfd6587d472d64e7cc955d77578f4c35235138d5421f9453559c35da860e8ef14142b2a3e314422b854421eed734ceb1efeecb9c66854c3b3ffe1b4ce25d7c983c005c03bf3a48dfe3e26e7a23129d6606fd28a697a9d552af6d9a9df2c3af333e2008e11bbec0727cb3f647535deb6277f5696833a71011a7d06602e2fd5234712596b696418f163d1a13ed38a682f87925bfa753f631cd027edd68149ee99eebc6f7d6dd4ae59af7588c8e1f4efab57644ccb1973d7879b70a70001040000000000000000d7900a820b63278f4e9a217b98ef7042ad2a923132f208fd8289eaf8cd00000000000009d27d753a300800000000000000a5686f2fccc33e3e34c3969c5ad781302d40e97a8ad10ce0cbe17366d5ac6af2fca2360a15b80400d52040ef7b28d300747877e176fe4c4b8e40dbf260f5a9f7eee30293c1b163b795d0aef4deb851a30000f569dc8f39943f889008e1ec914faa9e6cd0b3b4b3b5db666ebeb49d6a62019d76459e70b459543c4ac42e53b4ad4c77cff373ebd95848f01864e456969cd28000170996016aceb583df5ee4dd722e8c350af489f9a900000000a0dcc36b3d7c734a9cce0439f832a20d7cbdcda5dff3ba92dd66afb9d74aa222038994dcd3e7784dbea1e51a15b0f1a040cc63177f8fafa3192fc8e5552da1a982ab8dfe31ad1a0968faa47c2069d6bf09c3aa4f0fc128cb578d99b08a150b4cc4b22f6a464c6398c952519818a44a1b223ff502df87865c276588ea478e328e8277e811b99ce1acfecaf8e2c55ccc4b8eae0a61635514e99ffd438784060f23ba74c0b30b1180d935832deb686d789ba1d436d116394534e88492a42b8bf050c719661a2dc50b3a1dcfbc871e5c27e3d7260f6fa589e40000b89db451ff994845f6b49c12e89291398bcb3c06ef1289f74e0b0e2cab592d35f82a69e7284223a171c616b1f0fee6c4711d7aecb69746064d2c096554975d605ebe646302bf3d5cf32a9a09915ae3f3d4eb96615d7b237da56cd5e9904a19e145f25b6d98eb2c019967f553b61d0e80d6913cee9f8d18469a654a239a84a85debbc02846ac5791278f18c6759e3b513a68284d2efc30587e433431b2896a3bd48020af67e9ac071b2dd6dc3b9efae4ff03558fa619aea909c7f2416e7e7da1c51ccc7e6ac27412f728dc6d80da8adf317ca863ed683897321f8c8bb5a5d953d6783b7a06353ee496bbdff418de3e53234df87756eb99e330253cf5da4aa1a9648a38f07e2d302b4165983db4f7b8972923fffa8c03c288512a3a38fbd7c816a44634f7a03fab30811b7b93257bea4369ba46024dee5e9b0b2c3d3324e9b7c1f99ab9bb3f498b1485373b79ec84a67dad4e37575dab87ce55a9a69ed856a4c4410d1242ac1bd1539094a641cc086c2c53e363beafc74ab4e9ff320373705cbf5644586ffe60d293944fa2d9dc18b55f1af5c42f27747bef1ffd0c1766f062d47d61bf9f64e6ee288fa7fc12d48da526527b9f5c318c93ec447cb8b5eee7aa8a1e85696af3dfef96657c0545c8ebd96528d9c28828e5befd80d684b03b6d153da3e3cbd3bfbf4a9375b8ad04a1d241bcb5d5505cb6cc7a44e2e24bd0b1ca4879caaff59d0ce39dc7f3fea447f4e46967855208e63ec988bd2692afefbed2b001205e4b30ee8fe417defa566a73ace8f01f7181de0ef25f1744896a3c38859e6148c42454949cd64b1a888e7fe9c2d86bb01023b6ddeb67f5eb038af3e460c771518a4126c338b0390d459361e03adf6e6b558b3651a0e33d101b5febfff82794203da18db6fcf89715c2d338f78d8b9220171b41f528f857a7cb79ca990de1208777e13faaa9b9cb9e67797b07d9eb9e909410b50c5d981d9a72aa36498b630519d1530ef0000000000000000000037fcffffffffffffff8db8379bd2044c652dff399a9f8bfa4e9c507f049d18837464276830461ee203ba51f6102d262fc9a26bc3638ecce24e65c55da6efaa462f03d0e119c963a8c7a522b59f5a7b44d018cb2648383073d9e032492cae44350bc0a85697f431392eb22cae093e85954af97d6d7b2e6e8f43353062275ad1578a431594243452a2bfb89f91d8eaac038e9e17136e7c698f73faaabb3d00000000000080014573789425c4c32da528d89356aa6d2ae6da082e756c80cf39053431080ea6cbf9997a5a0ddad0b9d12bc3f880476ab32f0feaac5f16e61f7b72b8c9082eec423c6b3eaecfdcc9ec72795e7696421c83b76c2d6bac19bc875d009679778d8ef97d7e05329649d97b0dc54bea9b650873de2d3d702690176e0b23ee5cb5e469a8d1612d611722e6200e3a297d92f8e1de98326c5ef2b89d4e2d47767cd755783e5d865e373338e96ceb8399f296c59b2d70ca27735ecaff62982616d3ac1ab041733bce119d8002a6c8a2b08b32551b2313b1a2ff41b3f04af61c69c85cb2da48215727271bac2ffdeb62d9f5dc4845f1c3f63dc806e615ee8d28d6d7f181e30807afa27f41d0364c746a65a47464db68f3c433d88dd625db35fded2c86d75af88efaf20c8b37c644b6c4e773a9589200faa553bc92f916b75ddbfa18ab73979f46947b35914286d2499a0b8c970000000000000000f4fe74e0c26ab52329bd600627b256ca44dd121ffc8dbb6e5f70cbe03efccac70375b30cc927574d254d1b46c607e8b1ca7d1511568c3ef4b6b885f4582bdcef74e5e010627fc8e4fe00000000000000000000869d9640f06b11df2971909b90133983308ea4f033de613763f32d913bcbe9dd082a6fff197a20730269e6cfd31275395833f1c2b8a50a94c30cceae2a11fe9b9b835d0da73891c0b3ce22dea6bf31e7f51808cf72f44b4455b77a778440795e152dc1b7bb0a5636aa4742ce4d331a47de5836539cdf289176527277b70c8162aaf6f9475418b478329f3565450acfaf07000000eab8cabfa97e35081967bb92a264b07e8003d2f15537e72a1e4ca5ec1e2aaaf8236ecdefbaf512c75e636b6b6f518ad20521f909b12e9bc97e408e0dc82f950d12705f35708bc862196abb27e8d7991b5273987f38c4706289ff4f6130cee76465d487a07a74452f87da2029bd3debd9870335d58d3fe1ac80574fa3ea312997ab81bc6f569ffdb10ba3f20a86d95128d13e0c778998d3b3114bfb07bd61e4bff8a5e2ce4aa572c63e09b44ca4a181bcfe4eec3ce843c65c4948169fe639a186acc2b4a96c6b8d4d2e6d53ab97bea01eab953e6e89e3af34d4ada217bc6fda0fb2095c49195d0d6f365ca80a955b9ec81240a84ef672afa369fc8e3d444ba35d0f51a0065a3b982d09dfc6874fc0d8079b185447cb8a695e132d4d613a529d9c77e2a8f7320ecf698e8a2b170fd601dc1a9767a38b10788e92d1356f6a6c1bcfb2d31b46e735db13f1be80bac1b6be04fd98610000000000000000000000000000139af5493f74751c5e2501a4936bc4a0fa516117f4ccadc692003adee0a080eba2f1059660c0ee0e9aec72d4d0fe095632e4f641b0e34c611c5b3e0ba05fa36542d40837dda323910672a9097d68398fd3539686e4288db0d6bf7cb8a1835f46dfe11865a66ef47e736dada06677a5bca133d6cbc8fe5c4557e51b006bdccd7c5f32ff1d9e8b130f77df09236870fb3de5b87b4f8acc13df534eba329b86670000000000000000b27a2616c03cdf6c009447a652bca9b325e73c0737d5b717945e4fe7a169c5e2c54fc71a4104aa7cf0f5d30e2fcd9503650edbd8a5971a9a1fde5e5df37469ae204a6e899eacc1e63034cbabc5604739881cb82604bed3e53696a0606b26b879ef232a1a038291389593d1575cb79aa8284cf01a7e1a456acab9d8d608ad69d4c4b56492af7004e7ed9d47c5db3d76a00bea7c804f3a3638408bc1636f1009b7f185f51606918eaa0ab6bef11ae3d300"], &(0x7f0000000080)='GPL\x00', 0x9, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async) 787.956209ms ago: executing program 3 (id=4410): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000497ff66200080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000497ff66200080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x44, &(0x7f0000000000)={0x0, 0x0}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x44, &(0x7f0000000000)={0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x10, &(0x7f0000000740)=@framed={{}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x8, 0xfe00}, {0x7, 0x0, 0x8}, {}, {0x5}, {0x7, 0x0, 0x0, 0x0}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x1a}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x10, &(0x7f0000000740)=@framed={{}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x8, 0xfe00}, {0x7, 0x0, 0x8}, {}, {0x5}, {0x7, 0x0, 0x0, 0x0}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x1a}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f00000000c0)={0x29c, 0x12, 0x2, 0x70bd28, 0x25dfdbfd, {0x2c, 0x0, 0x5, 0xd8, {0x4e23, 0x4e21, [0x3, 0x9, 0x6, 0xcad6], [0x3ff, 0x0, 0x54, 0x2], 0x0, [0x2, 0x1]}, 0x9, 0x100}, [@INET_DIAG_REQ_BYTECODE={0xae, 0x1, "1db43af049b9a0eac63cfb1a15867443d1de11bb5b41c7e3aa19115f33e04d09937937f4e4050bfe6539f8656c9edc87189a2c896f26a796b1d8367219bf35dc0d0b1058dffcf6c1d14360e9ad81e5e564bbfb5155c839992f68c80451105f5db5ae7988927ccf47d95156ae151866575f44d4de2cf0a3e459a436b5f444b581eae339ef5a5c96a5cf84757d044a6924073aa8fd8e41cf38a85f49d5d432daa9b10392763c5fb99ebe9f"}, @INET_DIAG_REQ_BYTECODE={0xb9, 0x1, "0e0515e28209d7dddc0e3b1985b12700fd10d19d4500c22f82785bc8f2e94b1763068f5d51dadfa2256337068f370fe70d90a31261e0ee07b9258522520f86dd533cb2e7d3c5927fa529c7eef24fc6dd8396f58d6a361423cb2d4bbba1025c22d709641547d0bce0befd9a56b1f85989475218faacb170880a7d605b10ae446e1e918d10b263447d8e76b263d0b36c78134927a574df305d2a0bb6913fd740df69ae71520a16d694e93eb2ba7b619b86c819e54c73"}, @INET_DIAG_REQ_BYTECODE={0x56, 0x1, "7489294db36ff12ba76b1cd73863cc6c16680f8462b32184f3a29d83aa41dc60bc2f822d4dee90103e6f3e72c98d9e75bf5efd33efee56228de006604bd5cb70ee89d21480f6abf6a8fa58a2a85feee1bda6"}, @INET_DIAG_REQ_BYTECODE={0x5a, 0x1, "35fb93480b4da80aed7a4e3b5a83df338a49220b383a938cc4658f8b761c6da344d83cc82d94d433c922bb0a2c0b1a509030dac96ea019c5c8891121e68ab0c26e97fab5833ba37fe68a6b1afd4800643ccfc50133ad"}, @INET_DIAG_REQ_BYTECODE={0x30, 0x1, "9461c876f02891f10b684a3aedb11f29acce300142fe4c6021f7abc55a5d18bb0169e7941f9a67560a75463a"}]}, 0x29c}, 0x1, 0x0, 0x0, 0x2004c810}, 0xc4) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071117500000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@window={0x3, 0x3, 0x96}]}}}}}}}}, 0x0) 785.322201ms ago: executing program 2 (id=4411): recvfrom$llc(0xffffffffffffffff, &(0x7f0000000040)=""/120, 0x78, 0x10041, &(0x7f00000000c0)={0x1a, 0x103, 0x6, 0x8, 0x2, 0x8, @random="ab1058be2734"}, 0x10) (async) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(r1, &(0x7f0000000480)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r2, &(0x7f00000004c0)={0x2, 0x0, @multicast2, 0x2}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3d, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 743.569426ms ago: executing program 4 (id=4412): r0 = socket(0x11, 0x800000002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b2c, &(0x7f0000000040)) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8982, &(0x7f0000000000)={0x6, 'dvmrp0\x00', {0x864}, 0x7b2}) 667.347517ms ago: executing program 2 (id=4413): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c0009000000010380000000000000040f000000050001000a4dd104"], 0x1c}}, 0x0) (async) r1 = socket(0xa, 0x3, 0x4) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000140)={'IDLETIMER\x00'}, &(0x7f0000000280)=0x1e) (async, rerun: 32) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000300), &(0x7f0000000340)=0x4) (rerun: 32) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r1) (async) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) (async) syz_emit_ethernet(0x50, &(0x7f0000000200)={@local, @empty, @val={@void, {0x8100, 0x4, 0x0, 0x4}}, {@generic={0x809b, "14372bae8ebbb32feede97e2bdbb0b1d8da5b93b9a6322ad4993dd6f36fab6157fffad1e79c3d90a806e0db36cedbf399d78f329e8d61573dd12f1d12a7f"}}}, &(0x7f00000000c0)={0x0, 0xc8dd, [0x6c3, 0x206, 0x727, 0x762]}) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x34, 0x0, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x2000000) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c0019"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x12, r5, 0x0) (async) sendmmsg(r3, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f00000025c0)=[{&(0x7f0000000100)="313f7ac12164f7", 0x7}], 0x1}}], 0x1, 0x0) (async) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4040000}, 0x880) 611.817916ms ago: executing program 1 (id=4414): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000081000400000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000081000400000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x0) (async) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xb, 0xd}, {0x0, 0x2}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) 593.588501ms ago: executing program 3 (id=4415): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x17387344dc988f6a}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="02002bbd7000fcdbdf251700eaff0d0001006e65746465767369b7000f0002006e657464657673696d300000080003000100000008000b00fcffffffa054160081000000050012"], 0x54}, 0x1, 0x0, 0x0, 0x48884}, 0x2c000880) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0x7, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x4, 0xc9, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x6}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010865}, 0x4008000) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r10, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000280)={'veth1\x00'}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r12, 0x0, 0x0, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r11, 0x1, 0xd9, 0x6, @random="98c8ca7122df"}, 0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="700000001000010025bd7000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="380100005f0202002c001280110001006272696467655f736c61766500000000140005800500090000000000050008000000000008000a00"], 0x70}, 0x1, 0x0, 0x0, 0x8001}, 0x40040c4) 541.726313ms ago: executing program 0 (id=4416): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000200)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, 0x0, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x20088040}, 0x4) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x170, r1, 0x8, 0x70bd25, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0xfffffffd}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0x170}, 0x1, 0x0, 0x0, 0x24000001}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000020400"/20, @ANYRES32=0x0, @ANYBLOB="5d580000000000001c001a8018000a801400070000000000000000000000000000000001140003006970766c616e31000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x0) 500.293848ms ago: executing program 4 (id=4417): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711734000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, 0x1, 0xa, 0x0, 0x0, 0x0, {0x1, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x20004004) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000)=0x9, 0x4) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="080005"], 0x24}}, 0x0) recvmmsg(r2, &(0x7f0000002540)=[{{&(0x7f0000000840)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000240)=""/115, 0x75}, {&(0x7f0000000300)=""/167, 0xa7}, {&(0x7f00000003c0)=""/178, 0xb2}, {&(0x7f0000000480)=""/95, 0x5f}, {&(0x7f00000000c0)=""/48, 0x30}, {&(0x7f0000001340)=""/4095, 0x1000}, {&(0x7f0000000580)=""/81, 0x51}, {&(0x7f0000000600)=""/192, 0xc0}, {&(0x7f0000002800)=""/4096, 0x1000}], 0x9, &(0x7f0000000140)=""/61, 0x3d}, 0x2}, {{&(0x7f0000000780)=@isdn, 0x80, &(0x7f0000003800)=[{&(0x7f0000003880)=""/153, 0x99}, {&(0x7f00000008c0)=""/227, 0xe3}, {&(0x7f00000009c0)=""/177, 0xb1}, {&(0x7f0000000a80)=""/149, 0x95}, {&(0x7f0000000b40)=""/198, 0xc6}, {&(0x7f0000002680)=""/197, 0xc5}], 0x6, &(0x7f0000000cc0)=""/134, 0xfffffffffffffdc1}, 0x10001}, {{&(0x7f0000000d80)=@phonet, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000e00)=""/76, 0x4c}, {&(0x7f0000000e80)=""/223, 0xdf}, {&(0x7f0000000500)=""/32, 0x20}, {&(0x7f0000000f80)=""/49, 0x31}, {&(0x7f0000000fc0)=""/254, 0xfe}], 0x5, &(0x7f0000002340)=""/226, 0xe2}, 0xe}, {{&(0x7f0000001140)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000002440)=[{&(0x7f0000001240)=""/171, 0xab}, {&(0x7f0000000800)=""/27, 0x1b}], 0x2, &(0x7f0000002480)=""/187, 0xbb}, 0x8}], 0x4, 0x40012002, &(0x7f0000002640)={0x77359400}) sendmsg$nl_generic(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001300)={0x1c, 0x16, 0xa01, 0x80000000, 0x25dfdbfe, {0x2}, [@typed={0x4, 0xec}, @generic='!']}, 0x1c}}, 0x0) sendmmsg$inet6(r0, &(0x7f00000027c0)=[{{&(0x7f00000002c0)={0xa, 0x4e20, 0x0, @mcast2, 0x41}, 0x1c, 0x0}}], 0x1, 0x0) 498.212815ms ago: executing program 1 (id=4418): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x40, 0x140e, 0x1, 0x70bd29, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x824}, 0xc000) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c00)="f78d9ca38fff48f3be52163448412ba8ea2945e56c9d0c07b90e0aa06445cf2b74c2278ad7ad8633cd51dd7acf4536bac8c4635ff529b680a56b712e3cb5af7936e279fe07ba2f20334a4fdaec8c909e48d219b0e7e978166e29f691adec0e5526148adbaad390b4bd6b7e1050abf68515280ca2189a069539aacd9840e7c5b133180a836a9c7dc456448eafb217def1d6ca3e62338caebb4ed33a7c9eabec21a6f247d02a244e0cefaaf4386e99396a5afe2c34149995de08a45d3f2177579a01e0a2ea114a7e0e23cc5c260ed375faa4b119b2c8a8942a2f089cf952b6e4b21ba713", 0xe3}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4dbc3ae079f5fee8f28051926aae1efd7e0054a863f425cfe6cb54e7cb51726b360fbb37b4fe035bbb095873048", 0x48}, {&(0x7f0000000d00)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53ffcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2039b8a32ce9ec19062dbff79cf74cb2e5618e0e3b226a406ecf926ab538e24ff8f0dd2412b45ef06ac4e240211d5e18380efa6a46398907154344b4679e10d7826e0304f24fcf0f8b4f2afc4491e7a1e72794d936f67d8f8a74d00000000000000000000000000b2d3a8851a56799bd61ccee6d3a4cc88414ea68ec51cb95a94a6956c41098c667a0ecae2ad12622c61f47214b2723f06f5b4a07139d784541d5098ce4085909ca04c1398cd9fe0d467706054226e7e5b112e328aeaffffe1087148fdf6c48b748a8ecf99cb0133c575b431659d0749eb6fa929d488dd64ffbf772f8f430c08de6116140f4d7a3d4ae4d2558ce69df63d3567809732c45ac3c521d838f2eb790b35db9a56cf", 0x1d5}], 0x3, 0x0, 0x0, 0x80}], 0x1, 0x20000801) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0xff40}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x40d, 0x70bd2f, 0x1ffffffc, {0x0, 0x0, 0x0, r4, 0x40046, 0x3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}, @IFLA_BOND_XMIT_HASH_POLICY={0x5, 0xe, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x8000) sendmsg$NFT_MSG_GETCHAIN(r3, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="44020000040a010200000000000000000000020608000b40000000030900010073797a310000000008000b400000000108000540ff7fffff08000a4000000000fe000c00a8cd1debb8001c96f41a5cf6a1076346ce58789f3910f15e8f3fb6b08448f7986b70e0934768db8f215c044ead701d498f5f0876703dbb7d4b6c5ee0a08d8e4366b368851083eaed78fb006a2a482bc4d706afc988681ea06c9f492a34ea8f0e062321b665dceec708b93ef8322ab51e849b2ea89ad7731b1281e000008e64d346c80a63e182f180c7e90c87c0adc011d85721177d2804c53cadd8aacec5a7e99bfa537eddb8dacc2efe7fc9b82a30b360b2ccfe2b4a901ca40c1ac32c022fe6d1e55bfe33b00a1c4dfc8ea775d2e2c079d39770291f459a202d345a39a0f8da00876290aac9bac52dde0eda858474f995f0e3cb9ab26058066a00000900030073797a3100000000c6000c00620be79d45be3c3cdb547d31a94b5e4be768f312ce6e73c23e504d1bd5000dbd7df1486ca9e08a62116a40a7a87f57003007007926c14f2dfc98a9fb28ec259b13e93c6edef0c1ea0ec5420ce9428d0758d3e8169dfda5b8d9dd0a888859e4251bb4df6fc7e1d0e4a3a0a040444f2b615a304cbc7a7749dd31e155672ec9febe75f2e9c00899c98622c1e62299ebc698ebd1bccd3b646744685828f2f5d82efb7efd90b4781f3cf95aaa7b0719db396274920146b6516df15df1094c986becdb7f0f000008000b4000000001280008800c000140001000000000000d0c00024000000000000000060c0002400000000080000001"], 0x244}, 0x1, 0x0, 0x0, 0x4}, 0x20004004) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000880)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000170000000c0006"], 0x20}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a44000000090a010400000000000000000000000008000a4000fdff000900020073797a300000000008000440fffffffe08000540000000000900010073797a310000e6ff130000001100010000000000000000000000000a"], 0x6c}}, 0x0) 392.044799ms ago: executing program 2 (id=4419): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1e449, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000300012800b00010065727370616e0000200002800400120005001600020000000600180017000000050017"], 0x50}}, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'bond_slave_0\x00', &(0x7f0000000280)=@ethtool_gstrings}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x2, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000002000000000000000002000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70300000000000085000000ae000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 366.838652ms ago: executing program 0 (id=4420): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x7, 0x0, 0x10001, 0xffff, 0x5, 0x5, 0xfec8, 0x5, 0x7f}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffd, 0x4, 0x2, 0x4, 0x5, 0x2234, 0x83, 0x818, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x2, 0x58b, 0x85a, 0x3fc, 0x46, 0x2, 0x1, 0x0, 0x80000004, 0x10001, 0x790, 0x5, 0x1, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x3, 0xd2, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x5, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0xfffffffd, 0x9, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x408, 0x7ffffffd, 0x8, 0x1d24, 0x2, 0x7, 0xfffffffe, 0x7f, 0x6, 0x9, 0xff, 0x24, 0x5, 0xb, 0x6, 0x10007a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x9, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x5, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0xf7800000, 0xac, 0x9, 0x3, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0x10000a, 0x1, 0x0, 0x9, 0x300, 0x6, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x7fffffff, 0x5, 0x200, 0xac, 0xf, 0xd03, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0x8, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x0, 0x67f5, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0xc, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x107e, 0x4, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xfffffeff, 0x100005, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x3, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x1000, 0x4, 0x0, 0x3, 0x0, 0xd, 0x6, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0xc, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7fff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x8, 0x0, 0x2, 0x8, 0xffffff37, 0x3, 0x9, 0xc, 0xff, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x40, 0x4, 0x0, 0x5, 0x4, 0x1, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x9, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x5, 0x1f6, 0x751, 0x7, 0x40000000, 0x1, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a9, 0x1, 0x6, 0x3, 0x7ef8, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x3, 0x8, 0x5, 0x2, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x7, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x400003, 0x3, 0x6, 0x5fc8462f, 0x0, 0x100, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x7, 0x26, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0x40, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x8, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0xa, 0x6, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x20000000, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0xfc, 0x2, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r3, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r13, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x27, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r14, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x48, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r14, {0x0, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ARP_SHA={0xa, 0x3f, @local}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x20084084) 238.103515ms ago: executing program 4 (id=4421): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c000280060012"], 0x24}}, 0x0) (async) r3 = socket(0x25, 0x5, 0xb4) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) read(r4, &(0x7f0000000180)=""/115, 0x73) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000017c0)=ANY=[@ANYBLOB="180000000000f600000000000000000085000000a00000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) (async) sendmsg$SOCK_DIAG_BY_FAMILY(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000014001901000000000000000028001100fa"], 0x28}}, 0x0) (async) getsockopt$PNPIPE_IFINDEX(r3, 0x113, 0x2, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000001c0)={'erspan0\x00', &(0x7f0000000380)={'syztnl1\x00', r5, 0x10, 0x10, 0x7, 0x2af, {{0x4d, 0x4, 0x0, 0x3e, 0x134, 0x68, 0x0, 0x7, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, {[@ssrr={0x89, 0x13, 0xde, [@multicast2, @dev={0xac, 0x14, 0x14, 0x1e}, @broadcast, @multicast2]}, @end, @lsrr={0x83, 0x1f, 0x41, [@loopback, @local, @multicast2, @local, @empty, @empty, @empty]}, @cipso={0x86, 0x4c, 0x3, [{0x3, 0x9, "d3b3d18ec2c6bb"}, {0x7, 0x6, "99376cec"}, {0x0, 0xe, "b34550ba97211b737c9e998e"}, {0x0, 0xc, "84b99760f5015cef3c0f"}, {0x0, 0x2}, {0x7, 0x3, "aa"}, {0x7, 0x4, "68b1"}, {0x5, 0xe, "0f1463006029202f5a97c631"}, {0x2, 0x6, "511c31e6"}]}, @ssrr={0x89, 0x17, 0xff, [@private=0xa010100, @multicast1, @multicast1, @broadcast, @private=0xa010101]}, @generic={0x82, 0x5, "b0a9ee"}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x1c, 0xffffffffffffffff, [{0x7, 0x11, "a04ffcd3c56ceefa58bdf6b444f4bf"}, {0x6, 0x5, "37fb3d"}]}, @ssrr={0x89, 0x1f, 0xe9, [@empty, @loopback, @rand_addr=0x64010102, @local, @loopback, @private=0xa010102, @rand_addr=0x64010102]}, @cipso={0x86, 0x43, 0x3, [{0x5, 0x11, "d4e27d5a5f915083486a99bcebda7c"}, {0x5, 0xc, "7dd74f999dad09be6340"}, {0x5, 0xb, "c5e8a304b16bba0efd"}, {0x7, 0xd, "754b6d69729a42c85de4ab"}, {0x2, 0x8, "1f6ea9e016ac"}]}]}}}}}) (async) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x64010101}], 0xd) (async) sendmsg$nl_route(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_newaddr={0x68, 0x14, 0x200, 0x70bd2a, 0x25dfdbfd, {0xa, 0x40, 0x1, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @mcast2}, @IFA_FLAGS={0x8, 0x8, 0xc1}, @IFA_FLAGS={0x8, 0x8, 0x512}, @IFA_RT_PRIORITY={0x8, 0x9, 0x97b}, @IFA_ADDRESS={0x14, 0x1, @mcast2}, @IFA_RT_PRIORITY={0x8, 0x9, 0x9}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x48090) 100.106204ms ago: executing program 1 (id=4422): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)={0x58, r1, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x58}}, 0x20000000) 99.683393ms ago: executing program 2 (id=4423): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r0}, 0x18) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xcb, &(0x7f00000000c0)={0x1, 0x1, 0x7, r4}, 0xc) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 92.205228ms ago: executing program 4 (id=4424): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x12142) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000003c0)={'ip6tnl0\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)=ANY=[], 0x48) socket(0x40000000015, 0x5, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x14, r4, 0x1, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, r4, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x94) socketpair$unix(0x1, 0x5, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) 0s ago: executing program 3 (id=4425): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010000100000000000000000004000000", @ANYRES32=0x0, @ANYBLOB="000000000001000014001680100001800c000400feffffff0400000008001b"], 0x3c}}, 0x0) kernel console output (not intermixed with test programs): family 0 port 6081 - 0 [ 328.413395][ T6172] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.466005][T15771] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20003 [ 328.505238][ T6172] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.514037][ T6172] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.803425][ T3534] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.824393][ T3534] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.896137][ T6172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.908166][ T6172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.937550][T15790] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 329.082272][T15795] sctp: [Deprecated]: syz.1.2918 (pid 15795) Use of int in maxseg socket option. [ 329.082272][T15795] Use struct sctp_assoc_value instead [ 329.098747][T15795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2918'. [ 329.402077][T15810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2923'. [ 329.431103][T15802] syzkaller0: entered promiscuous mode [ 329.440314][T15802] syzkaller0: entered allmulticast mode [ 329.446546][T15810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2923'. [ 329.856926][T15826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2927'. [ 329.866124][T15826] validate_nla: 31 callbacks suppressed [ 329.866143][T15826] netlink: 'syz.4.2927': attribute type 5 has an invalid length. [ 329.886966][T15826] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2927'. [ 329.985169][ T5832] Bluetooth: hci3: command tx timeout [ 331.076296][T15826] geneve4: entered promiscuous mode [ 331.081587][T15826] geneve4: entered allmulticast mode [ 331.100735][ T3534] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 331.184630][ T3534] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 331.193312][ T3534] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 331.234338][ T3534] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 331.239471][T15850] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2932'. [ 331.508156][T15876] pim6reg: entered allmulticast mode [ 331.529986][T15878] bond10: down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 331.559695][T15879] bond11: down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 331.573767][T15878] netlink: 'syz.4.2939': attribute type 1 has an invalid length. [ 331.638443][T15884] netlink: 'syz.1.2941': attribute type 24 has an invalid length. [ 331.721820][T15891] netlink: 'syz.4.2943': attribute type 83 has an invalid length. [ 332.065025][ T5832] Bluetooth: hci3: command tx timeout [ 332.166557][T15902] netlink: 'syz.3.2948': attribute type 11 has an invalid length. [ 332.350703][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 332.361432][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 332.372787][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 332.382985][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 332.392093][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 332.463545][ T9046] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 332.480494][ T9046] netdevsim netdevsim1 eth3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 332.492218][ T9046] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.509657][T15918] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2951'. [ 332.577511][T15920] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.640728][ T9046] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 332.670014][ T9046] netdevsim netdevsim1 eth2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 332.682468][ T9046] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.722441][T15904] wlan0 speed is unknown, defaulting to 1000 [ 332.743442][T15904] wg1 speed is unknown, defaulting to 1000 [ 332.829226][ T9046] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 332.847128][T15931] netlink: 'syz.3.2956': attribute type 10 has an invalid length. [ 332.856447][ T9046] netdevsim netdevsim1 eth1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 332.858237][T15936] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2957'. [ 332.866336][ T9046] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.932646][T15931] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.947218][T15931] bridge_slave_1: left allmulticast mode [ 332.953082][T15931] bridge_slave_1: left promiscuous mode [ 332.962422][T15931] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.978537][T15931] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 333.058101][ T9046] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 333.097878][ T9046] netdevsim netdevsim1 eth0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 333.149150][ T9046] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.196156][T15946] netlink: 'syz.2.2955': attribute type 13 has an invalid length. [ 333.234876][T15952] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 333.262689][T15952] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2960'. [ 333.331176][T15946] erspan0: refused to change device tx_queue_len [ 333.345666][T15946] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 333.462896][T15958] macvlan4: entered promiscuous mode [ 333.468900][T15958] macvlan4: entered allmulticast mode [ 333.475626][T15958] bond9: entered promiscuous mode [ 333.481514][T15958] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 333.486436][T15952] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2960'. [ 333.499814][T15958] bond9: left promiscuous mode [ 333.538530][T15959] macvlan0: left promiscuous mode [ 333.545422][T15959] netlink: 'syz.0.2960': attribute type 2 has an invalid length. [ 333.882793][T15969] netlink: 'syz.4.2963': attribute type 83 has an invalid length. [ 333.948265][T15969] tipc: Enabled bearer , priority 0 [ 334.097062][T15974] syzkaller0: entered promiscuous mode [ 334.102758][T15974] syzkaller0: entered allmulticast mode [ 334.109059][T15974] tipc: Resetting bearer [ 334.122393][ T9046] bridge_slave_1: left allmulticast mode [ 334.135977][ T9046] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.145998][T15985] netlink: 'syz.0.2965': attribute type 63 has an invalid length. [ 334.172164][ T9046] bridge_slave_0: left allmulticast mode [ 334.180286][ T9046] bridge_slave_0: left promiscuous mode [ 334.194242][ T9046] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.226148][ T9046] veth0_to_bond: left allmulticast mode [ 334.239510][ T9046] veth0_to_bond: left promiscuous mode [ 334.246934][ T9046] bridge1: port 2(veth0_to_bond) entered disabled state [ 334.269151][ T9046] veth5: left allmulticast mode [ 334.278120][ T9046] veth5: left promiscuous mode [ 334.283557][ T9046] bridge1: port 1(veth5) entered disabled state [ 334.471643][ T52] Bluetooth: hci0: command tx timeout [ 335.218390][ T9046] bond5 (unregistering): (slave ip6gretap1): Releasing active interface [ 335.411160][ T9046] bond8 (unregistering): (slave gretap1): Releasing active interface [ 335.472180][ T9046] dvmrp0 (unregistering): left allmulticast mode [ 335.504155][ T9046] bond1 (unregistering): (slave geneve2): Releasing active interface [ 335.575326][ T9046] bridge0 (unregistering): left allmulticast mode [ 335.932731][ T9046] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 335.943581][ T9046] bond0 (unregistering): Released all slaves [ 336.030962][ T9046] bond1 (unregistering): Released all slaves [ 336.120471][ T9046] bond2 (unregistering): Released all slaves [ 336.217162][ T9046] bond3 (unregistering): Released all slaves [ 336.229881][ T9046] bond4 (unregistering): Released all slaves [ 336.242879][ T9046] bond5 (unregistering): Released all slaves [ 336.256198][ T9046] bond6 (unregistering): (slave lo): Releasing backup interface [ 336.264503][ T9046] bond6 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 336.277256][ T9046] bond6 (unregistering): Released all slaves [ 336.292169][ T9046] bond7 (unregistering): Released all slaves [ 336.305027][ T9046] bond8 (unregistering): Released all slaves [ 336.407704][ T9046] bond9 (unregistering): Released all slaves [ 336.419987][ T9046] bond10 (unregistering): Released all slaves [ 336.434021][T15987] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2964'. [ 336.443611][T15991] netlink: 284 bytes leftover after parsing attributes in process `syz.2.2964'. [ 336.551822][ T52] Bluetooth: hci0: command tx timeout [ 336.601857][T16006] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2969'. [ 336.612394][T16006] nbd: must specify at least one socket [ 336.679633][ T4644] tipc: Resetting bearer [ 336.703512][T15967] tipc: Resetting bearer [ 338.325977][T15967] tipc: Disabling bearer [ 338.334846][ T183] tipc: Node number set to 1311066274 [ 338.346051][T16003] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2967'. [ 338.364118][ T9046] 9: left promiscuous mode [ 338.635210][ T52] Bluetooth: hci0: command tx timeout [ 338.757020][T15904] chnl_net:caif_netlink_parms(): no params data found [ 338.772549][T16030] validate_nla: 1 callbacks suppressed [ 338.772567][T16030] netlink: 'syz.4.2976': attribute type 10 has an invalid length. [ 338.793143][ T9046] tipc: Left network mode [ 338.982800][T16040] netlink: 'syz.3.2977': attribute type 13 has an invalid length. [ 339.073233][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.106404][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.125792][T16046] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.155925][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.179499][T16054] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.204057][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.220497][T16046] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.255736][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 339.273491][T16061] netlink: 'syz.4.2981': attribute type 1 has an invalid length. [ 339.302582][T16061] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2981'. [ 339.408898][T16040] ip6tnl0: Caught tx_queue_len zero misconfig [ 339.456055][T15904] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.463449][T15904] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.476958][T15904] bridge_slave_0: entered allmulticast mode [ 339.484762][T15904] bridge_slave_0: entered promiscuous mode [ 339.605908][T15904] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.613142][T15904] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.634986][T15904] bridge_slave_1: entered allmulticast mode [ 339.647813][T15904] bridge_slave_1: entered promiscuous mode [ 339.933670][T15904] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.957243][ T9048] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.023668][T16088] ip6gre2: entered allmulticast mode [ 340.043186][T15904] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 340.123162][ T9048] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.216717][ T9048] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.238320][ T9048] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 340.252019][T16102] netlink: 'syz.3.2991': attribute type 9 has an invalid length. [ 340.263039][T16102] netlink: 'syz.3.2991': attribute type 6 has an invalid length. [ 340.704652][ T52] Bluetooth: hci0: command tx timeout [ 341.065837][T15904] team0: Port device team_slave_0 added [ 341.153400][T16104] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 341.167712][T16104] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.173463][T16121] netlink: 'syz.0.2993': attribute type 1 has an invalid length. [ 341.199454][T15904] team0: Port device team_slave_1 added [ 341.333251][T16104] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 341.347224][T16104] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 341.373850][T15904] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.383259][T15904] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.387437][T16130] netlink: 'syz.0.2997': attribute type 2 has an invalid length. [ 341.411760][T15904] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.437185][ T9046] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 341.445677][ T9046] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 341.455557][ T9046] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 341.463125][ T9046] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 341.473865][ T9046] batman_adv: batadv0: Removing interface: dummy0 [ 341.505383][ T9046] veth1_vlan: left promiscuous mode [ 341.973484][ T9046] team0 (unregistering): Port device team_slave_1 removed [ 342.021142][ T9046] team0 (unregistering): Port device team_slave_0 removed [ 342.441595][T16131] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 342.462479][T16130] 9: entered promiscuous mode [ 342.473613][T15904] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 342.494703][T15904] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 342.536640][T15904] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.566818][T16104] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.577480][T16104] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.768499][T16104] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.782544][T16104] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.019184][T15904] hsr_slave_0: entered promiscuous mode [ 343.038581][T15904] hsr_slave_1: entered promiscuous mode [ 343.053511][T15904] debugfs: 'hsr0' already exists in 'hsr' [ 343.066632][T15904] Cannot create hsr debugfs directory [ 343.338124][ T9048] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.353574][ T9048] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.499343][ T9048] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.514515][ T9048] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.566807][ T9044] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.598636][ T9044] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.665469][ T9048] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.678212][ T9048] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.786533][T16202] __nla_validate_parse: 6 callbacks suppressed [ 343.786553][T16202] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3012'. [ 343.810055][T16207] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3012'. [ 343.856161][T16206] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3014'. [ 343.881598][T16206] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3014'. [ 343.919684][T16206] netlink: 'syz.2.3014': attribute type 5 has an invalid length. [ 343.945692][T16211] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 343.961088][T16206] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3014'. [ 344.035674][T16216] netlink: 'syz.4.3015': attribute type 4 has an invalid length. [ 344.096225][T16206] geneve4: entered promiscuous mode [ 344.102056][T16206] geneve4: entered allmulticast mode [ 344.246263][ T3534] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 59300 - 0 [ 344.281844][ T3534] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 59300 - 0 [ 344.298579][T16230] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3019'. [ 344.323304][ T3534] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 59300 - 0 [ 344.486817][ T3534] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 59300 - 0 [ 344.516833][T16240] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3022'. [ 344.606178][T16239] netlink: 'syz.3.3021': attribute type 29 has an invalid length. [ 344.633108][T16246] netlink: 'syz.3.3021': attribute type 29 has an invalid length. [ 344.714016][T16239] netlink: 500 bytes leftover after parsing attributes in process `syz.3.3021'. [ 344.736383][T16239] unsupported nla_type 58 [ 344.916273][ T9046] IPVS: stop unused estimator thread 0... [ 345.011002][T16257] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3024'. [ 345.041474][T15904] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 345.080071][T16257] netlink: 'syz.4.3024': attribute type 1 has an invalid length. [ 345.106342][T15904] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 345.122196][T16257] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3024'. [ 345.134796][T16269] xt_l2tp: unknown flags: 10 [ 345.168532][T16269] lo: Caught tx_queue_len zero misconfig [ 345.234722][T15904] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 345.311074][T15904] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 345.337593][T16285] Cannot find del_set index 4 as target [ 345.507046][T16297] bond0: Caught tx_queue_len zero misconfig [ 345.760080][T15904] 8021q: adding VLAN 0 to HW filter on device bond0 [ 345.902628][T15904] 8021q: adding VLAN 0 to HW filter on device team0 [ 345.966376][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.973554][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.000741][T16335] xt_cgroup: invalid path, errno=-2 [ 346.028727][ T3534] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.035943][ T3534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 346.171670][T16339] netlink: 'syz.4.3043': attribute type 29 has an invalid length. [ 346.195170][T16339] netlink: 'syz.4.3043': attribute type 29 has an invalid length. [ 346.236321][T16341] netlink: 'syz.4.3043': attribute type 29 has an invalid length. [ 346.477643][T16352] bond0: entered promiscuous mode [ 346.492134][T16352] : entered promiscuous mode [ 346.497680][T16352] bond_slave_1: entered promiscuous mode [ 346.503693][T16352] bridge_slave_1: entered promiscuous mode [ 346.518602][T16352] bond0: left promiscuous mode [ 346.523552][T16352] : left promiscuous mode [ 346.528779][T16352] bond_slave_1: left promiscuous mode [ 346.534647][T16352] bridge_slave_1: left promiscuous mode [ 346.749478][T16367] netlink: 'syz.4.3048': attribute type 1 has an invalid length. [ 346.770904][T15904] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 346.925307][T15904] veth0_vlan: entered promiscuous mode [ 346.967069][T15904] veth1_vlan: entered promiscuous mode [ 347.081807][T15904] veth0_macvtap: entered promiscuous mode [ 347.123676][T15904] veth1_macvtap: entered promiscuous mode [ 347.283329][T15904] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 347.351353][T15904] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.374004][T16395] syzkaller0: entered promiscuous mode [ 347.380733][T16395] syzkaller0: entered allmulticast mode [ 347.395695][ T9048] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.486506][ T9048] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.500748][ T9048] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.519998][ T9048] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.540055][T16400] team0: Cannot enslave team device to itself [ 347.806263][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.814133][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.945064][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.972261][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 348.288617][T16454] netlink: 'syz.0.3068': attribute type 24 has an invalid length. [ 348.315059][T16453] sctp: [Deprecated]: syz.1.2946 (pid 16453) Use of struct sctp_assoc_value in delayed_ack socket option. [ 348.315059][T16453] Use struct sctp_sack_info instead [ 349.350716][ T5832] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 349.371287][ T5832] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 349.380654][ T5832] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 349.390135][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 349.398543][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 349.463452][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 349.495872][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 349.519980][T16504] macvlan0: entered promiscuous mode [ 349.644688][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 349.679346][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 349.752713][T16500] wlan0 speed is unknown, defaulting to 1000 [ 349.863289][T16500] wg1 speed is unknown, defaulting to 1000 [ 349.891950][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 349.929202][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 350.137733][T16549] __nla_validate_parse: 11 callbacks suppressed [ 350.137752][T16549] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3091'. [ 350.269089][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 350.299146][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 351.229893][T16607] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3103'. [ 351.514433][ T5832] Bluetooth: hci4: command tx timeout [ 353.261636][ T13] bond5 (unregistering): (slave gretap1): Releasing active interface [ 353.331499][ T13] dvmrp6 (unregistering): left allmulticast mode [ 353.584984][ T5832] Bluetooth: hci4: command tx timeout [ 353.808423][ T13] bond6 (unregistering): (slave bridge8): Releasing backup interface [ 354.000691][ T13] bond0 (unregistering): (slave 32): Releasing backup interface [ 354.010221][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 354.020642][ T13] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 354.032729][ T13] bond0 (unregistering): Released all slaves [ 354.151960][ T13] bond1 (unregistering): Released all slaves [ 354.165197][ T13] bond2 (unregistering): Released all slaves [ 354.302269][ T13] bond3 (unregistering): (slave veth7): Releasing active interface [ 354.314708][ T13] bond3 (unregistering): Released all slaves [ 354.429139][ T13] bond4 (unregistering): Released all slaves [ 354.441289][ T13] bond5 (unregistering): Released all slaves [ 354.453361][ T13] bond6 (unregistering): Released all slaves [ 354.466524][ T13] bond7 (unregistering): Released all slaves [ 354.484904][ T13] bond8 (unregistering): Released all slaves [ 354.605755][ T13] bond9 (unregistering): Released all slaves [ 354.618545][ T13] bond10 (unregistering): Released all slaves [ 354.631626][ T13] bond11 (unregistering): Released all slaves [ 354.867697][ T13] tipc: Left network mode [ 354.870883][T16614] macvlan0: entered promiscuous mode [ 354.924919][T16500] chnl_net:caif_netlink_parms(): no params data found [ 354.936422][T16618] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3107'. [ 355.049427][ T13] IPVS: stopping backup sync thread 9297 ... [ 355.276649][T16639] netlink: 'syz.3.3112': attribute type 13 has an invalid length. [ 355.309328][T16639] netlink: 'syz.3.3112': attribute type 58 has an invalid length. [ 355.331731][T16636] syzkaller0: entered promiscuous mode [ 355.338291][T16636] syzkaller0: entered allmulticast mode [ 355.346263][T16639] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3112'. [ 355.426723][T16640] xt_hashlimit: size too large, truncated to 1048576 [ 355.664638][ T5832] Bluetooth: hci4: command tx timeout [ 355.778121][T16624] bond10: entered allmulticast mode [ 355.796832][T16624] 8021q: adding VLAN 0 to HW filter on device bond10 [ 355.855236][T16500] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.863932][T16500] bridge0: port 1(bridge_slave_0) entered disabled state [ 355.876150][T16500] bridge_slave_0: entered allmulticast mode [ 355.906250][T16500] bridge_slave_0: entered promiscuous mode [ 356.040224][T16500] bridge0: port 2(bridge_slave_1) entered blocking state [ 356.049127][T16682] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 356.056431][T16682] IPv6: NLM_F_CREATE should be set when creating new route [ 356.063719][T16682] IPv6: NLM_F_CREATE should be set when creating new route [ 356.081912][T16500] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.089441][T16500] bridge_slave_1: entered allmulticast mode [ 356.095874][T16682] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 356.105836][T16500] bridge_slave_1: entered promiscuous mode [ 356.223796][T16500] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 356.268443][T16500] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 356.441048][T16500] team0: Port device team_slave_0 added [ 356.461654][T16500] team0: Port device team_slave_1 added [ 356.675751][T16672] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 356.742293][T16704] x_tables: unsorted underflow at hook 2 [ 356.773458][T16500] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 356.798199][T16500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 356.825967][T16500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 356.848507][ T937] IPVS: starting estimator thread 0... [ 356.864149][T16500] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 356.902923][T16500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 356.903765][T16715] netlink: 'syz.2.3125': attribute type 12 has an invalid length. [ 356.949438][T16500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 357.014391][T16713] IPVS: using max 31 ests per chain, 74400 per kthread [ 357.105315][T16724] netlink: 'syz.3.3127': attribute type 83 has an invalid length. [ 357.114965][T16725] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3126'. [ 357.184034][ T13] hsr_slave_0: left promiscuous mode [ 357.193512][T16731] netlink: 'syz.3.3127': attribute type 11 has an invalid length. [ 357.202509][ T13] hsr_slave_1: left promiscuous mode [ 357.210738][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 357.215515][T16731] netlink: 'syz.3.3127': attribute type 11 has an invalid length. [ 357.237339][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 357.242866][T16731] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3127'. [ 357.313331][ T13] pimreg3 (unregistering): left allmulticast mode [ 357.755322][ T5832] Bluetooth: hci4: command tx timeout [ 358.060696][T16715] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 358.130989][T16730] bridge0: entered promiscuous mode [ 358.148132][T16730] macsec1: entered promiscuous mode [ 358.153578][T16730] macsec1: entered allmulticast mode [ 358.165038][T16730] bridge0: entered allmulticast mode [ 358.172125][T16730] bridge0: port 3(macsec1) entered blocking state [ 358.179095][T16730] bridge0: port 3(macsec1) entered disabled state [ 358.193862][T16730] bridge0: left allmulticast mode [ 358.216497][T16730] bridge0: left promiscuous mode [ 358.398008][T16500] hsr_slave_0: entered promiscuous mode [ 358.398448][T16759] Bluetooth: MGMT ver 1.23 [ 358.405686][T16500] hsr_slave_1: entered promiscuous mode [ 358.417892][T16500] debugfs: 'hsr0' already exists in 'hsr' [ 358.423666][T16500] Cannot create hsr debugfs directory [ 358.458410][T16759] syzkaller1: entered promiscuous mode [ 358.463946][T16759] syzkaller1: entered allmulticast mode [ 358.516654][T16759] netlink: 'syz.1.3135': attribute type 3 has an invalid length. [ 358.527353][T16759] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3135'. [ 358.733814][ T13] IPVS: stop unused estimator thread 0... [ 358.790839][T16778] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3140'. [ 358.801234][T16778] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3140'. [ 358.820171][T16783] Bluetooth: MGMT ver 1.23 [ 358.831453][T16783] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 359.739690][T16832] netlink: 'syz.3.3150': attribute type 4 has an invalid length. [ 360.065574][T16856] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3153'. [ 360.282470][T16862] wlan0 speed is unknown, defaulting to 1000 [ 360.293446][T16500] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 360.364059][T16500] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 360.466667][T16500] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 360.522497][T16500] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 360.580946][T16878] xt_cgroup: path and classid specified [ 360.591485][T16881] syzkaller1: entered promiscuous mode [ 360.603299][T16881] syzkaller1: entered allmulticast mode [ 360.844953][T16899] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3161'. [ 360.919886][T16899] netlink: 'syz.3.3161': attribute type 1 has an invalid length. [ 360.965781][T16899] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3161'. [ 361.114106][T16500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 361.172759][T16500] 8021q: adding VLAN 0 to HW filter on device team0 [ 361.213841][T16910] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.221521][T16910] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.285354][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.292539][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 361.404839][ T9048] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.412289][ T9048] bridge0: port 2(bridge_slave_1) entered forwarding state [ 361.540697][T16930] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3167'. [ 361.843274][T16936] netlink: 'syz.3.3168': attribute type 10 has an invalid length. [ 362.069185][T16500] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 362.078193][T16948] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3170'. [ 362.099956][T16951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3171'. [ 362.123045][T16948] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.202024][T16948] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3170'. [ 362.216803][T16951] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 362.271441][T16951] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3171'. [ 362.302987][T16948] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.310354][T16948] bridge0: port 1(bridge_slave_0) entered forwarding state [ 362.325951][T16964] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3173'. [ 362.352812][T16948] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3170'. [ 362.365730][T16961] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3173'. [ 362.418137][T16948] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.584814][T16971] tipc: Enabling of bearer rejected, media not registered [ 362.830844][T16987] xt_HMARK: spi-set and port-set can't be combined [ 362.887239][T16990] netlink: 'syz.0.3179': attribute type 8 has an invalid length. [ 362.905062][T16500] veth0_vlan: entered promiscuous mode [ 362.968184][T16500] veth1_vlan: entered promiscuous mode [ 363.069218][T16500] veth0_macvtap: entered promiscuous mode [ 363.094076][T16500] veth1_macvtap: entered promiscuous mode [ 363.149162][T16500] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 363.213744][T16500] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 363.249961][T17005] batman_adv: batadv0: Adding interface: dummy0 [ 363.256948][T17005] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 363.314934][T17005] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 363.369284][ T6172] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.388624][ T6172] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.427280][ T6172] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.463207][ T6172] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.631821][ T4644] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.659998][ T4644] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.682703][T17019] netdevsim netdevsim0 ÿÿÿÿÿÿ: renamed from netdevsim0 [ 363.758828][ T6172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.784704][ T6172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.954659][T17032] netlink: 'syz.0.3191': attribute type 13 has an invalid length. [ 364.083304][T17032] bond_slave_1: left allmulticast mode [ 364.150434][T17032] tipc: Resetting bearer [ 364.165659][T17032] tipc: Resetting bearer [ 364.173997][T17032] macvlan0: left promiscuous mode [ 364.210078][T17032] netdevsim netdevsim0 ÿÿÿÿÿÿ: left promiscuous mode [ 364.408547][T17032] vlan2: left allmulticast mode [ 364.413575][T17032] erspan0: left allmulticast mode [ 364.447973][T17032] veth9: left promiscuous mode [ 364.475178][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 364.494065][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 364.511546][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 364.520751][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 364.529824][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 364.551444][T17032] team1: left promiscuous mode [ 364.556494][T17032] team1: left allmulticast mode [ 364.563157][T17032] bond7: left promiscuous mode [ 364.568348][T17032] bond7: left allmulticast mode [ 364.575346][T17032] bridge11: left promiscuous mode [ 364.580398][T17032] bridge11: left allmulticast mode [ 364.586529][T17032] vlan4: left promiscuous mode [ 364.591310][T17032] bridge0: left promiscuous mode [ 364.596653][T17032] team0: left promiscuous mode [ 364.603368][T17032] bridge12: left promiscuous mode [ 364.608472][T17032] bridge12: left allmulticast mode [ 364.614648][T17032] gretap2: left promiscuous mode [ 364.619612][T17032] gretap2: left allmulticast mode [ 364.631137][T17032] bond10: left allmulticast mode [ 364.839537][T17057] netlink: 'syz.1.3196': attribute type 5 has an invalid length. [ 364.884527][T17048] wlan0 speed is unknown, defaulting to 1000 [ 365.241452][T17085] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 365.389350][T17089] syzkaller1: entered promiscuous mode [ 365.403324][T17089] syzkaller1: entered allmulticast mode [ 365.982299][T17088] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 366.008337][T17088] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 366.293961][ T9048] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.303891][ T9048] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.316199][ T9048] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.327638][ T9048] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.403242][T17109] __nla_validate_parse: 10 callbacks suppressed [ 366.403261][T17109] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3211'. [ 366.457382][ T9048] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.476350][ T9048] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.496808][T17116] netlink: 'syz.0.3213': attribute type 1 has an invalid length. [ 366.507919][T17116] netlink: 'syz.0.3213': attribute type 1 has an invalid length. [ 366.518455][T17116] netlink: 'syz.0.3213': attribute type 1 has an invalid length. [ 366.532267][ T9048] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 366.541465][T17116] netlink: 'syz.0.3213': attribute type 2 has an invalid length. [ 366.549468][ T9048] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.559328][T17116] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3213'. [ 366.564307][ T5832] Bluetooth: hci5: command tx timeout [ 366.576729][T17048] chnl_net:caif_netlink_parms(): no params data found [ 366.591208][T17116] nftables ruleset with unbound set [ 366.656648][T17123] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 366.904164][T17137] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3218'. [ 366.956935][T17048] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.965933][T17137] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3218'. [ 366.972025][T17147] TCP: request_sock_subflow_v6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 366.975419][T17048] bridge0: port 1(bridge_slave_0) entered disabled state [ 366.994848][T17048] bridge_slave_0: entered allmulticast mode [ 367.002627][T17048] bridge_slave_0: entered promiscuous mode [ 367.022811][T17148] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3220'. [ 367.034246][T17148] netlink: 'syz.4.3220': attribute type 3 has an invalid length. [ 367.047882][T17048] bridge0: port 2(bridge_slave_1) entered blocking state [ 367.063078][T17048] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.071024][T17048] bridge_slave_1: entered allmulticast mode [ 367.078589][T17048] bridge_slave_1: entered promiscuous mode [ 367.141432][T17048] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 367.156238][T17048] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 367.164958][T17153] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3223'. [ 367.206450][T17150] : renamed from bond_slave_0 (while UP) [ 367.221367][T17048] team0: Port device team_slave_0 added [ 367.231515][T17048] team0: Port device team_slave_1 added [ 367.308445][T17048] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 367.318702][T17048] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.378602][T17048] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 367.444730][T17048] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 367.481288][T17048] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.528785][T17048] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 367.589090][T17175] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3228'. [ 367.634816][T17048] hsr_slave_0: entered promiscuous mode [ 367.641849][T17048] hsr_slave_1: entered promiscuous mode [ 367.649167][T17048] debugfs: 'hsr0' already exists in 'hsr' [ 367.655285][T17048] Cannot create hsr debugfs directory [ 367.737304][T17184] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3231'. [ 367.804667][T17179] bond11 (unregistering): Released all slaves [ 367.859684][T17191] vlan2: entered allmulticast mode [ 367.885789][T17192] vlan2: entered allmulticast mode [ 367.908189][T17194] block nbd0: Unsupported socket: should be TCP or UNIX. [ 368.061707][T17197] netlink: 'syz.1.3234': attribute type 33 has an invalid length. [ 368.084511][T17197] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3234'. [ 368.175330][T17048] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.190390][T17048] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.201678][T17048] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 59300 - 0 [ 368.216672][T17206] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3237'. [ 368.326175][T17048] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.344371][T17048] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.368481][T17048] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 59300 - 0 [ 368.399289][T17210] netlink: 'syz.3.3239': attribute type 29 has an invalid length. [ 368.409624][T17216] netlink: 'syz.3.3239': attribute type 29 has an invalid length. [ 368.418043][T17219] netlink: 'syz.4.3242': attribute type 12 has an invalid length. [ 368.451211][T17048] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.461482][T17048] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.471613][T17048] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 59300 - 0 [ 368.556507][T17048] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.585479][T17048] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.596268][T17048] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 59300 - 0 [ 368.629921][ T5832] Bluetooth: hci5: command tx timeout [ 368.667598][T17224] lo: entered allmulticast mode [ 368.926458][T17237] veth1_to_bond: entered allmulticast mode [ 368.945140][T17048] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 368.970206][T17048] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 369.031401][T17048] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 369.081749][T17048] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 369.326625][T17048] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.382592][T17048] 8021q: adding VLAN 0 to HW filter on device team0 [ 369.413548][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.420795][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 369.459664][ T6172] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.466953][ T6172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 369.706712][T17236] veth1_to_bond: left allmulticast mode [ 369.852102][T17048] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 369.879463][T17281] netlink: 'syz.1.3254': attribute type 2 has an invalid length. [ 370.012426][T17286] IPv6: NLM_F_REPLACE set, but no existing node found! [ 370.021314][T17048] veth0_vlan: entered promiscuous mode [ 370.047106][T17048] veth1_vlan: entered promiscuous mode [ 370.134091][T17048] veth0_macvtap: entered promiscuous mode [ 370.146014][T17048] veth1_macvtap: entered promiscuous mode [ 370.176697][T17048] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 370.192321][T17048] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 370.213025][ T9044] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.264868][ T9044] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.300368][ T9044] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.335859][ T9044] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.569847][ T2122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.586275][ T2122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.692348][ T6172] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.705612][ T5832] Bluetooth: hci5: command tx timeout [ 370.712133][ T6172] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.812273][T17331] team0: Caught tx_queue_len zero misconfig [ 370.977888][T17338] tipc: Started in network mode [ 370.982820][T17338] tipc: Node identity ae2fc78dc6a7, cluster identity 4711 [ 370.995969][T17338] tipc: Enabled bearer , priority 0 [ 371.007535][T17338] syzkaller0: entered promiscuous mode [ 371.013064][T17338] syzkaller0: entered allmulticast mode [ 371.099493][T17338] tipc: Resetting bearer [ 371.179643][T17338] tipc: Disabling bearer [ 371.708873][T17368] validate_nla: 2 callbacks suppressed [ 371.708891][T17368] netlink: 'syz.3.3281': attribute type 3 has an invalid length. [ 371.709218][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 371.736535][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 371.746859][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 371.759159][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 371.767998][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 371.857167][ T6172] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 371.889586][ T6172] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.971044][T17367] wlan0 speed is unknown, defaulting to 1000 [ 372.050966][ T6172] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 372.080166][ T6172] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 372.093102][T17384] __nla_validate_parse: 74 callbacks suppressed [ 372.093121][T17384] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3286'. [ 372.184919][T17386] sctp: [Deprecated]: syz.3.3287 (pid 17386) Use of int in maxseg socket option. [ 372.184919][T17386] Use struct sctp_assoc_value instead [ 372.186460][ T6172] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 372.211937][ T6172] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 372.309815][ T6172] netdevsim netdevsim0 ÿÿÿÿÿÿ (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 372.322442][ T6172] netdevsim netdevsim0 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 372.387635][T17395] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3290'. [ 372.622709][T17407] netlink: 'syz.2.3292': attribute type 12 has an invalid length. [ 372.702776][T17367] chnl_net:caif_netlink_parms(): no params data found [ 372.771519][ T6172] team0: left allmulticast mode [ 372.779159][ T6172] bridge6: left allmulticast mode [ 372.789307][ T52] Bluetooth: hci5: command tx timeout [ 372.814951][ T6172] bridge6: left promiscuous mode [ 372.824430][ T6172] bridge0: port 1(team0) entered disabled state [ 373.725156][ T6172] bond1 (unregistering): (slave bridge3): Releasing active interface [ 373.815801][ T6172] bond3 (unregistering): (slave bridge5): Releasing backup interface [ 373.825397][ T52] Bluetooth: hci1: command tx timeout [ 373.867684][ T6172] team0: Port device bridge6 removed [ 373.909150][T17440] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3298'. [ 374.389121][ T6172] bond0 (unregistering): Released all slaves [ 374.401755][ T6172] bond1 (unregistering): Released all slaves [ 374.414077][ T6172] bond2 (unregistering): Released all slaves [ 374.429245][ T6172] bond3 (unregistering): Released all slaves [ 374.551233][ T6172] bond4 (unregistering): Released all slaves [ 374.678461][ T6172] bond5 (unregistering): (slave veth9): Releasing active interface [ 374.688188][ T6172] bond5 (unregistering): Released all slaves [ 374.810886][ T6172] bond6 (unregistering): Released all slaves [ 374.931210][ T6172] bond7 (unregistering): Released all slaves [ 374.943366][ T6172] bond8 (unregistering): Released all slaves [ 374.956365][ T6172] bond9 (unregistering): Released all slaves [ 375.066099][ T6172] bond10 (unregistering): Released all slaves [ 375.248309][ T6172] : left promiscuous mode [ 375.285387][T17450] netlink: 'syz.4.3299': attribute type 11 has an invalid length. [ 375.295952][T17450] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3299'. [ 375.308503][T17451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3300'. [ 375.362288][T17455] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 375.442916][ T6172] : left promiscuous mode [ 375.549668][T17467] netlink: 'syz.4.3305': attribute type 1 has an invalid length. [ 375.560302][ T6172] 9: left promiscuous mode [ 375.607987][T17467] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 375.666977][T17463] syzkaller0: entered promiscuous mode [ 375.672501][T17463] syzkaller0: entered allmulticast mode [ 375.718917][ T6172] tipc: Disabling bearer [ 375.771446][ T6172] tipc: Left network mode [ 375.771610][T17367] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.841884][T17367] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.858815][T17367] bridge_slave_0: entered allmulticast mode [ 375.868868][T17367] bridge_slave_0: entered promiscuous mode [ 375.900513][T17484] netlink: 'syz.1.3307': attribute type 1 has an invalid length. [ 375.908551][ T52] Bluetooth: hci1: command tx timeout [ 375.964685][T17367] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.977912][T17367] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.994896][T17494] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3307'. [ 376.019749][T17367] bridge_slave_1: entered allmulticast mode [ 376.050018][T17367] bridge_slave_1: entered promiscuous mode [ 376.088855][T17504] netlink: 'syz.4.3311': attribute type 1 has an invalid length. [ 376.260298][T17512] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3313'. [ 376.294503][T17504] 8021q: adding VLAN 0 to HW filter on device bond1 [ 376.313171][T17507] gretap1: entered promiscuous mode [ 376.323280][T17507] bond1: (slave gretap1): making interface the new active one [ 376.332609][T17507] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 376.350161][T17509] macvlan2: entered promiscuous mode [ 376.355747][T17509] macvlan2: entered allmulticast mode [ 376.362165][T17509] bond1: entered promiscuous mode [ 376.368579][T17509] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 376.368663][T17516] netlink: zone id is out of range [ 376.376843][T17509] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 376.402119][T17509] bond1: left promiscuous mode [ 376.407889][T17516] netlink: zone id is out of range [ 376.424075][T17516] netlink: zone id is out of range [ 376.437482][T17516] netlink: zone id is out of range [ 376.450092][T17516] netlink: zone id is out of range [ 376.457152][T17516] netlink: zone id is out of range [ 376.473490][T17519] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 376.503230][T17516] netlink: zone id is out of range [ 376.510852][T17516] netlink: zone id is out of range [ 376.544169][T17367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.559601][T17367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.771204][ T71] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.804409][ T71] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.826741][ T71] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.860398][T17367] team0: Port device team_slave_0 added [ 376.886955][T17527] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 376.896324][T17527] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 376.905298][T17527] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 376.912728][T17527] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.928510][T17538] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3319'. [ 377.005028][ T71] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 377.027980][T17367] team0: Port device team_slave_1 added [ 377.074880][T17535] netlink: 'syz.4.3320': attribute type 4 has an invalid length. [ 377.115839][T17549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3322'. [ 377.145149][T17549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3322'. [ 377.160660][T17549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3322'. [ 377.175570][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3324'. [ 377.198411][T17367] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 377.216894][T17367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 377.263304][T17367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 377.283191][T17367] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 377.302277][T17367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 377.354607][T17367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 377.488116][ T6172] hsr_slave_0: left promiscuous mode [ 377.500678][ T6172] hsr_slave_1: left promiscuous mode [ 377.520556][ T6172] batman_adv: batadv0: Removing interface: dummy0 [ 377.548663][ T6172] veth1_vlan: left promiscuous mode [ 377.571584][ T6172] veth0_vlan: left promiscuous mode [ 377.756853][ T6172] pim6reg (unregistering): left allmulticast mode [ 377.796043][ T6172] pimreg (unregistering): left allmulticast mode [ 377.987206][ T52] Bluetooth: hci1: command tx timeout [ 378.656998][T17587] macvlan0: entered promiscuous mode [ 378.911423][T17367] hsr_slave_0: entered promiscuous mode [ 378.941686][T17367] hsr_slave_1: entered promiscuous mode [ 378.964732][T17367] debugfs: 'hsr0' already exists in 'hsr' [ 378.980741][T17367] Cannot create hsr debugfs directory [ 378.990412][T17603] netem: incorrect gi model size [ 379.005812][T17603] netem: change failed [ 379.011275][T17612] mac80211_hwsim hwsim33 syzkaller0: entered promiscuous mode [ 379.029257][T17612] mac80211_hwsim hwsim33 syzkaller0: entered allmulticast mode [ 379.087302][T17614] bond1: option miimon: invalid value (18446744073709551585) [ 379.095294][T17614] bond1: option miimon: allowed values 0 - 2147483647 [ 379.112878][T17614] bond1 (unregistering): Released all slaves [ 379.249694][ T6172] IPVS: stop unused estimator thread 0... [ 379.328451][T17625] xt_l2tp: v2 doesn't support IP mode [ 380.068848][ T52] Bluetooth: hci1: command tx timeout [ 380.100804][T17674] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3351'. [ 380.341817][T17690] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3354'. [ 380.659268][T17367] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 380.734759][T17367] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 380.775615][T17367] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 380.840519][T17367] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 381.108850][T17749] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3366'. [ 381.272633][T17367] 8021q: adding VLAN 0 to HW filter on device bond0 [ 381.351189][T17367] 8021q: adding VLAN 0 to HW filter on device team0 [ 381.381805][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.389062][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 381.438861][T17764] IPv6: sit1: Disabled Multicast RS [ 381.465755][T17764] sit1: entered allmulticast mode [ 381.522914][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 381.530189][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 381.558192][T17771] IPVS: set_ctl: invalid protocol: 12 0.0.0.0:20002 [ 381.778971][T17788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3375'. [ 381.815922][T17788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3375'. [ 381.828921][T17785] tipc: Enabled bearer , priority 0 [ 381.858620][T17788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3375'. [ 381.925541][T17783] tipc: Disabling bearer [ 382.022204][T17806] FAULT_INJECTION: forcing a failure. [ 382.022204][T17806] name failslab, interval 1, probability 0, space 0, times 0 [ 382.035739][T17806] CPU: 1 UID: 0 PID: 17806 Comm: syz.1.3378 Not tainted syzkaller #0 PREEMPT(full) [ 382.035765][T17806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 382.035791][T17806] Call Trace: [ 382.035798][T17806] [ 382.035806][T17806] dump_stack_lvl+0x189/0x250 [ 382.035831][T17806] ? __pfx____ratelimit+0x10/0x10 [ 382.035862][T17806] ? __pfx_dump_stack_lvl+0x10/0x10 [ 382.035880][T17806] ? __pfx__printk+0x10/0x10 [ 382.035916][T17806] should_fail_ex+0x414/0x560 [ 382.035940][T17806] should_failslab+0xa8/0x100 [ 382.035964][T17806] kmem_cache_alloc_node_noprof+0x77/0x710 [ 382.035983][T17806] ? __alloc_skb+0x255/0x430 [ 382.036002][T17806] ? napi_skb_cache_get+0x4a5/0x780 [ 382.036019][T17806] ? napi_skb_cache_get+0x151/0x780 [ 382.036042][T17806] __alloc_skb+0x255/0x430 [ 382.036066][T17806] ? __pfx___alloc_skb+0x10/0x10 [ 382.036099][T17806] xfrm_alloc_compat+0x1a6/0x16f0 [ 382.036208][T17806] ? xfrm_get_translator+0x1b/0x240 [ 382.036305][T17806] ? __pfx_xfrm_alloc_compat+0x10/0x10 [ 382.036328][T17806] xfrm_nlmsg_multicast+0xda/0x1f0 [ 382.036348][T17806] xfrm_send_policy_notify+0xb35/0x1bb0 [ 382.036376][T17806] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 382.036399][T17806] ? km_policy_notify+0x28/0x200 [ 382.036427][T17806] ? km_policy_notify+0x28/0x200 [ 382.036446][T17806] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 382.036465][T17806] km_policy_notify+0x121/0x200 [ 382.036483][T17806] ? km_policy_notify+0x28/0x200 [ 382.036504][T17806] xfrm_add_policy+0x4c7/0x800 [ 382.036529][T17806] ? __pfx_xfrm_add_policy+0x10/0x10 [ 382.036546][T17806] ? apparmor_capable+0x137/0x1a0 [ 382.036570][T17806] ? __nla_parse+0x40/0x60 [ 382.036592][T17806] xfrm_user_rcv_msg+0x7a3/0xab0 [ 382.036619][T17806] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 382.036672][T17806] ? __pfx___mutex_trylock_common+0x10/0x10 [ 382.036696][T17806] ? rcu_is_watching+0x15/0xb0 [ 382.036714][T17806] ? trace_contention_end+0x39/0x100 [ 382.036734][T17806] ? __mutex_lock+0x335/0x1350 [ 382.036763][T17806] netlink_rcv_skb+0x208/0x470 [ 382.036779][T17806] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 382.036801][T17806] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 382.036832][T17806] ? netlink_deliver_tap+0x2e/0x1b0 [ 382.036847][T17806] ? netlink_deliver_tap+0x2e/0x1b0 [ 382.036874][T17806] xfrm_netlink_rcv+0x79/0x90 [ 382.036895][T17806] netlink_unicast+0x82f/0x9e0 [ 382.036928][T17806] ? __pfx_netlink_unicast+0x10/0x10 [ 382.036952][T17806] ? netlink_sendmsg+0x642/0xb30 [ 382.036966][T17806] ? skb_put+0x11b/0x210 [ 382.036997][T17806] netlink_sendmsg+0x805/0xb30 [ 382.037026][T17806] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.037047][T17806] ? aa_sock_msg_perm+0xf1/0x1b0 [ 382.037065][T17806] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 382.037085][T17806] ? __pfx_netlink_sendmsg+0x10/0x10 [ 382.037102][T17806] __sock_sendmsg+0x21c/0x270 [ 382.037124][T17806] ____sys_sendmsg+0x505/0x820 [ 382.037155][T17806] ? __pfx_____sys_sendmsg+0x10/0x10 [ 382.037188][T17806] ? import_iovec+0x74/0xa0 [ 382.037214][T17806] ___sys_sendmsg+0x21f/0x2a0 [ 382.037241][T17806] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.037273][T17806] ? rcu_read_lock_any_held+0xb3/0x120 [ 382.037321][T17806] ? __fget_files+0x2a/0x420 [ 382.037336][T17806] ? __fget_files+0x3a0/0x420 [ 382.037363][T17806] __x64_sys_sendmsg+0x19b/0x260 [ 382.037390][T17806] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 382.037425][T17806] ? __pfx_ksys_write+0x10/0x10 [ 382.037451][T17806] ? do_syscall_64+0xbe/0xf80 [ 382.037477][T17806] do_syscall_64+0xfa/0xf80 [ 382.037497][T17806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.037514][T17806] ? clear_bhb_loop+0x60/0xb0 [ 382.037534][T17806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.037550][T17806] RIP: 0033:0x7f8db238f749 [ 382.037567][T17806] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 382.037582][T17806] RSP: 002b:00007f8db3183038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 382.037601][T17806] RAX: ffffffffffffffda RBX: 00007f8db25e5fa0 RCX: 00007f8db238f749 [ 382.037613][T17806] RDX: 0000000000004000 RSI: 0000200000000580 RDI: 0000000000000004 [ 382.037624][T17806] RBP: 00007f8db3183090 R08: 0000000000000000 R09: 0000000000000000 [ 382.037634][T17806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.037643][T17806] R13: 00007f8db25e6038 R14: 00007f8db25e5fa0 R15: 00007ffd40eda6d8 [ 382.037675][T17806] [ 382.869063][T17831] netlink: 'syz.4.3383': attribute type 12 has an invalid length. [ 382.886386][T17824] __nla_validate_parse: 1 callbacks suppressed [ 382.886406][T17824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3384'. [ 382.903178][T17831] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3383'. [ 382.939880][T17367] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 383.176610][T17367] veth0_vlan: entered promiscuous mode [ 383.211423][T17849] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3388'. [ 383.296038][T17850] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3389'. [ 383.349290][T17367] veth1_vlan: entered promiscuous mode [ 383.432308][T17859] netlink: 'syz.3.3391': attribute type 10 has an invalid length. [ 383.465262][T17859] veth1_macvtap: left promiscuous mode [ 383.480095][T17859] team0: Device veth1_macvtap failed to register rx_handler [ 383.569555][T17367] veth0_macvtap: entered promiscuous mode [ 383.583957][T17867] syzkaller1: entered promiscuous mode [ 383.591107][T17867] syzkaller1: entered allmulticast mode [ 383.746879][T17367] veth1_macvtap: entered promiscuous mode [ 383.810089][T17367] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 383.852273][T17367] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 383.897936][ T3534] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.912019][ T3534] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.935681][ T3534] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.967755][ T3534] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 384.332531][T17907] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3401'. [ 384.408342][ T3467] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 384.427518][ T3467] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.355357][ T9046] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.395003][ T9046] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.402113][T17935] netlink: 'syz.2.3403': attribute type 11 has an invalid length. [ 386.483469][T17935] netlink: 228 bytes leftover after parsing attributes in process `syz.2.3403'. [ 386.730872][T17951] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.3409'. [ 387.157898][T17977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3418'. [ 387.490722][T18000] IPv6: sit1: Disabled Multicast RS [ 387.507465][T18000] sit1: entered allmulticast mode [ 387.784668][T18003] : entered promiscuous mode [ 387.795436][T18000] IPv6: sit1: Disabled Multicast RS [ 387.801533][T18000] sit1: entered allmulticast mode [ 387.851005][T18016] tipc: Started in network mode [ 387.857557][T18016] tipc: Node identity 9, cluster identity 4711 [ 387.864045][T18016] tipc: Node number set to 9 [ 387.901453][T18000] IPv6: sit1: Disabled Multicast RS [ 387.915600][T18000] sit1: entered allmulticast mode [ 387.988621][T18028] bridge_slave_0: left promiscuous mode [ 387.998699][T18028] bridge0: port 1(bridge_slave_0) entered disabled state [ 388.024954][T18028] bridge_slave_1: left allmulticast mode [ 388.036562][T18028] bridge_slave_1: left promiscuous mode [ 388.042644][T18028] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.058696][T18028] bond0: (slave 32): Releasing backup interface [ 388.088259][T18028] bond0: (slave bond_slave_1): Releasing backup interface [ 388.101931][T18028] team0: Port device team_slave_0 removed [ 388.112231][T18028] team0: Port device team_slave_1 removed [ 388.118968][T18028] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 388.127026][T18028] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 388.136758][T18028] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 388.144151][T18028] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 388.156843][T18028] net_ratelimit: 48 callbacks suppressed [ 388.156864][T18028] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 388.182339][T18000] IPv6: sit1: Disabled Multicast RS [ 388.192123][T18000] sit1: entered allmulticast mode [ 412.837994][T18034] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 412.870773][T18035] veth0_to_team: entered promiscuous mode [ 413.051564][T18049] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3438'. [ 413.749983][T18101] netlink: 'syz.2.3449': attribute type 1 has an invalid length. [ 413.847793][T18104] bond1: option miimon: invalid value (18446744073709551585) [ 413.862627][T18104] bond1: option miimon: allowed values 0 - 2147483647 [ 413.907190][T18104] bond1 (unregistering): Released all slaves [ 413.950594][T18108] vlan2: entered promiscuous mode [ 413.967041][T18108] bridge0: entered promiscuous mode [ 414.100758][T18120] macvlan0: entered promiscuous mode [ 414.373493][T18143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3460'. [ 414.396118][T18143] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3460'. [ 414.407885][T18145] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3461'. [ 414.417794][T18145] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3461'. [ 414.418311][T18143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3460'. [ 414.437522][T18143] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3460'. [ 414.445953][T18145] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3461'. [ 414.513115][T18145] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3461'. [ 414.529011][T18149] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3463'. [ 414.589364][T18149] netlink: 'syz.2.3463': attribute type 12 has an invalid length. [ 414.660601][T18152] netlink: 'syz.2.3463': attribute type 1 has an invalid length. [ 414.833614][T18169] netlink: 'syz.2.3468': attribute type 32 has an invalid length. [ 414.922832][T18169] bond1: option coupled_control: invalid value (72) [ 414.932362][T18169] bond1 (unregistering): Released all slaves [ 415.014803][T18181] netlink: 'syz.4.3470': attribute type 8 has an invalid length. [ 415.252672][T18192] sctp: [Deprecated]: syz.0.3478 (pid 18192) Use of int in maxseg socket option. [ 415.252672][T18192] Use struct sctp_assoc_value instead [ 415.743595][ T5881] IPVS: starting estimator thread 0... [ 415.835756][T18230] syzkaller0: entered promiscuous mode [ 415.842739][T18230] syzkaller0: entered allmulticast mode [ 415.848779][T18236] IPVS: using max 36 ests per chain, 86400 per kthread [ 415.858801][T18242] macvlan0: entered promiscuous mode [ 417.165742][T18289] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 417.858725][T18295] IPVS: set_ctl: invalid protocol: 98 224.0.0.2:20002 [ 417.999770][T18299] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.028102][T18299] bridge_slave_1: left allmulticast mode [ 418.046608][T18299] bridge_slave_1: left promiscuous mode [ 418.055339][T18299] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.152172][T18309] __nla_validate_parse: 7 callbacks suppressed [ 418.152200][T18309] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3508'. [ 418.190121][T18309] netlink: 'syz.4.3508': attribute type 3 has an invalid length. [ 418.237532][T18315] netlink: 'syz.0.3510': attribute type 3 has an invalid length. [ 418.559331][T18334] netlink: 'syz.2.3517': attribute type 3 has an invalid length. [ 418.588968][T18334] netlink: 766 bytes leftover after parsing attributes in process `syz.2.3517'. [ 418.810180][T18354] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3522'. [ 418.893327][T18354] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3522'. [ 418.902475][T18363] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3524'. [ 418.902510][T18363] netlink: 'syz.2.3524': attribute type 20 has an invalid length. [ 418.912182][T18363] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3524'. [ 418.912216][T18363] netlink: 'syz.2.3524': attribute type 20 has an invalid length. [ 418.941189][ T9048] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.970989][ T9048] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.994695][ T9048] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 419.044855][ T9048] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 419.344695][T18386] netlink: 'syz.0.3531': attribute type 11 has an invalid length. [ 419.352652][T18386] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3531'. [ 419.385454][T18390] netlink: 'syz.4.3533': attribute type 1 has an invalid length. [ 419.405510][T18391] bridge1: entered allmulticast mode [ 419.491289][T18390] 8021q: adding VLAN 0 to HW filter on device bond2 [ 419.622062][T18398] 8021q: adding VLAN 0 to HW filter on device bond2 [ 419.637056][T18398] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 419.652700][T18398] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 419.705588][T18390] veth3: entered promiscuous mode [ 419.714009][T18390] bond2: (slave veth3): Enslaving as an active interface with a down link [ 419.738247][T18409] vlan2: entered allmulticast mode [ 419.743480][T18409] bond2: entered allmulticast mode [ 420.012502][T18431] rdma_op ffff8880495b19f0 conn xmit_rdma 0000000000000000 [ 420.093313][T18436] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3545'. [ 420.179422][T18445] netlink: 'syz.2.3547': attribute type 9 has an invalid length. [ 420.234738][T18449] netlink: 'syz.3.3548': attribute type 33 has an invalid length. [ 420.272328][T18449] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 420.285204][T18449] bond1 (unregistering): Released all slaves [ 420.373740][T18454] netlink: 'syz.2.3549': attribute type 1 has an invalid length. [ 420.448499][T18454] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3549'. [ 420.477375][T18454] tipc: Enabled bearer , priority 10 [ 420.820481][T18480] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3555'. [ 421.227058][T18503] netlink: 'syz.0.3563': attribute type 4 has an invalid length. [ 421.448079][T18527] delete_channel: no stack [ 422.631518][T18565] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.093720][ T5902] tipc: Node number set to 1753794445 [ 423.152106][T18571] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 423.264892][T18577] netlink: 'syz.1.3584': attribute type 1 has an invalid length. [ 423.272677][T18577] __nla_validate_parse: 3 callbacks suppressed [ 423.272694][T18577] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3584'. [ 423.499277][T18590] netlink: 'syz.4.3590': attribute type 1 has an invalid length. [ 446.881226][T18609] netlink: 'syz.4.3597': attribute type 1 has an invalid length. [ 446.896819][T18609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3597'. [ 446.909999][T18612] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3600'. [ 446.936610][T18612] netlink: 'syz.2.3600': attribute type 20 has an invalid length. [ 446.947452][T18617] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3598'. [ 447.012130][T18620] vlan2: entered allmulticast mode [ 447.017713][T18620] veth1: entered allmulticast mode [ 447.135830][T18627] xt_l2tp: v2 sid > 0xffff: 1114112 [ 447.187150][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 447.586872][T18653] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3612'. [ 447.618195][T18650] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3612'. [ 447.652495][T18654] netlink: 'syz.1.3612': attribute type 10 has an invalid length. [ 447.685812][T18654] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3612'. [ 447.742996][T18654] team0: Port device geneve0 added [ 447.865822][T18669] vlan2: entered promiscuous mode [ 447.871020][T18669] bridge0: entered promiscuous mode [ 447.925950][ T30] audit: type=1804 audit(1765366228.203:7): pid=18679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.3619" name="/newroot/74/cgroup.controllers" dev="tmpfs" ino=400 res=1 errno=0 [ 447.975531][ T30] audit: type=1800 audit(1765366228.203:8): pid=18679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3619" name="cgroup.controllers" dev="tmpfs" ino=400 res=0 errno=0 [ 448.508091][T18710] IPv6: addrconf: prefix option has invalid lifetime [ 448.865410][T18743] v: renamed from vlan0 [ 448.986555][T18751] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3636'. [ 449.040207][T18756] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3635'. [ 449.049707][T18756] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3635'. [ 449.784676][T18788] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 449.838662][T18797] netlink: 'syz.0.3643': attribute type 1 has an invalid length. [ 449.865498][T18797] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3643'. [ 450.030295][T18806] netlink: 'syz.3.3646': attribute type 29 has an invalid length. [ 450.051243][T18811] netlink: 'syz.3.3646': attribute type 29 has an invalid length. [ 450.403425][T18828] bridge3: the hash_elasticity option has been deprecated and is always 16 [ 450.520742][T18835] lo speed is unknown, defaulting to 1000 [ 450.536925][T18831] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 450.551854][T18835] lo speed is unknown, defaulting to 1000 [ 450.586433][T18835] lo speed is unknown, defaulting to 1000 [ 450.660468][T18835] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 450.787875][T18835] lo speed is unknown, defaulting to 1000 [ 450.824064][T18835] lo speed is unknown, defaulting to 1000 [ 450.846246][T18835] lo speed is unknown, defaulting to 1000 [ 450.873021][T18835] lo speed is unknown, defaulting to 1000 [ 450.877567][T18848] sctp: [Deprecated]: syz.1.3660 (pid 18848) Use of int in max_burst socket option. [ 450.877567][T18848] Use struct sctp_assoc_value instead [ 450.887853][T18835] lo speed is unknown, defaulting to 1000 [ 450.918484][T18835] lo speed is unknown, defaulting to 1000 [ 450.936511][T18835] lo speed is unknown, defaulting to 1000 [ 451.107447][T18856] set match dimension is over the limit! [ 451.576367][T18885] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 451.583690][T18885] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 451.631382][T18888] netlink: 'syz.2.3673': attribute type 1 has an invalid length. [ 451.645795][T18888] netlink: 'syz.2.3673': attribute type 1 has an invalid length. [ 451.806306][T18897] nbd: illegal input index 2958377 [ 451.919610][T18906] netlink: 'syz.4.3680': attribute type 1 has an invalid length. [ 451.968470][T18907] __nla_validate_parse: 8 callbacks suppressed [ 451.968517][T18907] netlink: 26 bytes leftover after parsing attributes in process `syz.1.3679'. [ 451.996206][T18906] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3680'. [ 452.135099][T18920] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 452.143450][T18920] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 452.153971][T18920] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3685'. [ 452.183210][T18920] vlan2: entered allmulticast mode [ 452.189720][T18920] mac80211_hwsim hwsim36 wlan0: entered allmulticast mode [ 452.375839][T18928] ip6t_srh: unknown srh invflags 4000 [ 452.396727][T18929] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 452.576485][ T5832] Bluetooth: hci1: link tx timeout [ 452.592878][ T5832] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 452.619978][T18949] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3694'. [ 452.682070][T18949] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3694'. [ 452.858397][T18958] netlink: 'syz.0.3695': attribute type 33 has an invalid length. [ 452.883259][T18960] netlink: 'syz.3.3696': attribute type 12 has an invalid length. [ 452.979024][T18958] bond2: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 452.985931][T18973] netlink: 'syz.3.3699': attribute type 1 has an invalid length. [ 452.991865][T18967] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3697'. [ 453.069335][T18958] bond2 (unregistering): Released all slaves [ 453.211350][T18973] bond1: entered promiscuous mode [ 453.222876][T18973] 8021q: adding VLAN 0 to HW filter on device bond1 [ 453.250225][T18974] bond1: (slave bridge1): making interface the new active one [ 453.258752][T18974] bridge1: entered promiscuous mode [ 453.277019][T18974] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 453.327420][T18986] C: renamed from lo (while UP) [ 453.365023][T18986] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 453.480352][T19005] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3704'. [ 453.654688][T19015] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3707'. [ 453.685385][T19015] xt_policy: neither incoming nor outgoing policy selected [ 453.706429][T19015] netlink: 112 bytes leftover after parsing attributes in process `syz.1.3707'. [ 453.785244][T19015] tipc: Started in network mode [ 453.790464][T19015] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 453.813028][T19015] tipc: Enabled bearer , priority 10 [ 453.839159][T19024] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3713'. [ 453.909462][T19028] IPVS: length: 4096 != 24 [ 454.026926][T19032] syzkaller1: entered promiscuous mode [ 454.046018][T19032] syzkaller1: entered allmulticast mode [ 454.165714][T19045] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 454.265728][T19055] netlink: 'syz.0.3726': attribute type 1 has an invalid length. [ 454.387724][T19068] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 454.397290][T19068] netlink: 'syz.2.3729': attribute type 1 has an invalid length. [ 454.433668][T19068] 8021q: adding VLAN 0 to HW filter on device bond1 [ 454.487771][T19068] bond1: entered promiscuous mode [ 454.633197][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 454.924596][ T5938] tipc: Node number set to 4269801492 [ 454.957592][T19114] lo: entered allmulticast mode [ 455.010445][T19117] netlink: 'syz.1.3744': attribute type 12 has an invalid length. [ 455.108868][T19117] bond2: option primary_reselect: invalid value (255) [ 455.137737][T19117] bond2 (unregistering): Released all slaves [ 455.320684][T19137] syzkaller1: entered promiscuous mode [ 455.372504][T19137] syzkaller1: entered allmulticast mode [ 456.003121][T19181] openvswitch: netlink: Message has 2712 unknown bytes. [ 456.018566][T19184] openvswitch: netlink: Message has 2712 unknown bytes. [ 456.271119][T19195] openvswitch: netlink: Tunnel attr 148 out of range max 16 [ 456.286913][T19195] pimreg: entered allmulticast mode [ 457.038329][T19260] netlink: 'syz.2.3786': attribute type 1 has an invalid length. [ 457.051369][T19260] netlink: 'syz.2.3786': attribute type 2 has an invalid length. [ 457.360202][T19280] lo speed is unknown, defaulting to 1000 [ 457.407493][T19286] netlink: 'syz.3.3795': attribute type 2 has an invalid length. [ 457.427619][ T5832] Bluetooth: hci0: command 0x0406 tx timeout [ 457.433457][T19287] IPVS: Unknown mcast interface: pim6reg1 [ 457.496646][T19296] netlink: 'syz.3.3799': attribute type 13 has an invalid length. [ 457.531945][T19296] gretap0: refused to change device tx_queue_len [ 457.544568][T19296] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 457.585955][T19302] erspan0: entered allmulticast mode [ 457.609186][ T6172] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 457.621151][T19292] xt_l2tp: v2 doesn't support IP mode [ 457.628319][T19309] __nla_validate_parse: 13 callbacks suppressed [ 457.628332][T19309] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3800'. [ 457.738658][T19316] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3802'. [ 458.517202][T19348] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3808'. [ 458.547284][T19350] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3810'. [ 458.723198][T19362] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3810'. [ 458.759771][T19361] syzkaller0: entered promiscuous mode [ 458.765819][T19361] syzkaller0: entered allmulticast mode [ 458.879714][T19373] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3814'. [ 458.919328][T19375] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3816'. [ 458.929726][T19375] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3816'. [ 458.939028][T19375] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3816'. [ 459.175824][T19386] syzkaller0: entered promiscuous mode [ 459.181422][T19386] syzkaller0: entered allmulticast mode [ 459.222297][T19386] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3820'. [ 459.246314][T19386] x_tables: duplicate underflow at hook 2 [ 459.567265][T19408] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.576240][T19411] netlink: 'syz.2.3828': attribute type 5 has an invalid length. [ 459.579370][T19408] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.620514][T19411] geneve2: entered promiscuous mode [ 459.626032][T19411] geneve2: entered allmulticast mode [ 459.650847][ T9048] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 40328 - 0 [ 459.660743][ T9048] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 40328 - 0 [ 459.750963][T19408] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 459.792139][T19408] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 459.856860][T19423] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 460.012155][T19434] netlink: 'syz.3.3835': attribute type 11 has an invalid length. [ 460.272024][T19403] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 461.421617][T19451] syzkaller1: entered promiscuous mode [ 461.440673][T19451] syzkaller1: entered allmulticast mode [ 461.504688][ T52] Bluetooth: hci0: command 0x0406 tx timeout [ 461.525792][T19455] bond2: down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 461.547724][T19458] team0: Device ipvlan1 failed to register rx_handler [ 461.813642][T19408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.842809][T19408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.867635][T19408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 40328 - 0 [ 462.116563][T19408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 462.157607][T19408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.168515][T19408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 40328 - 0 [ 462.380447][ T9046] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.410040][ T9046] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 40328 - 0 [ 462.425929][ T9046] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 462.501262][ T9046] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.510963][ T9046] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 40328 - 0 [ 462.552748][ T9046] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 462.634941][ T9046] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.669557][ T9046] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 40328 - 0 [ 462.695090][ T9046] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 462.726036][T19532] __nla_validate_parse: 10 callbacks suppressed [ 462.726053][T19532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3852'. [ 462.764823][ T6172] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 462.793492][ T6172] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 40328 - 0 [ 462.813841][ T6172] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 462.910483][T19545] netlink: 'syz.4.3856': attribute type 142 has an invalid length. [ 462.932514][T19546] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3855'. [ 463.084865][T19553] netlink: 204 bytes leftover after parsing attributes in process `syz.0.3857'. [ 463.147563][T19552] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3859'. [ 463.297106][T19569] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 463.348486][T19569] netlink: 45 bytes leftover after parsing attributes in process `syz.4.3861'. [ 463.493589][T19581] netlink: 'syz.2.3865': attribute type 29 has an invalid length. [ 463.502920][T19581] netlink: 'syz.2.3865': attribute type 29 has an invalid length. [ 463.526214][T19581] netlink: 500 bytes leftover after parsing attributes in process `syz.2.3865'. [ 463.739908][T19597] netlink: 'syz.2.3868': attribute type 1 has an invalid length. [ 463.823763][T19601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3868'. [ 463.891983][T19597] 8021q: adding VLAN 0 to HW filter on device bond3 [ 463.996364][T19610] bond3: (slave geneve3): making interface the new active one [ 464.047193][T19610] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 464.116021][T19620] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3873'. [ 464.125750][T19619] netlink: 'syz.0.3874': attribute type 1 has an invalid length. [ 464.133501][T19619] netlink: 'syz.0.3874': attribute type 4 has an invalid length. [ 464.164536][T19619] netlink: 9422 bytes leftover after parsing attributes in process `syz.0.3874'. [ 464.238964][T19628] openvswitch: netlink: ct_state flags 6d0000e0 unsupported [ 464.487702][T19646] netlink: 'syz.3.3882': attribute type 39 has an invalid length. [ 464.723361][T19660] bond3: entered promiscuous mode [ 464.728803][T19660] bond3: entered allmulticast mode [ 464.738584][T19660] 8021q: adding VLAN 0 to HW filter on device bond3 [ 464.759060][T19663] IPv6: sit1: Disabled Multicast RS [ 464.767367][T19660] x_tables: unsorted underflow at hook 4 [ 464.835236][T19668] tipc: Enabled bearer , priority 0 [ 465.256273][T19682] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 465.579068][T19706] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3899'. [ 465.925823][T19725] netlink: 'syz.3.3904': attribute type 1 has an invalid length. [ 466.378227][T19756] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 466.471632][T19765] netlink: 'syz.3.3915': attribute type 2 has an invalid length. [ 466.517576][T19763] netlink: 'syz.0.3916': attribute type 2 has an invalid length. [ 466.545197][ T5832] Bluetooth: hci1: command 0x0406 tx timeout [ 466.628255][T19773] syzkaller0: entered promiscuous mode [ 466.639231][T19773] syzkaller0: entered allmulticast mode [ 466.976101][ T30] audit: type=1800 audit(1765366247.253:9): pid=19796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3926" name="memory.events" dev="tmpfs" ino=533 res=0 errno=0 [ 467.037666][ T30] audit: type=1804 audit(1765366247.273:10): pid=19796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.3926" name="/newroot/101/memory.events" dev="tmpfs" ino=533 res=1 errno=0 [ 467.079339][T19798] bond0: option all_slaves_active: invalid value (3) [ 467.279035][T19809] tipc: Enabling of bearer rejected, failed to enable media [ 467.332534][T19817] tipc: Enabling of bearer rejected, failed to enable media [ 467.499834][T19831] xt_CT: You must specify a L4 protocol and not use inversions on it [ 467.738030][T19851] sctp: [Deprecated]: syz.1.3944 (pid 19851) Use of int in max_burst socket option. [ 467.738030][T19851] Use struct sctp_assoc_value instead [ 468.118692][T19871] __nla_validate_parse: 40 callbacks suppressed [ 468.118711][T19871] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3950'. [ 468.219501][T19872] netlink: 184 bytes leftover after parsing attributes in process `syz.2.3949'. [ 468.462718][T19865] netlink: 596 bytes leftover after parsing attributes in process `syz.0.3948'. [ 468.495975][T19891] netlink: 'syz.3.3957': attribute type 10 has an invalid length. [ 468.506780][T19891] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 468.520651][T19891] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 468.541331][T19894] lo: entered promiscuous mode [ 468.547054][T19894] netlink: 'syz.4.3958': attribute type 2 has an invalid length. [ 468.555148][T19894] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 468.812423][T19914] netlink: 'syz.4.3966': attribute type 1 has an invalid length. [ 468.823272][T19916] netlink: 'syz.4.3966': attribute type 1 has an invalid length. [ 468.862506][T19916] bond5: (slave xfrm1): The slave device specified does not support setting the MAC address [ 468.879755][T19916] bond5: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 468.908705][T19914] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3966'. [ 468.930164][T19916] bond5: (slave xfrm1): making interface the new active one [ 468.969529][T19916] bond5: (slave xfrm1): Enslaving as an active interface with an up link [ 469.037757][T19914] bond5 (unregistering): (slave xfrm1): Releasing backup interface [ 469.053814][T19914] bond5 (unregistering): Released all slaves [ 469.166768][T19931] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3970'. [ 469.320160][T19950] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3970'. [ 469.335125][T19951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3974'. [ 469.426623][T19953] xt_l2tp: v2 doesn't support IP mode [ 469.965514][T19983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3986'. [ 469.985190][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.998121][T19983] netlink: 'syz.2.3986': attribute type 7 has an invalid length. [ 470.062413][T19995] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3989'. [ 470.068580][T19992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3988'. [ 470.099603][T19992] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.107357][T19992] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.162692][T20002] mac80211_hwsim hwsim33 syzkaller0: left promiscuous mode [ 470.179441][T20002] mac80211_hwsim hwsim33 syzkaller0: left allmulticast mode [ 470.227199][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.289882][T20009] netlink: 'syz.4.3992': attribute type 1 has an invalid length. [ 470.394128][T20014] xt_CT: You must specify a L4 protocol and not use inversions on it [ 470.544770][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.562410][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.591833][T20023] tipc: Can't bind to reserved service type 1 [ 470.697204][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.710557][T20035] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 470.781200][T20042] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 470.789004][T20041] sctp: [Deprecated]: syz.3.4006 (pid 20041) Use of int in maxseg socket option. [ 470.789004][T20041] Use struct sctp_assoc_value instead [ 471.056394][T20067] netlink: 'syz.0.4014': attribute type 3 has an invalid length. [ 471.097680][T20070] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 471.294464][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.396835][T20088] netlink: 'syz.2.4022': attribute type 1 has an invalid length. [ 471.429180][T20093] x_tables: unsorted underflow at hook 4 [ 471.848427][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.308467][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.606298][T20115] x_tables: ip_tables: TTL target: only valid in mangle table, not [ 472.611255][T20116] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.787535][ T5832] Bluetooth: hci4: command 0x0406 tx timeout [ 473.141628][T20129] nbd: must specify a device to reconfigure [ 473.244657][T20136] __nla_validate_parse: 8 callbacks suppressed [ 473.244674][T20136] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4036'. [ 473.294894][T20143] ksmbd: Unknown IPC event: 1, ignore. [ 473.300257][T20144] netlink: 'syz.1.4038': attribute type 9 has an invalid length. [ 473.482504][T20153] tipc: Enabled bearer , priority 0 [ 473.566949][T20153] syzkaller0: entered promiscuous mode [ 473.572492][T20153] syzkaller0: entered allmulticast mode [ 473.579574][T20153] tipc: Resetting bearer [ 473.586494][T20158] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 473.617316][T20150] tipc: Resetting bearer [ 473.751834][T20175] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4048'. [ 473.803094][T20177] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4049'. [ 473.822492][T20177] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4049'. [ 474.218084][T20193] Bluetooth: MGMT ver 1.23 [ 475.176354][T20150] tipc: Disabling bearer [ 475.193076][T20191] wg1: entered promiscuous mode [ 475.205745][T20191] wg1: entered allmulticast mode [ 475.225840][ T71] net_ratelimit: 10 callbacks suppressed [ 475.225865][ T71] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.357800][T20206] gtp0: entered promiscuous mode [ 475.362882][T20206] gtp0: entered allmulticast mode [ 475.429628][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.626918][T20225] syzkaller0: entered promiscuous mode [ 475.634334][T20225] syzkaller0: entered allmulticast mode [ 475.647696][T20225] 0: reclassify loop, rule prio 0, protocol 800 [ 475.725162][T20230] tipc: Enabled bearer , priority 0 [ 475.735667][T20233] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4066'. [ 475.747188][T20234] syzkaller0: entered promiscuous mode [ 475.752852][T20234] syzkaller0: entered allmulticast mode [ 475.840748][T20235] tipc: Resetting bearer [ 475.886410][T20241] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4067'. [ 475.899083][T20235] tipc: Disabling bearer [ 475.920562][T20244] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.016351][T20253] team_slave_0: entered promiscuous mode [ 476.022397][T20253] team_slave_1: entered promiscuous mode [ 476.070817][T20258] netlink: 408 bytes leftover after parsing attributes in process `syz.3.4071'. [ 476.308318][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.317462][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.392047][T20282] netlink: 'syz.1.4076': attribute type 23 has an invalid length. [ 476.400506][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.465227][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.737389][T20299] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 476.766490][T20307] netlink: 'syz.2.4082': attribute type 1 has an invalid length. [ 476.835101][T20307] veth3: entered promiscuous mode [ 476.868390][T20307] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4082'. [ 476.904601][T20317] tipc: Trying to set illegal importance in message [ 477.174791][T20333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.402726][T20345] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 477.504896][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.640382][T20356] bond5: option all_slaves_active: invalid value (222) [ 477.649625][T20356] bond5 (unregistering): Released all slaves [ 477.762849][T20366] syzkaller0: entered promiscuous mode [ 477.765689][T20364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4098'. [ 477.770223][T20366] syzkaller0: entered allmulticast mode [ 477.832446][T20364] bond4: Invalid ad_actor_system MAC address. [ 477.839415][T20364] bond4: option ad_actor_system: invalid value (1) [ 477.848483][T20364] bond4 (unregistering): Released all slaves [ 478.121226][T20390] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4103'. [ 478.430438][T20405] C: entered promiscuous mode [ 478.492584][T20405] tunl0: entered promiscuous mode [ 478.533784][T20405] gre0: entered promiscuous mode [ 478.588482][T20405] gretap0: entered promiscuous mode [ 478.687956][T20405] erspan0: entered promiscuous mode [ 478.712444][T20405] ip_vti0: entered promiscuous mode [ 480.628577][ T50] net_ratelimit: 12 callbacks suppressed [ 480.628590][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.948485][ T9048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.664663][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.064573][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.072714][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.080881][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.705813][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.184918][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.744545][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.284537][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.824647][ T50] net_ratelimit: 6 callbacks suppressed [ 485.824665][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.504845][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.864666][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.625664][ T2122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.825059][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.833563][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.904720][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.145016][ T5832] Bluetooth: hci5: command 0x0406 tx timeout [ 488.744719][ T2122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.944606][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.825029][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.954638][ T9044] net_ratelimit: 5 callbacks suppressed [ 490.954654][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 491.025602][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.064638][ T9048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.073064][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.464787][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.473424][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.864886][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 492.873368][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.104708][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.164681][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.224680][ T5987] net_ratelimit: 8 callbacks suppressed [ 496.224694][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.312454][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.321099][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.466117][ T9048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.944655][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.264938][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.574843][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.304600][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.674850][ T3467] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.344549][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.427358][ T9044] net_ratelimit: 7 callbacks suppressed [ 501.427378][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.441344][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.449469][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.457643][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.466260][ T5938] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.475082][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 502.004793][ T9044] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 502.464888][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.105065][ T9048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.505092][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.434961][ T71] net_ratelimit: 8 callbacks suppressed [ 506.434981][ T71] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.475325][ T2122] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.483654][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 506.624598][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.554695][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 507.664632][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.654656][ T71] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.704840][ T50] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.865173][ T6007] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 508.873658][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.825251][ T5902] net_ratelimit: 6 callbacks suppressed [ 511.825272][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.985220][ T3467] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.305201][ T1161] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.313469][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.864651][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.094574][ T9048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.319863][T20442] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4111'. [ 513.329756][T20442] Unsupported xt match [ 513.329769][T20442] unable to load match [ 513.402157][T20447] veth1_macvtap: left promiscuous mode [ 513.407736][T20447] macsec0: entered promiscuous mode [ 513.413260][T20447] macsec0: entered allmulticast mode [ 513.512738][T20447] veth1_macvtap: entered promiscuous mode [ 513.518987][T20447] veth1_macvtap: entered allmulticast mode [ 513.527694][T20447] macsec0: left promiscuous mode [ 513.533067][T20447] macsec0: left allmulticast mode [ 513.539241][T20447] veth1_macvtap: left allmulticast mode [ 513.563107][T20459] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.585272][T20461] 8021q: VLANs not supported on ipvlan1 [ 513.611983][T20458] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.682659][T20459] syzkaller0: entered promiscuous mode [ 513.691967][T20459] syzkaller0: entered allmulticast mode [ 513.856286][ T30] audit: type=1804 audit(1765366294.133:11): pid=20479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4124" name="/newroot/236/cgroup.controllers" dev="tmpfs" ino=1213 res=1 errno=0 [ 513.898640][ T30] audit: type=1800 audit(1765366294.153:12): pid=20479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4124" name="cgroup.controllers" dev="tmpfs" ino=1213 res=0 errno=0 [ 513.904720][ T5987] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.937572][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.359147][T20475] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 515.378686][T20498] IPv6: sit1: Disabled Multicast RS [ 515.394514][T20498] sit1: entered allmulticast mode [ 515.430602][T20507] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4130'. [ 515.526123][T20513] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4131'. [ 515.545544][T20513] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4131'. [ 515.652010][T20517] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4134'. [ 515.663317][T20517] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4134'. [ 515.706073][T20517] bridge0: port 3(vlan3) entered blocking state [ 515.712556][T20517] bridge0: port 3(vlan3) entered disabled state [ 515.719592][T20517] vlan3: entered allmulticast mode [ 515.725098][T20517] bridge0: entered allmulticast mode [ 515.734013][T20517] vlan3: left allmulticast mode [ 515.739442][T20517] bridge0: left allmulticast mode [ 515.882507][T20531] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4138'. [ 515.901454][T20538] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4140'. [ 515.936970][T20540] netlink: 248 bytes leftover after parsing attributes in process `syz.4.4141'. [ 516.045790][T20545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4144'. [ 516.279701][T20564] netlink: 'syz.0.4149': attribute type 1 has an invalid length. [ 516.307049][T20568] syzkaller0: entered promiscuous mode [ 516.316467][T20568] syzkaller0: entered allmulticast mode [ 516.628103][T20592] vlan3: entered allmulticast mode [ 516.633273][T20592] mac80211_hwsim hwsim43 wlan0: entered allmulticast mode [ 516.858411][T20612] netlink: 'syz.3.4164': attribute type 1 has an invalid length. [ 516.941164][T20612] 8021q: adding VLAN 0 to HW filter on device bond4 [ 516.957769][T20623] x_tables: unsorted underflow at hook 3 [ 517.020714][T20619] bond4: (slave geneve3): making interface the new active one [ 517.024720][ T5902] net_ratelimit: 10 callbacks suppressed [ 517.024737][ T5902] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.030694][T20619] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 517.087498][T20627] lo: entered promiscuous mode [ 517.100860][T20627] netlink: 'syz.2.4169': attribute type 2 has an invalid length. [ 517.110555][T20627] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 517.134982][ T6172] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.160411][ T5902] lo speed is unknown, defaulting to 1000 [ 517.173232][ T6172] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.184602][ T5902] syz2: Port: 1 Link DOWN [ 517.197268][ T6172] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.216254][ T6172] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.283900][T20643] bridge4: entered promiscuous mode [ 517.289574][T20643] bridge4: entered allmulticast mode [ 517.347990][T20646] C: left promiscuous mode [ 517.353304][T20646] tunl0: left promiscuous mode [ 517.363436][T20646] gre0: left promiscuous mode [ 517.370766][T20646] gretap0: left promiscuous mode [ 517.377072][T20646] erspan0: left promiscuous mode [ 517.383301][T20646] ip_vti0: left promiscuous mode [ 517.710339][T20674] netlink: 'syz.1.4181': attribute type 1 has an invalid length. [ 518.333820][T20724] __nla_validate_parse: 14 callbacks suppressed [ 518.333838][T20724] netlink: 232 bytes leftover after parsing attributes in process `syz.2.4193'. [ 518.363291][T20724] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4193'. [ 518.451778][T20730] sctp: [Deprecated]: syz.1.4199 (pid 20730) Use of int in maxseg socket option. [ 518.451778][T20730] Use struct sctp_assoc_value instead [ 518.536992][T20736] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4201'. [ 518.695462][T20750] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4206'. [ 518.737608][T20750] geneve3: entered promiscuous mode [ 518.743836][T20748] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4207'. [ 518.779082][T20756] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4205'. [ 518.936891][T20765] netlink: 'syz.1.4212': attribute type 39 has an invalid length. [ 519.223205][T20791] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4219'. [ 519.252032][T20793] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4220'. [ 519.500521][T20817] batman_adv: batadv0: Adding interface: dummy0 [ 519.524281][T20817] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.559207][T20817] batman_adv: batadv0: Interface activated: dummy0 [ 519.589243][T20808] batadv0: mtu less than device minimum [ 519.608019][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.620255][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.631424][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.643278][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.655089][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.666873][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.678136][T20808] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 519.737524][T20818] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.880463][T20818] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.031875][T20818] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.113638][T20846] syzkaller0: entered promiscuous mode [ 520.133608][T20846] syzkaller0: entered allmulticast mode [ 520.211965][T20818] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.268063][T20863] netlink: 'syz.3.4243': attribute type 1 has an invalid length. [ 520.278868][T20863] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4243'. [ 520.362419][ T71] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.436286][ T71] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.452671][ T71] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.517082][ T9044] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.551244][T20873] pim6reg: entered allmulticast mode [ 520.573712][T20873] pim6reg: left allmulticast mode [ 520.718679][T20880] netlink: 'syz.4.4249': attribute type 29 has an invalid length. [ 520.735249][T20880] netlink: 'syz.4.4249': attribute type 29 has an invalid length. [ 520.780042][T20881] º: renamed from veth1_vlan (while UP) [ 520.841553][T20883] xt_hashlimit: overflow, rate too high: 0 [ 520.967316][T20897] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4253'. [ 521.201298][T20906] veth0_to_bridge: entered allmulticast mode [ 521.225223][ T9044] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.263511][T20906] syzkaller0: entered promiscuous mode [ 521.275209][T20906] syzkaller0: entered allmulticast mode [ 521.329820][T20910] tipc: Enabled bearer , priority 0 [ 521.337656][T20910] syzkaller0: entered promiscuous mode [ 521.343144][T20910] syzkaller0: entered allmulticast mode [ 521.377960][T20910] tipc: Resetting bearer [ 521.399286][T20909] tipc: Resetting bearer [ 521.426016][T20909] tipc: Disabling bearer [ 521.716099][T20935] netlink: 'syz.1.4266': attribute type 1 has an invalid length. [ 521.743020][T20941] ipt_rpfilter: unknown options [ 522.680153][T20979] netlink: 'syz.4.4280': attribute type 15 has an invalid length. [ 522.822612][T20993] batadv_slave_1: entered promiscuous mode [ 522.835574][T20990] batadv_slave_1: left promiscuous mode [ 523.364698][T21039] __nla_validate_parse: 18 callbacks suppressed [ 523.364717][T21039] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4298'. [ 523.454130][T21045] pimreg: entered allmulticast mode [ 523.482342][T21048] team_slave_1: entered promiscuous mode [ 523.758987][T21063] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4305'. [ 523.838100][T21069] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4308'. [ 524.237731][T21096] net_ratelimit: 14 callbacks suppressed [ 524.237751][T21096] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 524.237771][T21097] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 524.316930][T21104] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4318'. [ 524.328302][T21103] netlink: 'syz.3.4317': attribute type 2 has an invalid length. [ 524.399223][T21103] : entered promiscuous mode [ 524.443514][T21097] syz.4.4316 (21097) used greatest stack depth: 17656 bytes left [ 524.590260][T21103] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4317'. [ 524.635625][T21121] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.777634][T21136] netlink: 'syz.2.4323': attribute type 1 has an invalid length. [ 524.868496][T21121] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.953237][T21121] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.971617][T21154] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 525.068475][T21161] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4324'. [ 525.070474][T21121] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.088387][T21161] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 525.168656][T21164] 8021q: VLANs not supported on ipvlan0 [ 525.210625][T21167] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4330'. [ 525.239656][T21167] netlink: 43 bytes leftover after parsing attributes in process `syz.2.4330'. [ 525.258847][T21167] netlink: 'syz.2.4330': attribute type 6 has an invalid length. [ 525.272609][T21171] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 525.277840][T21167] netlink: 'syz.2.4330': attribute type 5 has an invalid length. [ 525.296297][T21167] netlink: 43 bytes leftover after parsing attributes in process `syz.2.4330'. [ 525.554798][T21187] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 525.791903][T21203] netlink: 'syz.3.4340': attribute type 1 has an invalid length. [ 525.892096][T21212] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4340'. [ 525.981335][T21212] bond5: (slave bridge2): making interface the new active one [ 526.016763][T21212] bond5: (slave bridge2): Enslaving as an active interface with an up link [ 526.037277][T21221] : renamed from bridge_slave_0 (while UP) [ 526.256570][T21232] netlink: 'syz.4.4348': attribute type 1 has an invalid length. [ 526.293955][T21232] netlink: 'syz.4.4348': attribute type 1 has an invalid length. [ 526.334344][T21232] netlink: 'syz.4.4348': attribute type 1 has an invalid length. [ 526.432154][ T3534] syzkaller0: tun_net_xmit 76 [ 526.440260][ T3534] syzkaller0: tun_net_xmit 48 [ 526.461316][ T5902] syzkaller0: tun_net_xmit 76 [ 526.472310][T21242] veth0_macvtap: left promiscuous mode [ 526.485151][T21242] macvtap0: entered allmulticast mode [ 526.494852][ T5934] syzkaller0: tun_net_xmit 76 [ 526.505647][T21242] macvtap0: refused to change device tx_queue_len [ 526.517890][T21238] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 526.522468][ T5902] syzkaller0: tun_net_xmit 76 [ 526.527483][T21238] syzkaller0: Linktype set failed because interface is up [ 526.634642][T21251] v: renamed from veth0_vlan (while UP) [ 526.656871][ T5934] syzkaller0: tun_net_xmit 76 [ 528.617785][T21300] __nla_validate_parse: 5 callbacks suppressed [ 528.617804][T21300] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4364'. [ 528.737289][T21317] Unsupported ieee802154 address type: 0 [ 528.809129][T21322] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4369'. [ 528.950817][T21325] bond5: down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 529.143338][ T3534] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.214120][ T3534] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.276594][ T3534] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.284990][T21351] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4373'. [ 529.308400][ T6172] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 529.326224][T21357] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4373'. [ 529.335678][T21357] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4373'. [ 529.355385][ T49] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.377143][T21351] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4373'. [ 529.466310][T21351] netlink: 43 bytes leftover after parsing attributes in process `syz.3.4373'. [ 529.528045][T21351] validate_nla: 2 callbacks suppressed [ 529.528062][T21351] netlink: 'syz.3.4373': attribute type 5 has an invalid length. [ 529.574345][T21351] netlink: 43 bytes leftover after parsing attributes in process `syz.3.4373'. [ 530.036850][T21399] netlink: 'syz.1.4385': attribute type 1 has an invalid length. [ 530.101663][T21399] 8021q: adding VLAN 0 to HW filter on device bond3 [ 530.463533][T21416] syzkaller0: entered promiscuous mode [ 530.487063][T21416] syzkaller0: entered allmulticast mode [ 530.502007][T21437] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4391'. [ 530.550124][T21440] netlink: 'syz.1.4393': attribute type 1 has an invalid length. [ 530.567655][T21440] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4393'. [ 530.585381][T21445] netlink: 'syz.1.4393': attribute type 1 has an invalid length. [ 532.317059][T21465] gtp0: entered promiscuous mode [ 532.334600][T21465] gtp0: entered allmulticast mode [ 532.713688][T21504] netlink: 'syz.1.4406': attribute type 30 has an invalid length. [ 532.734930][T21499] team0: No ports can be present during mode change [ 532.768400][T21509] sctp: [Deprecated]: syz.1.4406 (pid 21509) Use of struct sctp_assoc_value in delayed_ack socket option. [ 532.768400][T21509] Use struct sctp_sack_info instead [ 532.953663][T21523] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 533.013534][T21523] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 533.205535][T21541] syzkaller0: entered promiscuous mode [ 533.211143][T21541] syzkaller0: entered allmulticast mode [ 533.404173][T21551] netlink: 'syz.3.4415': attribute type 9 has an invalid length. [ 533.678115][T21579] __nla_validate_parse: 8 callbacks suppressed [ 533.678133][T21579] netlink: 830 bytes leftover after parsing attributes in process `syz.2.4423'. [ 533.761392][T21585] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 533.762963][T21586] netlink: 'syz.4.4424': attribute type 10 has an invalid length. [ 533.785695][T21573] [ 533.788035][T21573] ====================================================== [ 533.795384][T21573] WARNING: possible circular locking dependency detected [ 533.802409][T21573] syzkaller #0 Not tainted [ 533.806821][T21573] ------------------------------------------------------ [ 533.813819][T21573] syz.1.4422/21573 is trying to acquire lock: [ 533.819865][T21573] ffff888142bf5e38 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1e5/0x4c0 [ 533.829322][T21573] [ 533.829322][T21573] but task is already holding lock: [ 533.836670][T21573] ffff888142bf58f8 (&q->q_usage_counter(io)#49){++++}-{0:0}, at: elevator_change+0x1ca/0x4c0 [ 533.846841][T21573] [ 533.846841][T21573] which lock already depends on the new lock. [ 533.846841][T21573] [ 533.857221][T21573] [ 533.857221][T21573] the existing dependency chain (in reverse order) is: [ 533.866216][T21573] [ 533.866216][T21573] -> #6 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 533.874809][T21573] blk_alloc_queue+0x538/0x620 [ 533.880170][T21573] __blk_mq_alloc_disk+0x15c/0x340 [ 533.885816][T21573] nbd_dev_add+0x46c/0xae0 [ 533.890779][T21573] nbd_init+0x168/0x1f0 [ 533.895444][T21573] do_one_initcall+0x1fb/0x7f0 [ 533.900717][T21573] do_initcall_level+0x104/0x190 [ 533.906158][T21573] do_initcalls+0x59/0xa0 [ 533.910997][T21573] kernel_init_freeable+0x334/0x4b0 [ 533.916700][T21573] kernel_init+0x1d/0x1d0 [ 533.921548][T21573] ret_from_fork+0x599/0xb30 [ 533.926645][T21573] ret_from_fork_asm+0x1a/0x30 [ 533.931917][T21573] [ 533.931917][T21573] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 533.939112][T21573] fs_reclaim_acquire+0x72/0x100 [ 533.944591][T21573] __kmalloc_cache_node_noprof+0x45/0x6f0 [ 533.950835][T21573] create_worker+0x112/0x720 [ 533.955932][T21573] workqueue_prepare_cpu+0xe4/0x170 [ 533.961685][T21573] cpuhp_invoke_callback+0x445/0x860 [ 533.968103][T21573] _cpu_up+0x2c9/0x580 [ 533.972672][T21573] cpu_up+0x1d2/0x220 [ 533.977155][T21573] cpuhp_bringup_mask+0xb2/0x1a0 [ 533.982597][T21573] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 533.988907][T21573] bringup_nonboot_cpus+0x17/0x30 [ 533.994433][T21573] smp_init+0x32/0x110 [ 533.999007][T21573] kernel_init_freeable+0x316/0x4b0 [ 534.004704][T21573] kernel_init+0x1d/0x1d0 [ 534.009536][T21573] ret_from_fork+0x599/0xb30 [ 534.014637][T21573] ret_from_fork_asm+0x1a/0x30 [ 534.019925][T21573] [ 534.019925][T21573] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 534.027641][T21573] cpus_read_lock+0x42/0x160 [ 534.032747][T21573] static_key_slow_inc+0x12/0x30 [ 534.038280][T21573] nbd_genl_reconfigure+0x10d8/0x1a50 [ 534.044246][T21573] genl_family_rcv_msg_doit+0x215/0x300 [ 534.050309][T21573] genl_rcv_msg+0x60e/0x790 [ 534.055326][T21573] netlink_rcv_skb+0x208/0x470 [ 534.060596][T21573] genl_rcv+0x28/0x40 [ 534.065087][T21573] netlink_unicast+0x82f/0x9e0 [ 534.070368][T21573] netlink_sendmsg+0x805/0xb30 [ 534.075634][T21573] __sock_sendmsg+0x21c/0x270 [ 534.080818][T21573] ____sys_sendmsg+0x505/0x820 [ 534.086090][T21573] ___sys_sendmsg+0x21f/0x2a0 [ 534.091284][T21573] __x64_sys_sendmsg+0x19b/0x260 [ 534.096728][T21573] do_syscall_64+0xfa/0xf80 [ 534.101754][T21573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.108152][T21573] [ 534.108152][T21573] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 534.115908][T21573] __mutex_lock+0x187/0x1350 [ 534.121030][T21573] nbd_queue_rq+0x257/0xf10 [ 534.126041][T21573] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 534.132091][T21573] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 534.139001][T21573] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 534.145487][T21573] blk_mq_run_hw_queue+0x348/0x4f0 [ 534.151164][T21573] blk_mq_dispatch_list+0xd0c/0xe00 [ 534.156864][T21573] blk_mq_flush_plug_list+0x469/0x550 [ 534.162737][T21573] __blk_flush_plug+0x3d3/0x4b0 [ 534.168089][T21573] __submit_bio+0x2d3/0x5a0 [ 534.173095][T21573] submit_bio_noacct_nocheck+0x2eb/0xa30 [ 534.179230][T21573] block_read_full_folio+0x599/0x830 [ 534.185132][T21573] filemap_read_folio+0x117/0x380 [ 534.190694][T21573] do_read_cache_folio+0x350/0x590 [ 534.196314][T21573] read_part_sector+0xb6/0x2b0 [ 534.201631][T21573] adfspart_check_ICS+0xa4/0xa50 [ 534.207067][T21573] bdev_disk_changed+0x75f/0x14b0 [ 534.212591][T21573] blkdev_get_whole+0x380/0x510 [ 534.217993][T21573] bdev_open+0x31e/0xd30 [ 534.222793][T21573] blkdev_open+0x457/0x600 [ 534.227732][T21573] do_dentry_open+0x7ce/0x1420 [ 534.233018][T21573] vfs_open+0x3b/0x340 [ 534.237599][T21573] path_openat+0x340e/0x3dd0 [ 534.242801][T21573] do_filp_open+0x1fa/0x410 [ 534.247809][T21573] do_sys_openat2+0x121/0x200 [ 534.252994][T21573] __x64_sys_openat+0x138/0x170 [ 534.258353][T21573] do_syscall_64+0xfa/0xf80 [ 534.263398][T21573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.269819][T21573] [ 534.269819][T21573] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 534.277026][T21573] __mutex_lock+0x187/0x1350 [ 534.282131][T21573] nbd_queue_rq+0xc8/0xf10 [ 534.287054][T21573] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 534.293103][T21573] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 534.299930][T21573] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 534.306412][T21573] blk_mq_run_hw_queue+0x348/0x4f0 [ 534.312031][T21573] blk_mq_dispatch_list+0xd0c/0xe00 [ 534.317734][T21573] blk_mq_flush_plug_list+0x469/0x550 [ 534.323615][T21573] __blk_flush_plug+0x3d3/0x4b0 [ 534.328965][T21573] __submit_bio+0x2d3/0x5a0 [ 534.333970][T21573] submit_bio_noacct_nocheck+0x2eb/0xa30 [ 534.340102][T21573] block_read_full_folio+0x599/0x830 [ 534.345891][T21573] filemap_read_folio+0x117/0x380 [ 534.351438][T21573] do_read_cache_folio+0x350/0x590 [ 534.357054][T21573] read_part_sector+0xb6/0x2b0 [ 534.362317][T21573] adfspart_check_ICS+0xa4/0xa50 [ 534.367772][T21573] bdev_disk_changed+0x75f/0x14b0 [ 534.373296][T21573] blkdev_get_whole+0x380/0x510 [ 534.378650][T21573] bdev_open+0x31e/0xd30 [ 534.383392][T21573] blkdev_open+0x457/0x600 [ 534.388312][T21573] do_dentry_open+0x7ce/0x1420 [ 534.393586][T21573] vfs_open+0x3b/0x340 [ 534.398154][T21573] path_openat+0x340e/0x3dd0 [ 534.403249][T21573] do_filp_open+0x1fa/0x410 [ 534.408256][T21573] do_sys_openat2+0x121/0x200 [ 534.413433][T21573] __x64_sys_openat+0x138/0x170 [ 534.418873][T21573] do_syscall_64+0xfa/0xf80 [ 534.423881][T21573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.430282][T21573] [ 534.430282][T21573] -> #1 (set->srcu){.+.+}-{0:0}: [ 534.437404][T21573] __synchronize_srcu+0x96/0x390 [ 534.442846][T21573] elevator_switch+0x12b/0x640 [ 534.448109][T21573] elevator_change+0x315/0x4c0 [ 534.453378][T21573] elevator_set_default+0x186/0x260 [ 534.459086][T21573] blk_register_queue+0x34e/0x3f0 [ 534.464612][T21573] __add_disk+0x677/0xd50 [ 534.469447][T21573] add_disk_fwnode+0xfc/0x480 [ 534.474626][T21573] nbd_dev_add+0x717/0xae0 [ 534.479545][T21573] nbd_init+0x168/0x1f0 [ 534.484213][T21573] do_one_initcall+0x1fb/0x7f0 [ 534.489479][T21573] do_initcall_level+0x104/0x190 [ 534.494917][T21573] do_initcalls+0x59/0xa0 [ 534.499747][T21573] kernel_init_freeable+0x334/0x4b0 [ 534.505445][T21573] kernel_init+0x1d/0x1d0 [ 534.510278][T21573] ret_from_fork+0x599/0xb30 [ 534.515377][T21573] ret_from_fork_asm+0x1a/0x30 [ 534.520645][T21573] [ 534.520645][T21573] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 534.528449][T21573] __lock_acquire+0x15a6/0x2cf0 [ 534.533810][T21573] lock_acquire+0x117/0x340 [ 534.538813][T21573] __mutex_lock+0x187/0x1350 [ 534.543912][T21573] elevator_change+0x1e5/0x4c0 [ 534.549181][T21573] elevator_set_none+0x42/0xb0 [ 534.554455][T21573] blk_mq_update_nr_hw_queues+0x598/0x1ab0 [ 534.560767][T21573] nbd_start_device+0x17f/0xb10 [ 534.566132][T21573] nbd_genl_connect+0x135b/0x18f0 [ 534.571662][T21573] genl_family_rcv_msg_doit+0x215/0x300 [ 534.577716][T21573] genl_rcv_msg+0x60e/0x790 [ 534.582722][T21573] netlink_rcv_skb+0x208/0x470 [ 534.587987][T21573] genl_rcv+0x28/0x40 [ 534.592475][T21573] netlink_unicast+0x82f/0x9e0 [ 534.597744][T21573] netlink_sendmsg+0x805/0xb30 [ 534.603097][T21573] __sock_sendmsg+0x21c/0x270 [ 534.608364][T21573] ____sys_sendmsg+0x505/0x820 [ 534.613636][T21573] ___sys_sendmsg+0x21f/0x2a0 [ 534.618818][T21573] __x64_sys_sendmsg+0x19b/0x260 [ 534.624352][T21573] do_syscall_64+0xfa/0xf80 [ 534.629371][T21573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.635769][T21573] [ 534.635769][T21573] other info that might help us debug this: [ 534.635769][T21573] [ 534.645980][T21573] Chain exists of: [ 534.645980][T21573] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#49 [ 534.645980][T21573] [ 534.659702][T21573] Possible unsafe locking scenario: [ 534.659702][T21573] [ 534.667135][T21573] CPU0 CPU1 [ 534.672482][T21573] ---- ---- [ 534.677880][T21573] lock(&q->q_usage_counter(io)#49); [ 534.683243][T21573] lock(fs_reclaim); [ 534.689726][T21573] lock(&q->q_usage_counter(io)#49); [ 534.697607][T21573] lock(&q->elevator_lock); [ 534.702180][T21573] [ 534.702180][T21573] *** DEADLOCK *** [ 534.702180][T21573] [ 534.710319][T21573] 6 locks held by syz.1.4422/21573: [ 534.715497][T21573] #0: ffffffff8f35d1b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 534.723666][T21573] #1: ffffffff8f35cfc8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 534.732615][T21573] #2: ffff888142f209d0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x1ab0 [ 534.743998][T21573] #3: ffff888142f208d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x1ab0 [ 534.754942][T21573] #4: ffff888142bf58f8 (&q->q_usage_counter(io)#49){++++}-{0:0}, at: elevator_change+0x1ca/0x4c0 [ 534.765545][T21573] #5: ffff888142bf5930 (&q->q_usage_counter(queue)#33){+.+.}-{0:0}, at: elevator_change+0x1ca/0x4c0 [ 534.776411][T21573] [ 534.776411][T21573] stack backtrace: [ 534.782468][T21573] CPU: 0 UID: 0 PID: 21573 Comm: syz.1.4422 Not tainted syzkaller #0 PREEMPT(full) [ 534.782486][T21573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 534.782498][T21573] Call Trace: [ 534.782508][T21573] [ 534.782515][T21573] dump_stack_lvl+0x189/0x250 [ 534.782533][T21573] ? __pfx_dump_stack_lvl+0x10/0x10 [ 534.782548][T21573] ? __pfx__printk+0x10/0x10 [ 534.782566][T21573] ? print_lock_name+0xde/0x100 [ 534.782583][T21573] print_circular_bug+0x2e2/0x300 [ 534.782601][T21573] check_noncircular+0x12e/0x150 [ 534.782618][T21573] __lock_acquire+0x15a6/0x2cf0 [ 534.782639][T21573] ? elevator_change+0x1e5/0x4c0 [ 534.782650][T21573] lock_acquire+0x117/0x340 [ 534.782661][T21573] ? elevator_change+0x1e5/0x4c0 [ 534.782677][T21573] __mutex_lock+0x187/0x1350 [ 534.782694][T21573] ? elevator_change+0x1e5/0x4c0 [ 534.782707][T21573] ? xa_find_after+0xae/0x430 [ 534.782725][T21573] ? xa_find_after+0x402/0x430 [ 534.782741][T21573] ? elevator_change+0x1e5/0x4c0 [ 534.782752][T21573] ? xa_find_after+0xae/0x430 [ 534.782769][T21573] ? __pfx___mutex_lock+0x10/0x10 [ 534.782786][T21573] ? __pfx_blk_mq_cancel_work_sync+0x10/0x10 [ 534.782804][T21573] elevator_change+0x1e5/0x4c0 [ 534.782818][T21573] elevator_set_none+0x42/0xb0 [ 534.782831][T21573] blk_mq_update_nr_hw_queues+0x598/0x1ab0 [ 534.782852][T21573] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 534.782873][T21573] ? sysfs_add_file_mode_ns+0x259/0x300 [ 534.782955][T21573] nbd_start_device+0x17f/0xb10 [ 534.782973][T21573] ? device_create_file+0xf4/0x1b0 [ 534.783043][T21573] nbd_genl_connect+0x135b/0x18f0 [ 534.783062][T21573] ? __pfx_nbd_genl_connect+0x10/0x10 [ 534.783079][T21573] ? rcu_is_watching+0x15/0xb0 [ 534.783094][T21573] ? __nla_parse+0x40/0x60 [ 534.783111][T21573] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 534.783131][T21573] genl_family_rcv_msg_doit+0x215/0x300 [ 534.783150][T21573] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 534.783170][T21573] ? __lock_acquire+0x6b6/0x2cf0 [ 534.783184][T21573] genl_rcv_msg+0x60e/0x790 [ 534.783201][T21573] ? __pfx_genl_rcv_msg+0x10/0x10 [ 534.783216][T21573] ? __pfx_nbd_genl_connect+0x10/0x10 [ 534.783235][T21573] netlink_rcv_skb+0x208/0x470 [ 534.783247][T21573] ? __pfx_genl_rcv_msg+0x10/0x10 [ 534.783263][T21573] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 534.783280][T21573] ? down_read+0x274/0x2e0 [ 534.783300][T21573] ? genl_rcv+0xd/0x40 [ 534.783315][T21573] genl_rcv+0x28/0x40 [ 534.783328][T21573] netlink_unicast+0x82f/0x9e0 [ 534.783348][T21573] ? __pfx_netlink_unicast+0x10/0x10 [ 534.783366][T21573] ? netlink_sendmsg+0x642/0xb30 [ 534.783377][T21573] ? skb_put+0x11b/0x210 [ 534.783395][T21573] netlink_sendmsg+0x805/0xb30 [ 534.783411][T21573] ? __pfx_netlink_sendmsg+0x10/0x10 [ 534.783425][T21573] ? aa_sock_msg_perm+0xf1/0x1b0 [ 534.783438][T21573] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 534.783455][T21573] ? __pfx_netlink_sendmsg+0x10/0x10 [ 534.783467][T21573] __sock_sendmsg+0x21c/0x270 [ 534.783483][T21573] ____sys_sendmsg+0x505/0x820 [ 534.783503][T21573] ? __pfx_____sys_sendmsg+0x10/0x10 [ 534.783523][T21573] ? import_iovec+0x74/0xa0 [ 534.783542][T21573] ___sys_sendmsg+0x21f/0x2a0 [ 534.783560][T21573] ? __pfx____sys_sendmsg+0x10/0x10 [ 534.783581][T21573] ? futex_wait+0x285/0x360 [ 534.783604][T21573] ? __fget_files+0x2a/0x420 [ 534.783615][T21573] ? __fget_files+0x3a0/0x420 [ 534.783630][T21573] __x64_sys_sendmsg+0x19b/0x260 [ 534.783648][T21573] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 534.783671][T21573] ? do_syscall_64+0xbe/0xf80 [ 534.783688][T21573] do_syscall_64+0xfa/0xf80 [ 534.783703][T21573] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.783716][T21573] ? clear_bhb_loop+0x60/0xb0 [ 534.783730][T21573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.783743][T21573] RIP: 0033:0x7f8db238f749 [ 534.783756][T21573] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 534.783768][T21573] RSP: 002b:00007f8db3183038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 534.783782][T21573] RAX: ffffffffffffffda RBX: 00007f8db25e5fa0 RCX: 00007f8db238f749 [ 534.783792][T21573] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 534.783801][T21573] RBP: 00007f8db2413f91 R08: 0000000000000000 R09: 0000000000000000 [ 534.783809][T21573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 534.783817][T21573] R13: 00007f8db25e6038 R14: 00007f8db25e5fa0 R15: 00007ffd40eda6d8 [ 534.783832][T21573] [ 535.291080][T21586] team0: Port device dummy0 added [ 535.339859][ T52] block nbd0: Receive control failed (result -32) [ 535.347036][ T52] block nbd0: Receive control failed (result -32) [ 535.356878][T21573] nbd0: detected capacity change from 0 to 127 [ 535.360061][T21595] block nbd0: Dead connection, failed to find a fallback [ 535.370386][T21595] block nbd0: shutting down sockets [ 535.375610][T21595] blk_print_req_error: 138 callbacks suppressed [ 535.375625][T21595] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.391424][T21595] buffer_io_error: 138 callbacks suppressed [ 535.391438][T21595] Buffer I/O error on dev nbd0, logical block 0, async page read [ 535.405337][T21595] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.414851][T21595] Buffer I/O error on dev nbd0, logical block 1, async page read [ 535.424513][T21595] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.433625][T21595] Buffer I/O error on dev nbd0, logical block 2, async page read [ 535.442063][T21595] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.451657][T21595] Buffer I/O error on dev nbd0, logical block 3, async page read [ 535.459547][T21595] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.468624][T21595] Buffer I/O error on dev nbd0, logical block 0, async page read [ 535.476879][T21595] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.485983][T21595] Buffer I/O error on dev nbd0, logical block 1, async page read [ 535.494273][T21595] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.503345][T21595] Buffer I/O error on dev nbd0, logical block 2, async page read [ 535.511531][T21595] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.521393][T21595] Buffer I/O error on dev nbd0, logical block 3, async page read [ 535.533827][T21595] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.543508][T21595] Buffer I/O error on dev nbd0, logical block 0, async page read [ 535.552022][T21595] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 535.561424][T21595] Buffer I/O error on dev nbd0, logical block 1, async page read [ 535.570165][T21595] ldm_validate_partition_table(): Disk read failed. [ 535.577770][T21595] Dev nbd0: unable to read RDB block 0 [ 535.583975][T21595] nbd0: unable to read partition table [ 535.596780][T21595] ldm_validate_partition_table(): Disk read failed. [ 535.604061][T21595] Dev nbd0: unable to read RDB block 0 [ 535.610494][T21595] nbd0: unable to read partition table [ 535.623634][T21595] ldm_validate_partition_table(): Disk read failed. [ 535.631192][T21595] Dev nbd0: unable to read RDB block 0 [ 535.637630][T21595] nbd0: unable to read partition table [ 535.647762][T21595] ldm_validate_partition_table(): Disk read failed. [ 535.656238][T21595] Dev nbd0: unable to read RDB block 0 [ 535.662897][T21595] nbd0: unable to read partition table