last executing test programs: 3m28.617400382s ago: executing program 4 (id=2159): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=@ipv4_newroute={0x38, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, @LWTUNNEL_IP_OPT_VXLAN_GBP={0x8}}}}]}, 0x38}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000040)={0x6, 'veth0_virt_wifi\x00', {0x6}, 0x7ff}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x30, r3, 0x1, 0x0, 0x0, {{}, {}, {0x14}}}, 0x30}}, 0x0) 3m28.494472173s ago: executing program 4 (id=2162): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)={@multicast1, @local, 0x1, 0x7, [@loopback, @loopback, @dev={0xac, 0x14, 0x14, 0x3a}, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @local, @initdev={0xac, 0x1e, 0x0, 0x0}]}, 0x2c) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=@delchain={0x2c, 0x64, 0xf31, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0xe, 0x1b}}, [@TCA_CHAIN={0x8, 0xb, 0xffff647b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x44000) 3m28.096178916s ago: executing program 4 (id=2171): socket$inet_icmp(0x2, 0x2, 0x1) r0 = socket(0x10, 0x803, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r7 = socket$tipc(0x1e, 0x5, 0x0) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$key(0xf, 0x3, 0x2) (async) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x1a, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) (async) bind$tipc(r7, &(0x7f00000001c0)=@name={0x1e, 0x2, 0x3, {{0x40, 0x2}, 0x5}}, 0x19) (async) connect$tipc(r7, &(0x7f00000002c0)=@id={0x1e, 0x3, 0x0, {0x4e21}}, 0x10) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x110, 0x2c, 0xd27, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xffff, 0xfff3}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0xdc, 0x2, [@TCA_MATCHALL_ACT={0xd8, 0x2, [@m_vlan={0xd4, 0x15, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x2}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xeaa}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x7}]}, {0x85, 0x6, "368d75d1e45e4a340fa31e18124676aa18d1951838450ee9d5a700a4a253e79382ca13eccc2fa2e7aae7ea86a1fc083d75ac4fdc0cc0b3b223bea782a3af14449dbd44344642716a0509f3cf6f7f45d901209b3c22c35f7777e2190763b577c09fe85f7b3fa0d629e38925b986b04ae3458219b46233059ef1067985accad3a5e6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3m27.248243783s ago: executing program 4 (id=2182): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_ethernet(0x41, &(0x7f00000000c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @void, {@arp={0x806, @generic={0x13, 0x8863, 0x6, 0xf, 0x8, @remote, "38fa89052aafdaabe8c573d9f6aa7e", @random="40b29e38d665", '\x00'/16}}}}, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)={0x14, r1, 0x711, 0x70bd27}, 0x14}, 0x1, 0x0, 0x0, 0x4004094}, 0x8894) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff) (async) syz_emit_ethernet(0x41, &(0x7f00000000c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @void, {@arp={0x806, @generic={0x13, 0x8863, 0x6, 0xf, 0x8, @remote, "38fa89052aafdaabe8c573d9f6aa7e", @random="40b29e38d665", '\x00'/16}}}}, 0x0) (async) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000280)={0x14, r1, 0x711, 0x70bd27}, 0x14}, 0x1, 0x0, 0x0, 0x4004094}, 0x8894) (async) 3m26.649600163s ago: executing program 4 (id=2193): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000e80)=ANY=[@ANYBLOB="b40500000000000061107a0000000000070000000000000095000044c51cb05200000000008ef3a960a080406dee7b83fe63afe8b0ba84dfbf4d2758f39602b5a8b6d6a0da46e5e4878057e43acf9d2457b5bd451ddc28a4d7f38da84e44ea72c7c7fc08cacd88abf1d63c85d98dd4f95eb30ae722f6ec83f9332c88d6de56dec585d98f09c03c3ecb29732284bd8539ed4b844eed8340d9f6db0cb60200000087ad14d45ce0b33785fb4cc1e014734133907b009ec7c9bda01c25edec69771acead61e0e7"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xc3, &(0x7f0000000240)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x6}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000051}, 0x4008090) 3m11.5104476s ago: executing program 32 (id=2193): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x4, &(0x7f0000000e80)=ANY=[@ANYBLOB="b40500000000000061107a0000000000070000000000000095000044c51cb05200000000008ef3a960a080406dee7b83fe63afe8b0ba84dfbf4d2758f39602b5a8b6d6a0da46e5e4878057e43acf9d2457b5bd451ddc28a4d7f38da84e44ea72c7c7fc08cacd88abf1d63c85d98dd4f95eb30ae722f6ec83f9332c88d6de56dec585d98f09c03c3ecb29732284bd8539ed4b844eed8340d9f6db0cb60200000087ad14d45ce0b33785fb4cc1e014734133907b009ec7c9bda01c25edec69771acead61e0e7"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xc3, &(0x7f0000000240)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x6}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000051}, 0x4008090) 2m26.823633555s ago: executing program 3 (id=2823): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) connect$netlink(r0, &(0x7f0000000080)=@kern={0x10, 0x0, 0x0, 0x2000}, 0xc) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)={0x3, 'dvmrp0\x00', {0xffff}, 0x7}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket(0x11, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @dev}, 0x14) close(r3) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x9) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000100)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) connect$unix(r7, &(0x7f0000000000)=@abs={0x0, 0x0, 0x5}, 0x6e) connect$unix(r6, &(0x7f0000000800)=@file={0x0, './file0\x00'}, 0x6e) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$SIOCRSSL2CALL(r8, 0x891c, 0x0) r9 = socket$inet(0xa, 0x801, 0x84) connect$inet(r9, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r9, 0x8) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) r11 = accept4(r9, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r11, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x6, 0x9}, &(0x7f00000000c0)=0x18) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffe0}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4044000}, 0x4008884) 2m26.245913876s ago: executing program 3 (id=2827): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x4, 0xc}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="8500000011000000350000000000020085000000230000009500073d000000003c8ea5932cf6fec5eade4bb02aa4f152b8bdfdf8ffffffffffeeff547930a8abf35fd3908aa4e150e020a1a45f8d6700ff00000000f669011b4504090bc057a5cdb706ceac9856bad67505a783d6f5d0542b83f636ab45c12311d14da9bf"], 0x0, 0x4}, 0x94) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r1, 0x58, &(0x7f0000000580)}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x7, 0x4, 0xc}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="8500000011000000350000000000020085000000230000009500073d000000003c8ea5932cf6fec5eade4bb02aa4f152b8bdfdf8ffffffffffeeff547930a8abf35fd3908aa4e150e020a1a45f8d6700ff00000000f669011b4504090bc057a5cdb706ceac9856bad67505a783d6f5d0542b83f636ab45c12311d14da9bf"], 0x0, 0x4}, 0x94) (async) socket$qrtr(0x2a, 0x2, 0x0) (async) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r1, 0x58, &(0x7f0000000580)}, 0x10) (async) 2m26.005012067s ago: executing program 3 (id=2829): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000001b00000000de65aefad64a54f0", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x10, "0000e3ffffff6331ce5db6ba62d46a00"}}}]}, 0x48}}, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x12, &(0x7f0000000a00)=@ringbuf={{0x18, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@map_idx_val={0x18, 0x3, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, @generic={0x48, 0x7, 0x7, 0xfff, 0x80000001}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r0]}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000040)={r5, r4}, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r6}, 0x4) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r9, &(0x7f0000000040), 0xc) r10 = socket$inet6(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xffefffff}, {0x16}]}, 0x10) sendto$inet6(r10, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) r11 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r11, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r11, &(0x7f0000000340)=[{&(0x7f0000000080)='~', 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) read(r9, &(0x7f0000000100)=""/19, 0x13) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r12, @ANYBLOB="0500180130000000050019010c0000001300260085160000"], 0x34}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)={0x0, @remote, @local}, &(0x7f00000000c0)=0xc) recvmsg$kcm(r1, &(0x7f0000000740)={&(0x7f00000004c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000540)=""/156, 0x9c}, {&(0x7f0000000840)=""/166, 0xa6}, {&(0x7f0000000900)=""/248, 0xf8}], 0x3}, 0x12120) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x1c, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf5c, 0x0, 0x0, 0x0, 0x80}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x2}, @jmp={0x5, 0x1, 0x5, 0xb, 0x4, 0x50, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa41365c}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @exit, @map_idx={0x18, 0x2, 0x5, 0x0, 0x2}]}, &(0x7f0000000000)='GPL\x00', 0x8000, 0x0, 0x0, 0x41100, 0x40, '\x00', r13, 0x0, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000100)=[r4, r0, r0], &(0x7f00000001c0)=[{0x2, 0x3, 0x5, 0x2}, {0x5, 0x4, 0x2, 0x1}], 0x10, 0x3}, 0x94) 2m25.404220225s ago: executing program 3 (id=2834): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x26, 0x9, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x18) socket$nl_audit(0x10, 0x3, 0x9) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000004340)='netdevsim0\x00', 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x26, 0x9, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x2}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x18) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) socket(0x40000000015, 0x5, 0x0) (async) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) (async) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) (async) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10) (async) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) (async) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000004340)='netdevsim0\x00', 0x10) (async) 2m23.668931633s ago: executing program 5 (id=2844): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000001380)=[{{&(0x7f0000000080)=@can, 0x80, &(0x7f0000000540)=[{&(0x7f0000000100)=""/49, 0x31}, {&(0x7f0000000140)=""/65, 0x41}, {&(0x7f00000001c0)=""/176, 0xb0}, {&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000380)=""/243, 0xf3}, {&(0x7f0000000480)=""/162, 0xa2}], 0x6, &(0x7f0000000300)=""/38, 0x26}}, {{&(0x7f00000005c0)=@qipcrtr, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000640)=""/87, 0x57}, {&(0x7f00000006c0)=""/250, 0xfa}, {&(0x7f00000007c0)=""/172, 0xac}, {&(0x7f0000000880)=""/149, 0x95}, {&(0x7f0000000940)=""/252, 0xfc}, {&(0x7f0000000a40)=""/204, 0xcc}, {&(0x7f0000000b40)}], 0x7, &(0x7f0000000c00)=""/209, 0xd1}, 0x40}, {{&(0x7f0000000d00)=@isdn, 0x80, &(0x7f0000001240)=[{&(0x7f0000000d80)=""/21, 0x15}, {&(0x7f0000000dc0)=""/251, 0xfb}, {&(0x7f0000000ec0)=""/19, 0x13}, {&(0x7f0000000f00)=""/207, 0xcf}, {&(0x7f0000001000)=""/157, 0x9d}, {&(0x7f00000010c0)=""/129, 0x81}, {&(0x7f0000001180)=""/128, 0x80}, {&(0x7f0000001200)=""/47, 0x2f}], 0x8, &(0x7f00000012c0)=""/172, 0xac}, 0x9}], 0x3, 0x21, &(0x7f0000001480)={r2, r3+60000000}) 2m22.636062273s ago: executing program 5 (id=2846): socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'veth0_vlan\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x4, r1, 0x1, 0x6, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, 0x14) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x50}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4000) recvmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)={0x10, 0x12, 0x1}, 0x10}], 0x1}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025bd7000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xd}, {0xfff1, 0xfff2}, {0xffe0}}}, 0x24}}, 0x40000) 2m15.820290408s ago: executing program 5 (id=2849): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) listen(r1, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0xa, 0x1, 0x0) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000000000000000000000000000aa09000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e210000000800"/550], 0x610) socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket(0xa, 0x1, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x5b, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f04d0067c55a1bc000900b80006990700000015000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4098000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1fff01e3bb9ad809d5e1cace81ed0b66bce0b42a9e1b518077c20708215c2c4b4ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300000000000000", 0xd8}], 0x1}, 0x48002) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xfffffffe}}, {{0xa, 0x4e08, 0x4a3, @private2, 0x4f0}}}, 0x108) socket$key(0xf, 0x3, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000008297e87886ea4cabad588f0a55fa2e2500281207a9"], 0x30}}, 0x4004090) 2m15.23700899s ago: executing program 5 (id=2851): r0 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) (async) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) bpf$BPF_BTF_LOAD(0x25, &(0x7f0000000040)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000040)={r3, @in6={{0x2, 0x0, 0x0, @empty}}}, &(0x7f0000000300)=0x90) (async) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={r3, 0x80}, 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={0xffffffffffffffff, 0xe, 0x10}, 0xc) (async) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={0x0, @loopback, @empty}, &(0x7f0000000280)=0xc) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r7, &(0x7f0000000000)=ANY=[], 0x38) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r7, 0x0) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x19, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2128}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx={0x18, 0x6, 0x5, 0x0, 0x6}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x200}, @alu={0x4, 0x0, 0x5, 0x8, 0xb, 0x100, 0xfffffffffffffffc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000140)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x4, '\x00', r6, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000002c0)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000000440)={0x2, 0x5, 0x1, 0x6}, 0x10, 0x0, 0x0, 0x7, &(0x7f00000004c0)=[r7, r8], &(0x7f0000000500)=[{0x4, 0x1, 0x7, 0x2}, {0x2, 0x1, 0xa, 0x2}, {0x2, 0x3, 0xd, 0x8}, {0x1, 0x2, 0xb, 0xa}, {0x4, 0x3, 0x0, 0x8}, {0x2, 0x1, 0x1}, {0x3, 0x2, 0xd20cc8d, 0xc}], 0x10, 0xfffffff9}, 0x94) 2m14.728893292s ago: executing program 5 (id=2854): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000080), 0x12) bind$x25(r0, &(0x7f00000002c0), 0x12) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="05002dbd7000000000000f00000008000300", @ANYRES32=r5, @ANYBLOB="3f000e0080000000ffffffffffff080211000000ffffffffffff00000000000000000000640001000006861551128cc10301030406f0027f0006a7060206000004000e8008000c006400000008000d00000000007d6b6e4d1638d5020f6bac653612e9bc9b49d6a1df72cd810e3c6b2fc3bb15104f0ff9fe536b91520f3dc437126f079d67725775ea01256100ed615ce64f7995f7869c415dbca7ee1a8b29e2b84c1d63d51716dbc41913ab1b"], 0x70}}, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x1c, 0x0, &(0x7f0000000080)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="24000005005c77532473a63d979f6f29537172d5777ce56a6474ee5c91727d48c852628198820ab103ab002318579b5ef5b4f75f89d017c58b5aa1f6a16d1bd828e23bbb30df50070ce8ce6330c676c8bfcc87c3433e7ba8469214ab8659c3bbaf", @ANYRES16=r8, @ANYBLOB="0100000000000000000000000000080002000000000008000100", @ANYRES32=0x0, @ANYBLOB], 0x24}}, 0x0) sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r8, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}, @GTPA_MS_ADDRESS={0x8, 0x5, @private=0xa010101}, @GTPA_LINK={0x8, 0x1, r2}]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r2, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r1], 0x68}}, 0x0) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x6, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xdd}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x1}]}]}, 0x24}}, 0xc010) ioctl$sock_inet6_udp_SIOCINQ(r9, 0x541b, &(0x7f00000005c0)) close(r9) sendmsg$OSF_MSG_REMOVE(r9, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000b80)={0x964, 0x1, 0x5, 0x101, 0x0, 0x0, {0x3, 0x0, 0x4}, [{{0x254, 0x1, {{0x1}, 0x5a, 0x7, 0x7, 0x6, 0x6, 'syz1\x00', "db9b90c14c16f8b115c6e84125ee956a61ca60e4039e755a29fa4efcfed04489", "55db1da92aecc68e6717320419bdee252c9ae1ab08f3bff438d3b2423c4b4f02", [{0x7, 0x5, {0x3, 0x2}}, {0x1, 0x2, {0x2, 0x5}}, {0x4, 0x401, {0x0, 0x9}}, {0x871f, 0x1, {0x0, 0x9}}, {0x3, 0x6, {0x1, 0x816}}, {0xc, 0xa6, {0x1, 0x8}}, {0xffff, 0xcb3, {0x1, 0x7}}, {0x8000, 0xc00, {0x3, 0x5}}, {0x6, 0x5, {0x3, 0x90}}, {0x91, 0x8001, {0x0, 0xfffffffc}}, {0x5, 0x2d, {0x0, 0x8}}, {0x4, 0xff, {0x3, 0x5}}, {0x120, 0x0, {0x3, 0x80000000}}, {0x5, 0x2, {0x3, 0x3}}, {0x6, 0x4, {0x2, 0x9293}}, {0x2}, {0x1, 0xffff, {0x0, 0x8}}, {0x3, 0xe, {0x0, 0x5}}, {0xffff, 0xe, {0x1, 0x9}}, {0x3, 0x80, {0x2, 0x20}}, {0xc, 0xa922, {0x2, 0x4}}, {0x6, 0x3, {0x3, 0xdd1a}}, {0xfffb, 0xbac}, {0x4, 0x1ff, {0x3, 0xba1}}, {0x8, 0x400, {0x1, 0x2}}, {0x1, 0x1, {0x2, 0x8}}, {0xb5e, 0x8, {0x2, 0x8000}}, {0x2, 0x7, {0x3, 0x9}}, {0x3, 0x4, {0x2, 0x80}}, {0x3ff, 0x100, {0x1, 0x4dd25fea}}, {0xf, 0x5, {0x0, 0x8}}, {0x9, 0x4, {0x1, 0x2}}, {0x4, 0x4, {0x2, 0x29}}, {0x6f8f, 0xf, {0x1, 0x5}}, {0xfffb, 0xc5c4, {0x1, 0x9}}, {0xd, 0x346, {0x0, 0x4}}, {0xa, 0x401, {0x1, 0x80000000}}, {0x7fff, 0x401, {0x3, 0x9aa}}, {0x2, 0x4, {0x2, 0x7}}, {0x2, 0xfff5, {0x2, 0xe01a}}]}}}, {{0x254, 0x1, {{0x0, 0x1}, 0xfd, 0x66, 0x4, 0x7, 0xa, 'syz0\x00', "41eaa63909f4cbaebb895e197e8c8dd579a87aa3b3efd0ec3dcb93e7c974febc", "c8029f4792ee9b662dd14bdc7fc6f4b72062986a541fd4e3216d8da665990130", [{0x2}, {0x0, 0x40, {0x1, 0x1}}, {0x6, 0x400, {0x1, 0x3}}, {0xfff8, 0x44, {0x2, 0xb00}}, {0xc8, 0x8, {0x2, 0x922}}, {0x2, 0x3, {0x1}}, {0x2, 0xb, {0x3, 0x10}}, {0xbdb, 0xfffe, {0x1, 0xe46}}, {0x2c18, 0x7, {0x0, 0xfe000000}}, {0x80, 0x5, {0x0, 0x2fe4}}, {0x6, 0x0, {0x3, 0x1ff}}, {0x3, 0x6, {0x0, 0x2}}, {0x3ff, 0x4, {0x3, 0xfffff001}}, {0x86ae, 0x0, {0x1, 0x9}}, {0x6, 0x8000, {0x2, 0x3}}, {0x7, 0xc, {0x2, 0x3}}, {0x8, 0x6, {0x2, 0x6}}, {0x101, 0x8001, {0x0, 0xfffffff6}}, {0x1, 0x5, {0x1, 0x5}}, {0x0, 0x85, {0x0, 0x1}}, {0xfffd, 0x0, {0x1, 0x100}}, {0xd8, 0x3, {0x0, 0x32de}}, {0xc744, 0x1, {0x1}}, {0x0, 0x1, {0x3, 0x8}}, {0x4, 0xa6f, {0x2, 0x7}}, {0x1, 0xf47, {0x0, 0x2}}, {0x8, 0x2, {0x1, 0x5}}, {0x4, 0xff, {0x0, 0x800}}, {0xfff, 0x7, {0x2, 0x8}}, {0x0, 0x5, {0x2, 0x4}}, {0x8, 0x9, {0x3, 0x7f}}, {0xb, 0x1, {0x3, 0x5}}, {0x200, 0x4, {0x3, 0xffffffff}}, {0x4, 0x3, {0x1, 0x7fff}}, {0x10, 0x400, {0x0, 0x9}}, {0x4, 0x2, {0x1, 0x400000}}, {0x200, 0x8, {0x2, 0x7}}, {0x800, 0x4, {0x0, 0x4}}, {0x6, 0xf, {0x1, 0x9}}, {0x0, 0x9, {0x1, 0x101}}]}}}, {{0x254, 0x1, {{0x3, 0x4}, 0x8e, 0x1e, 0xe6, 0xfff7, 0x8, 'syz0\x00', "f4ac16abb13e61f74f257bf8193dd20c05b84f6b45addefd027b399d7c461227", "4488793b00aafd3d9799fd2cfba5bceabc87c22f74cfa846b162cad2260e4395", [{0x3ff, 0x6, {0x0, 0x2}}, {0xfffc, 0x2, {0x1, 0x68a9}}, {0x7, 0x7f, {0x1, 0x6}}, {0x0, 0x6, {0x3, 0x3}}, {0x9, 0x38, {0x0, 0x9}}, {0x8, 0x3, {0x1, 0x10000}}, {0x4, 0x8, {0x2, 0x8}}, {0x0, 0x1, {0x2, 0x80}}, {0x81, 0x9, {0x3, 0x6e}}, {0x8, 0x400, {0x1, 0x2}}, {0x101, 0x5, {0x2, 0x8000}}, {0xe, 0x7, {0x1, 0x7}}, {0x9, 0xb, {0x2, 0x9}}, {0xf58, 0x200, {0x0, 0x1}}, {0xffff, 0x6, {0x3, 0x2}}, {0x3, 0x5, {0x1, 0x4}}, {0xc, 0xfffd, {0x2, 0x3}}, {0x2, 0x9}, {0x4, 0xb851}, {0x2, 0x7, {0x0, 0x580c9b33}}, {0x5, 0x0, {0x2, 0x9e14}}, {0x0, 0x9, {0x1, 0x10000}}, {0x8001, 0xff01, {0x1, 0x8}}, {0x0, 0x1, {0x2, 0x4}}, {0x5, 0x3, {0x1, 0x8}}, {0x200, 0x11, {0x0, 0x7}}, {0xff, 0x431, {0x3, 0x310}}, {0x9, 0x0, {0x2, 0x9}}, {0x2e, 0x8000, {0x1, 0x7}}, {0x7, 0x8, {0x2, 0x5}}, {0x7fff, 0x5, {0x1, 0x80}}, {0xc, 0x4, {0x1, 0x9}}, {0x4, 0x7ff, {0x2}}, {0x445, 0x16, {0x3, 0x1}}, {0x743, 0x5, {0x1, 0xf6f}}, {0xf0b5, 0x5, {0x3, 0x200}}, {0x4, 0x14, {0x3, 0x80000001}}, {0x0, 0x3a65, {0x1, 0xffffffc0}}, {0x1, 0x3, {0x0, 0x9}}, {0x800, 0x7, {0x0, 0x2}}]}}}, {{0x254, 0x1, {{0x1, 0x40}, 0x9, 0x10, 0x0, 0xc, 0x10, 'syz1\x00', "c36d81d97002683c262edf5c5fa8c4586e24b21c6dd12e4cec28fea042621f0b", "e69d893f224f8c9d4d5d813a8ebb3597ba0a2b5b23213a78171602b677a0dad3", [{0x4122, 0x1, {0x1, 0xffff}}, {0x3, 0x8, {0x2, 0x5}}, {0x7, 0x8000, {0x1, 0x7fffffff}}, {0x3, 0x7, {0x0, 0x3ff}}, {0x8001, 0x8, {0x2, 0xfffffb36}}, {0x1, 0x8, {0x2, 0x8001}}, {0x4, 0x8, {0x0, 0x1}}, {0x8, 0x8001, {0x0, 0x2}}, {0x0, 0x0, {0x3, 0x8}}, {0x81, 0x4, {0x3, 0x1}}, {0x400, 0x60, {0x0, 0x9}}, {0x0, 0xc48, {0x0, 0x3}}, {0x54c, 0xfffd, {0x1, 0x8}}, {0x6e, 0xa7, {0x2, 0xaf9}}, {0x5, 0x2, {0x2, 0x4}}, {0x769, 0x3, {0x0, 0x4}}, {0x846, 0xc37a, {0x1, 0x72}}, {0x2, 0x7f, {0x3, 0x200}}, {0x5, 0x4b, {0x3, 0x9}}, {0x3, 0x2, {0x2, 0x9}}, {0x81, 0x81, {0x0, 0x9e}}, {0xe5, 0x7, {0x0, 0x3}}, {0xb, 0x6, {0x1, 0x7ff}}, {0xc4, 0x7, {0x0, 0x3}}, {0x4c14, 0x407, {0x2, 0xab}}, {0x6, 0xfff, {0x1, 0x10}}, {0x8, 0xfffc, {0x3, 0x80}}, {0x4, 0x3, {0x2, 0x4d9}}, {0x2, 0x3, {0x3, 0x2}}, {0x1, 0x3, {0x2, 0xabda}}, {0x7f, 0x1, {0x1, 0x1}}, {0x4, 0x100, {0x3, 0x9}}, {0x0, 0x8, {0x2, 0x7fff}}, {0x1000, 0x7fff, {0x3, 0xdb}}, {0x40, 0x400, {0x0, 0x51}}, {0x9, 0x5, {0x0, 0x529}}, {0xf, 0xa, {0x2, 0x9}}, {0x0, 0xfffe, {0x0, 0x5}}, {0x101, 0x9, {0x1, 0x8}}, {0xc, 0x81, {0x0, 0x4b7f}}]}}}]}, 0x964}}, 0x1) 2m14.005518333s ago: executing program 5 (id=2857): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}], 0x10) unshare(0x6c040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NOTIFY_RADAR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000028c49ef7caf55d887c941b", @ANYRES16=r7, @ANYBLOB="010028bd7000fedbdf258600000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, 0x0, 0x8080) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) socket$inet(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r9 = socket$qrtr(0x2a, 0x2, 0x0) sendmsg(r9, &(0x7f0000003040)={&(0x7f0000000000)=@qipcrtr={0x2a, 0x1, 0x2}, 0x80, 0x0}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[], 0x7c}}, 0x104) sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54000000060a0b0400000000000000000200000028000480240001800b000100736f636b657400001400028008000240000000190800000000000900020073797a3201000000140000001100010000000000000000000000000a"], 0x7c}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 2m9.861344142s ago: executing program 33 (id=2834): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x26, 0x9, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x18) socket$nl_audit(0x10, 0x3, 0x9) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000004340)='netdevsim0\x00', 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x26, 0x9, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, 0x2}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x18) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) socket(0x40000000015, 0x5, 0x0) (async) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) (async) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) (async) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @loopback}, 0x10) (async) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) (async) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000004340)='netdevsim0\x00', 0x10) (async) 1m58.362412779s ago: executing program 34 (id=2857): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}], 0x10) unshare(0x6c040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NOTIFY_RADAR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000028c49ef7caf55d887c941b", @ANYRES16=r7, @ANYBLOB="010028bd7000fedbdf258600000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, 0x0, 0x8080) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) socket$inet(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r9 = socket$qrtr(0x2a, 0x2, 0x0) sendmsg(r9, &(0x7f0000003040)={&(0x7f0000000000)=@qipcrtr={0x2a, 0x1, 0x2}, 0x80, 0x0}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[], 0x7c}}, 0x104) sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54000000060a0b0400000000000000000200000028000480240001800b000100736f636b657400001400028008000240000000190800000000000900020073797a3201000000140000001100010000000000000000000000000a"], 0x7c}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 1m33.255995942s ago: executing program 0 (id=2959): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000080)=0x4) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004) (async) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000380)="00214717a70700000000030600710a5eeb9d0471200000000500000000000000ffff0342844d50e77d0dc450de49c204a803166580ac899c081cb49f1930e7d07fbdf3d8134e72158357ee37fdae", 0x4e}], 0x1, 0xee, 0x1) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) (async) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000005c0)={0x1c, r3, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x26000000) 1m32.564723628s ago: executing program 0 (id=2961): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 32) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) (rerun: 32) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001580)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000540)=0x9c) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x6}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) (async) socket$unix(0x1, 0x2, 0x0) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r7 = socket$kcm(0x11, 0x3, 0x0) (async, rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xfff2}, {0x2, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffffd}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x5}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) r10 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r12, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x2, "00000000ce072d4530bfda82621b0500"}}}]}, 0x48}}, 0x0) (async, rerun: 32) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r5, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) (async, rerun: 32) listen(r0, 0xfffffffc) (async) r13 = socket$netlink(0x10, 0x3, 0x4) writev(r13, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 1m31.515923536s ago: executing program 0 (id=2962): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000180)={0x2, 'vlan0\x00', {0x5}}) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a090400000000000000000200000038000480340001800a0001006c696d6974000000240002800c000140000000000000000908000540000000000c00024000000005000000000900010073797a30000000000900020073797a32"], 0x8c}, 0x1, 0x0, 0x0, 0x4085}, 0x0) 1m31.110133397s ago: executing program 0 (id=2963): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket(0x14, 0x2, 0x4) close(0xffffffffffffffff) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) (async, rerun: 32) connect$802154_dgram(r0, &(0x7f0000000000)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x14) (rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0x4, 0x4, 0x7}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r2}, &(0x7f00000000c0), &(0x7f0000000300)}, 0x20) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x22, 0x0, &(0x7f00000006c0)="f6f4e9a1d78ad62ceef1884366a578bb3fb7dbfc", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) (async) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[], 0xa4}}, 0x40040) (async) socket$nl_generic(0x10, 0x3, 0x10) 1m29.127784742s ago: executing program 2 (id=2969): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @local, 0x3, 0x3}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x900}, 0x60) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000780), r3) getsockname$packet(r3, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) r4 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {}, {0x1, 0xfff1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_FLAGS={0x8, 0x8, 0xb}]}}]}, 0x44}}, 0x1) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) recvfrom$rxrpc(r3, &(0x7f0000000200)=""/94, 0x5e, 0x40000020, &(0x7f00000002c0)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0xa, @remote, 0x2}}, 0x24) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="030300000000fcff03000d00000008000300", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x80}}, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="80420000000000001400030076657468305f746f5f626f6e6400000008003a00", @ANYRES32=0x0, @ANYBLOB='\b\x00('], 0x44}}, 0x0) sendmsg$nl_xfrm(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0xb8}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRESHEX=r10, @ANYRESOCT=r10, @ANYRES32=r9, @ANYRES32=r8, @ANYRES32=r8, @ANYRES8=0x0, @ANYRESHEX=r8, @ANYRES8=r10], 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0x8050) 1m28.867591473s ago: executing program 7 (id=2890): socket$kcm(0x10, 0x400000002, 0x0) (async) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000200)=ANY=[@ANYBLOB="1800000014000104595e0000008000001e"], 0x18}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001940)=@newlink={0x50, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@loopback]}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24048800}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001940)=@newlink={0x50, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x8, 0x8, 0x0, 0x1, [@loopback]}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24048800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="180200000000000000000000000000008500000011"], 0x0, 0x1, 0x0, 0x0, 0x40f00}, 0x94) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="33fe0000240013"], 0xfe33) 1m28.07732191s ago: executing program 7 (id=2972): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000008000000000000001c2df6f270000000fad413ec50000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r2}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r3}, 0x10) close(0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0xfff8}, {0xffff, 0xffff}, {0xa, 0xfff1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_EGRESS_BLOCK={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c044}, 0x40) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000380)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006cef770aaa898bfffddb23aed73c6f6164"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) 1m27.75855993s ago: executing program 2 (id=2973): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000440), 0x8) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r1}, @IFLA_GTP_FD1={0x8, 0x2, @udp6=r2}]}}}]}, 0x40}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, &(0x7f0000000080)=[0x0, 0x0], &(0x7f00000000c0)=[0x0], 0x0, 0x82, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x2b, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) r4 = socket$kcm(0x2, 0x922000000001, 0x106) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x25, &(0x7f00000002c0)=r5, 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001e004b05000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6], 0x28}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710439000000000095000000"], &(0x7f0000000340)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x18, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r3}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.net/syz0\x00', 0x200002, 0x0) 1m27.413182981s ago: executing program 6 (id=2976): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffdfe, {0x0, 0x0, 0x0, r1, {0xd}, {0xffff}, {0x7, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x4000080) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x26, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x9c}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffdfe, {0x0, 0x0, 0x0, r1, {0xd}, {0xffff}, {0x7, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x4000080) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x26, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x9c}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) (async) 1m27.246434929s ago: executing program 7 (id=2977): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket(0x2000000000000021, 0x2, 0x10000000000002) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r3, 0xe4}, 0x18) r4 = socket(0x10, 0x803, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff6}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x5, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6fe2}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x4, 0x0, 0xd87, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xab, 0x8e}}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1804"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r11) r12 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r12, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r11, 0x4010744d, &(0x7f0000000180)) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) 1m26.922898016s ago: executing program 6 (id=2978): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="2e0000000000000000000000000000002f110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x1, 0x8, 0x4, 0xff, 0x0, 0x1}, 0x50) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, &(0x7f0000000000), &(0x7f0000000040)=r2}, 0x20) setsockopt(r0, 0x84, 0x18, &(0x7f00000002c0)="1af3050000f2bd5b", 0x8) 1m26.81365236s ago: executing program 1 (id=2979): r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'erspan0\x00', &(0x7f0000000140)=@ethtool_pauseparam={0x13, 0x0, 0xfffffffd}}) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r2) sendmsg$FOU_CMD_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="0ab9f7ff", @ANYRES16=r3, @ANYBLOB="010026bd7000ffdbdf2503000000060001004e230000050002000a000000"], 0x24}}, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r6, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, r6, 0x0, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xeb}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7f}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x4004095) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x5c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0x30}, @IFLA_GRE_LOCAL={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}]}, 0x5c}}, 0x0) 1m26.81307521s ago: executing program 2 (id=2980): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x526}, @TCA_SAMPLE_PARMS={0x18}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x70}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@newtaction={0x48, 0x31, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x48}}, 0x0) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0x9f04, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="60000000100001040100"/20, @ANYRES32=0x0, @ANYBLOB="7b130000000000003800128008000100677470002c00028008000100", @ANYRES32, @ANYBLOB="08000300", @ANYRES32], 0x60}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x1fffffffffffff1b, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x2f}]}, &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xc6}, 0x90) 1m26.21107278s ago: executing program 6 (id=2981): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x400}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0xd9a7, @dev={0xfe, 0x80, '\x00', 0x28}, 0x7c96}, 0x1c) (async, rerun: 64) r1 = socket$netlink(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000004900010000000000000000000a006000", @ANYRES32=0x0, @ANYBLOB="000000000800020000000000140001"], 0x38}}, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000084000000060a010400000000000000000100000008000b40000000005c000480340001800b000100657874686472000024000280080001400000000b080003400000000008000440000000300500020007000000240001800a0001007265646972000000140002800800014000000012080002400002000e0900010073797a30"], 0xf8}}, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000280)=0xd, 0x4) (async) r3 = socket$inet6(0xa, 0x80002, 0x88) (async) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="680000000714010025bd7000ffdbdf25080001000100000008000100000000000900020073797a32000000000900020073797a300000000005004200050000000800010001000000090002007379b6bf000000000900020073797a3000000000080001"], 0x68}}, 0x0) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r1, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x10, 0x1412, 0x20, 0x70bd26, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x8080}, 0x880) (rerun: 32) setsockopt$inet6_udp_int(r3, 0x11, 0x66, &(0x7f00000002c0), 0x4) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r4}, 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4050000000000007110ae0000000000060000000000000095000000000000001f3d4eb3edc86c04e323b24d9426e5339e162b4915ca4c92ec3a4a3935b6d581c304908f84d3f0e99ac4402141407b980e454bd575dd0dc0f1a682f6ba574e0700000000000000515ec25d0b1f1c8c9cd8eb72385ad6136789dcd5a694d3cfb4cec510d0d4d980e649aa4492032c5888f5f9b246b9f5117cb89f3ff246280a1ab186bbd42370e30e9a2028d82bd071a329b281c4393e1e8ce723f67552961cd23f056542399289825a0d3e13b1401cda214d8f87ba4e8a5fff7be68fe15f3c1df84f2086f79ab69bbb072848357dc3bbc144cca554fdf459a2b6dd58c29bafe29a5b1d630a94c14753a1b0d26203185b5735d393c9a6367767ff9f9edf5e6e7e94aefd0d49ad707a4a7027185086a66c0a321f386bc40caed35d63967e3809ad3187a72972c5c22c085f0a481e7ce9458e8c21647d100c9fc91eb8fe87d05e6545dcbe6cd28444fcdaac12f6469abc71af781f79c7aeafcdcadda97413e2539860ae46370405f742edd486fc26697c52d18f7adeaf79101b3da624ef12673df25d15d6f3f0be93636d8ea88eaafe20257812496258c87d3e97c35fbf3967e1ae86639489758fa8759006669c0d7ed1710d80bf8424e190cb78e36dd7e2e01034991761ff243405d75021155bf4e831208f0a845897ac198e36dc9e0928727ea3a6dc3f2f64aa4007cf52c41ffff9c7a51dc635d7d34f509725530e2f1d1f5ba90c325591f90c354764997bd47abcab66966d683c392ea96668506002589df1c948237f1533f3157fec94ebf2ce6347f6516a"], &(0x7f0000000240)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000000), 0xe, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2dc}, 0x94) 1m26.160929482s ago: executing program 2 (id=2982): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000480)={r1, 0x4}, &(0x7f0000000700)=0x8) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f00000001c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x5, 0x1, 0xfff, 0x5, @dev={0xfe, 0x80, '\x00', 0xf}, @empty, 0x40, 0x0, 0x19, 0x801}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000deff00010000000900010073797a300000000038000000160a01000000000000000000010000070900010073797a30000009000000000000007a30000000000c0003800800014000000000140000001000010000000000000000000000000a"], 0x80}}, 0x0) 1m25.712846298s ago: executing program 1 (id=2983): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="410000000000000001000603000014000300060afc04090300f006e8ffff00000001080007003a3a0909140002"], 0x44}, 0x1, 0x1000000}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'veth0_to_bond\x00', 0x400}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETDEBUG(r2, 0x400454c9, &(0x7f0000000140)=0x1) close(r4) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x6, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x5}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r5}, @generic={0x66}, @initr0, @exit, @printk={@x={0x18, 0x0}, {0x3, 0x3, 0x3, 0xa, 0x0}, {0x5, 0x1, 0xb, 0x1, 0x5}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x19}}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0xde, &(0x7f0000003e40)=""/222}, 0x90) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @link_local}) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[], 0xffdd) 1m25.585219829s ago: executing program 0 (id=2974): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="500200"/20, @ANYRES32=0x0, @ANYBLOB="3f00000000000000300012800b00010062726964676500002000028005000700080000000c002e0003000000030000000500170000000000"], 0x50}}, 0x0) 1m23.714209751s ago: executing program 1 (id=2984): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000480)={0x3, {{0xa, 0x4, 0x10001, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000600)={0x2, {{0xa, 0x4e24, 0xffffffff, @mcast2, 0x4}}, {{0xa, 0x4e21, 0x5, @mcast2, 0x5}}}, 0x108) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYRES8=0x0, @ANYRESHEX=r5, @ANYRES8=r5], 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r4, @ANYRES64=r4, @ANYRES64=r3, @ANYRES16, @ANYRES64=r5, @ANYRESHEX=r5, @ANYRESOCT=r1], 0x40}, 0x1, 0x0, 0x0, 0x20008000}, 0x480d0) 1m23.713437259s ago: executing program 2 (id=2985): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv4_newroute={0xdc, 0x18, 0x1, 0x0, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x8, 0x800}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}, @RTA_METRICS={0x2d, 0x8, 0x0, 0x1, "9f6ce4af131a1bbfdcafd6acbd4795cf0909fb68cd8a32b9364ee7e5c9c4f9eee7e4fd4bfa32076102"}, @RTA_METRICS={0x85, 0x8, 0x0, 0x1, "610b90b7b43f7e208409d2293355fe33a1cbfee0726ea6e12e6ce523b5d31e275b4d328dd99b6337a91a38dd25e0a7d8c64669e385b98bbbe4d0cf541673f7ca162a709a603ad2b19bef5d60ee78f27288b6c873249b77285703ec157732f2898b90b962b1c88354549f78075ea9ceeecbb6606d1206525aba5da1a1d9a8b024af"}]}, 0xdc}, 0x1, 0x0, 0x0, 0x800}, 0x80) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x2) (async) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) close(r4) (async) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r3) (async) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000240)={r2, 0x4, 0x8001, 0x200}) ioctl$TUNGETFILTER(r6, 0x801054db, &(0x7f0000000300)=""/175) (async) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00042dbd7000fedbdf25030000000800030000005ccfbe940180060001000a000000140004002001000000000000000000000008000400070000002c00018014000400fe8000800000000000000000000000aa14000400fe880020000000000000000000000101000000"], 0x70}, 0x1, 0x0, 0x0, 0x4000031}, 0x1) 1m23.712425581s ago: executing program 6 (id=2986): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r1, &(0x7f00000013c0)=[{{&(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000001400)=[@ip_tos_int={{0x14}}], 0x18}}], 0x1, 0x4000000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e22, 0x1, @loopback, 0x10001}], 0x1c) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r0]}, 0x90) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000040)={r3, r2}, 0xc) 1m23.677995168s ago: executing program 7 (id=2987): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x1c, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10) (async) ioctl$FITHAW(r0, 0xc0045878) 1m23.23305163s ago: executing program 1 (id=2988): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000070000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r2}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) ppoll(0x0, 0x0, 0x0, &(0x7f0000000500)={[0xfe9]}, 0x8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x60) 1m23.216955194s ago: executing program 7 (id=2989): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000007a00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x46}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r2, &(0x7f00000003c0)='V', 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000180)={0x0, 0x8, 0x4}, 0x8) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x3, 0xf, &(0x7f0000000540)=ANY=[@ANYBLOB="180000181100f700"/20, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r4, 0x5201) close(0x3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x27, 0xe, 0x0, &(0x7f0000000040)="f8ad48cc02cb29fcc800775b86dd", 0x0, 0x7f, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000340)=ANY=[@ANYRES32=r0, @ANYRES64=r1, @ANYBLOB='\t\x00\x00\x00\x00'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r1, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r7, 0x29, 0x39, &(0x7f0000000040)="ff0204000000000100000000000000000000000000000205", 0x18) getsockopt$inet6_opts(r7, 0x29, 0x39, 0x0, &(0x7f0000000080)=0x35) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xfff2, 0xffe0}, {0x1, 0xfff1}, {0x7, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="22fc070003000000"], &(0x7f0000000040)='GPL\x00', 0x18, 0x4d, &(0x7f0000000100)=""/77, 0x41000, 0x40, '\x00', r8, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000180)={0x5, 0x3, 0x7a5}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{0x3, 0x2, 0x4, 0xc}], 0x10, 0x1}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r10 = openat$cgroup_devices(r9, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r10, &(0x7f0000000140)=ANY=[@ANYBLOB='c *:', @ANYRESOCT=r10], 0xa) sendmmsg$inet6(r0, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000ac0)="01", 0xfffffe9c}], 0x1}}], 0x2, 0x241) 1m23.205554934s ago: executing program 6 (id=2990): r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) connect$x25(r1, &(0x7f0000000500)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) (async) r2 = socket(0x28, 0x1, 0x0) (async) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r5 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, 0x0, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x12, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001c0000000000000000000000711207000000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @cgroup_sock_addr=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) sendto$packet(r3, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c28035", 0xe, 0x830, &(0x7f0000000440)={0x11, 0x0, r7, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, 0x14) (async) getsockname$packet(r2, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002440)=@delchain={0x34, 0x2e, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0xe, 0x3}, {0xfff1, 0xffff}, {0xc, 0xd}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e0021001400000002800000121f", 0x2e}], 0x1}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) socket$inet6_udplite(0xa, 0x2, 0x88) syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r9) (async) sendmsg$nl_route(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000004fd7e0ca1f652669b8100001040000027432004da1fc4949eec07b619abc7d8990bc4a7a213186a272fcaa6c10b78245455f4e439e0a7bd01950099124cc7b5d5ba454e02a2076e15cfeee8d4d8d09670c5a869e3c46b60035d16b9001105abd39345a6b967c483a233e7e416886ec6665085c132bc642c9d834d59093980a34cdc86bb723c65afd36e4cd8a1e15e39cde9c858c7353ec6a1d5b07d6a5c49dacaa7b07b64a8fa36e92ff5865d10da385cbebaef9bd1da1ec1437f6de36b1a609caf3201b63394bb09d38ffcbb10585ec8ac33b76cbb28a2b7899682576b59e71143d9e50e0775c9c849f78ca50ba4ae526f26ced0cb17422c2a76921b827ef4161e66170ce376de3fa160ddd751afe3973721a288a0928d20a855e1d52111a20af61a2526e017807b7dbf59ec877c01e776bb9b93c4f5222d3b78dc8622cd4b11ec43a0b74916029fbb97a6794b66342eed60cfe17d6358e18cccefdffbf81e81767aecfc33d2438ea89a1852aad7db886f268613ff413b0ea63bf34fc9de18d81c619d7", @ANYRES32=0x0, @ANYBLOB="0380000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x240008c4}, 0x0) 1m23.133626149s ago: executing program 2 (id=2991): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd7000fbdbdf251e00000008000300", @ANYRES32, @ANYBLOB="50002f800c0002000203aaaaaaaaaaaa0c0003800800010002"], 0x6c}, 0x1, 0x0, 0x0, 0x20040814}, 0x4880) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c0016"], 0x38}}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x400, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000300)=0x4, 0x4) close(r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r5, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0xfffffffc}) ioctl(r5, 0x8b22, &(0x7f0000000040)) sendmsg$TIPC_NL_MEDIA_SET(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$smc(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000180)={'wlan0\x00', &(0x7f0000000140)=@ethtool_sset_info={0x37, 0x7, 0x7}}) sendmsg$SMC_PNETID_DEL(r4, &(0x7f00000002c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r7, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@SMC_PNETID_NAME={0x51, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x0, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x0, 0x2, 'ip6tnl0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x3, 0x8000, 0x9, 0xa}, 0x10) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000580), r6) sendmsg$GTP_CMD_GETPDP(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x1c, r9, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', @random="b524732b4e4a"}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="89e7ee2c78dad9b4b473fec988a8", 0xe}, {&(0x7f0000000380)="2acfb759abd3", 0x6}], 0x2) sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x38, 0x5, 0x6, 0x204, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x90}, 0x804) 1m22.676622734s ago: executing program 1 (id=2992): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000340)={'ip6_vti0\x00', 0x0, 0x29, 0x7, 0x8, 0xfffffffb, 0x1d, @rand_addr=' \x01\x00', @remote, 0x700, 0x1, 0x5, 0x1}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=@ipv6_getroute={0x34, 0x1a, 0x10, 0x70bd29, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, [@RTA_PRIORITY={0x8, 0x6, 0x4}, @RTA_IIF={0x8, 0x3, r1}, @RTA_MARK={0x8}]}, 0x34}}, 0x20000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="7c010000190001000000000000000000fe880000000000000000000000000001ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000100000000000000c4000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000000000000010000000000000000000000000000e0000002000000000000000000000000000000006c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fc00000000000000000000000000000000000000040004"], 0x17c}}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0011"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x0, 0x0, 0xff, 0x3, 0x600}, 0x21) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0xffffffffffffff0e, 0x5, 0x1, 0x0, 0xfffffffe}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}], {0x14}}, 0x6c}}, 0x0) 1m22.255493076s ago: executing program 6 (id=2993): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x3}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x13, 0x2}, @TCA_FQ_FLOW_PLIMIT]}}]}, 0x48}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r0}) sendto$ax25(r5, &(0x7f0000000440)="a48e4e703188911cef379f9423a523cdde0410cdda0e39695496ddb03bea32ae7f8ea9eef5101f4fe833c182e0a4a7054f784ca3588d467847aa7411147e73984c3d6b4975015660383f388d79b659e5b71daae033b472cccb5242d3236969ff3dcc334c1d85c1f7a0f025b00b36214708075e5bb1b7cb766294abf5f7506f815f45fe6dbee2bf7eb850fa8b144311dd3f2abe7b2c6ca53ce476ae2e14da24723989ebf99f96bd0c86fd2bbbd7d98e022cfd72c2064a0a973e8290d195bb7d02989a0fe6a643f03d2789cdf4e2358f5ddd5f9e866b05007ccec533c42ff0b4eda917aaa58c317f8ff14768e4438116a0442933a4cb", 0xf5, 0x4041, &(0x7f0000000140)={{0x3, @null}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0xc0c4) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x103082, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56c4d, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x10, 0x7}, {0xffff}, {0x10}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7}}]}, 0x40}}, 0x4000) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000305000000000020000000000000", @ANYRES32=0x0, @ANYBLOB="15e3000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r10, @ANYBLOB="0a000100aaaa00"], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000600)=@deltfilter={0x64, 0x2d, 0x0, 0x70ad2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x6, 0x2}, {0xfff2, 0xffe0}, {0x4, 0x8}}, [@TCA_CHAIN={0x8, 0xb, 0x2f4}, @filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x6}, @TCA_FLOWER_KEY_CVLAN_ID={0x6, 0x4d, 0xb27}, @TCA_FLOWER_KEY_ENC_IP_TOS_MASK={0x5, 0x51, 0x81}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @remote}]}}, @TCA_CHAIN={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f0000000240)="8000000ee7decd7a000000", 0xb, 0x20000091, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596cf"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) socket$tipc(0x1e, 0x2, 0x0) r13 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r13, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) 1m21.997028759s ago: executing program 0 (id=2974): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="500200"/20, @ANYRES32=0x0, @ANYBLOB="3f00000000000000300012800b00010062726964676500002000028005000700080000000c002e0003000000030000000500170000000000"], 0x50}}, 0x0) 1m21.95275964s ago: executing program 7 (id=2994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="68000000100001002fbd7000fddbdf2500000000", @ANYRES32=0x0, @ANYRES16=r0], 0x68}, 0x1, 0x0, 0x0, 0x20008080}, 0x0) 1m20.064282141s ago: executing program 1 (id=2995): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20000850) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmmsg$inet(r4, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010102}}}], 0x20}}], 0x1, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r9, 0x100) accept4(r9, 0x0, 0x0, 0x0) shutdown(r9, 0x1) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x23, 0x6c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x14, 0x4, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@ssrr={0x89, 0xf, 0x5b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @private=0xa010102]}, @timestamp_prespec={0x44, 0x2c, 0x0, 0x3, 0x0, [{@multicast1=0xe000002f}, {@multicast1}, {@private}, {@dev={0xac, 0x14, 0x14, 0x4}}, {@private, 0x8000}]}]}}}}}}}, 0x0) 1m7.913083347s ago: executing program 35 (id=2991): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd7000fbdbdf251e00000008000300", @ANYRES32, @ANYBLOB="50002f800c0002000203aaaaaaaaaaaa0c0003800800010002"], 0x6c}, 0x1, 0x0, 0x0, 0x20040814}, 0x4880) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c0016"], 0x38}}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x400, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000300)=0x4, 0x4) close(r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r5, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0xfffffffc}) ioctl(r5, 0x8b22, &(0x7f0000000040)) sendmsg$TIPC_NL_MEDIA_SET(r4, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$smc(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000180)={'wlan0\x00', &(0x7f0000000140)=@ethtool_sset_info={0x37, 0x7, 0x7}}) sendmsg$SMC_PNETID_DEL(r4, &(0x7f00000002c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r7, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@SMC_PNETID_NAME={0x51, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x0, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x0, 0x2, 'ip6tnl0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x3, 0x8000, 0x9, 0xa}, 0x10) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000580), r6) sendmsg$GTP_CMD_GETPDP(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x1c, r9, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', @random="b524732b4e4a"}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)="89e7ee2c78dad9b4b473fec988a8", 0xe}, {&(0x7f0000000380)="2acfb759abd3", 0x6}], 0x2) sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x38, 0x5, 0x6, 0x204, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x90}, 0x804) 1m6.582855815s ago: executing program 36 (id=2993): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x3}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x13, 0x2}, @TCA_FQ_FLOW_PLIMIT]}}]}, 0x48}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000000c0)={r0}) sendto$ax25(r5, &(0x7f0000000440)="a48e4e703188911cef379f9423a523cdde0410cdda0e39695496ddb03bea32ae7f8ea9eef5101f4fe833c182e0a4a7054f784ca3588d467847aa7411147e73984c3d6b4975015660383f388d79b659e5b71daae033b472cccb5242d3236969ff3dcc334c1d85c1f7a0f025b00b36214708075e5bb1b7cb766294abf5f7506f815f45fe6dbee2bf7eb850fa8b144311dd3f2abe7b2c6ca53ce476ae2e14da24723989ebf99f96bd0c86fd2bbbd7d98e022cfd72c2064a0a973e8290d195bb7d02989a0fe6a643f03d2789cdf4e2358f5ddd5f9e866b05007ccec533c42ff0b4eda917aaa58c317f8ff14768e4438116a0442933a4cb", 0xf5, 0x4041, &(0x7f0000000140)={{0x3, @null}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0xc0c4) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x103082, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56c4d, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x10, 0x7}, {0xffff}, {0x10}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7}}]}, 0x40}}, 0x4000) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000305000000000020000000000000", @ANYRES32=0x0, @ANYBLOB="15e3000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r10, @ANYBLOB="0a000100aaaa00"], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000600)=@deltfilter={0x64, 0x2d, 0x0, 0x70ad2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x6, 0x2}, {0xfff2, 0xffe0}, {0x4, 0x8}}, [@TCA_CHAIN={0x8, 0xb, 0x2f4}, @filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x6}, @TCA_FLOWER_KEY_CVLAN_ID={0x6, 0x4d, 0xb27}, @TCA_FLOWER_KEY_ENC_IP_TOS_MASK={0x5, 0x51, 0x81}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @remote}]}}, @TCA_CHAIN={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f0000000240)="8000000ee7decd7a000000", 0xb, 0x20000091, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596cf"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) socket$tipc(0x1e, 0x2, 0x0) r13 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r13, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) 1m6.415377367s ago: executing program 37 (id=2994): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="68000000100001002fbd7000fddbdf2500000000", @ANYRES32=0x0, @ANYRES16=r0], 0x68}, 0x1, 0x0, 0x0, 0x20008080}, 0x0) 1m4.721312506s ago: executing program 38 (id=2995): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x20000850) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmmsg$inet(r4, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010102}}}], 0x20}}], 0x1, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r9, 0x100) accept4(r9, 0x0, 0x0, 0x0) shutdown(r9, 0x1) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x23, 0x6c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x14, 0x4, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@ssrr={0x89, 0xf, 0x5b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @private=0xa010102]}, @timestamp_prespec={0x44, 0x2c, 0x0, 0x3, 0x0, [{@multicast1=0xe000002f}, {@multicast1}, {@private}, {@dev={0xac, 0x14, 0x14, 0x4}}, {@private, 0x8000}]}]}}}}}}}, 0x0) 1m4.662477613s ago: executing program 9 (id=2997): r0 = socket(0x2d, 0x2, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r0}) 1m3.104510368s ago: executing program 3 (id=2999): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 4.529241314s ago: executing program 4 (id=2998): getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x80000000, 0x9, 0xfffffff9, 0xfffffffd, 0xf1, 0xcaf2, 0x47}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000100)={r0, @in={{0x2, 0x4e20, @multicast1}}, 0x35, 0x9, 0x6eb, 0x8, 0x4f, 0x7ff, 0xd}, 0x9c) 0s ago: executing program 3 (id=2999): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) kernel console output (not intermixed with test programs): 4] nbd2: detected capacity change from 0 to 1929379840 [ 216.744231][ T52] block nbd2: Receive control failed (result -104) [ 216.973674][T11460] ieee802154 phy1 wpan1: encryption failed: -22 [ 217.023656][T11463] IPv6: sit1: Disabled Multicast RS [ 217.034054][T11463] sit1: entered allmulticast mode [ 217.092401][T11468] vlan3: entered allmulticast mode [ 217.100717][T11468] mac80211_hwsim hwsim3 wlan0: entered allmulticast mode [ 217.163156][T11468] netlink: 'syz.2.1516': attribute type 3 has an invalid length. [ 217.374981][T11482] gre0: left promiscuous mode [ 217.427249][T11487] netlink: 'syz.3.1523': attribute type 21 has an invalid length. [ 217.564687][T11495] xt_CT: You must specify a L4 protocol and not use inversions on it [ 217.723539][T11482] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 217.767106][T11482] gretap1: left promiscuous mode [ 217.787460][ T1134] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.817749][ T1134] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.868102][ T1134] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.921763][T11505] netlink: 'syz.0.1530': attribute type 1 has an invalid length. [ 217.935858][T11505] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 218.283468][T11525] syzkaller0: entered promiscuous mode [ 218.289588][T11525] syzkaller0: entered allmulticast mode [ 218.392793][T11533] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 218.417593][T11527] pim6reg527: entered allmulticast mode [ 218.498766][T11541] netlink: 'syz.2.1542': attribute type 2 has an invalid length. [ 218.525412][T11541] __nla_validate_parse: 17 callbacks suppressed [ 218.525435][T11541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1542'. [ 218.611140][T11548] Cannot find set identified by id 65534 to match [ 218.706609][T11551] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1545'. [ 218.734976][T11555] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1546'. [ 219.061115][T11579] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1554'. [ 219.306218][T11598] netlink: 'syz.2.1559': attribute type 7 has an invalid length. [ 219.380690][T11606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1561'. [ 219.541703][T11616] erspan0: left allmulticast mode [ 219.564009][T11620] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1567'. [ 219.582688][T11620] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1567'. [ 219.819395][T11633] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 219.889793][T11640] netlink: 'syz.0.1573': attribute type 12 has an invalid length. [ 219.965327][T11649] openvswitch: netlink: IP tunnel dst address not specified [ 219.988697][T11652] netlink: 'syz.0.1573': attribute type 12 has an invalid length. [ 220.003654][T11640] bond10: option primary_reselect: invalid value (255) [ 220.022621][T11640] bond10 (unregistering): Released all slaves [ 220.289246][T11652] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 220.320946][T11657] syzkaller0: entered promiscuous mode [ 220.431113][T11657] syzkaller0: entered allmulticast mode [ 220.473052][T11678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 220.582275][T11691] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1578'. [ 220.700347][T11693] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1580'. [ 220.758075][T11695] sctp: [Deprecated]: syz.1.1581 (pid 11695) Use of int in maxseg socket option. [ 220.758075][T11695] Use struct sctp_assoc_value instead [ 220.772864][T11696] sctp: [Deprecated]: syz.1.1581 (pid 11696) Use of int in maxseg socket option. [ 220.772864][T11696] Use struct sctp_assoc_value instead [ 220.867230][T11704] sock: sock_set_timeout: `syz.0.1583' (pid 11704) tries to set negative timeout [ 221.113726][T11726] sch_tbf: burst 0 is lower than device lo mtu (143) ! [ 221.131490][T11724] netlink: 'syz.3.1588': attribute type 28 has an invalid length. [ 221.161097][T11724] netlink: 'syz.3.1588': attribute type 3 has an invalid length. [ 221.169076][T11724] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1588'. [ 221.250490][T11734] IPVS: Error joining to the multicast group [ 221.820274][T11775] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 221.937718][T11784] vlan2: entered promiscuous mode [ 221.947203][T11784] bridge0: entered promiscuous mode [ 222.376333][T11802] bond5: Invalid ad_actor_system MAC address. [ 222.382856][T11802] bond5: option ad_actor_system: invalid value (1) [ 222.401909][T11802] bond5 (unregistering): Released all slaves [ 222.493340][T11784] netlink: 'syz.1.1604': attribute type 4 has an invalid length. [ 223.202943][T11836] syzkaller0: entered promiscuous mode [ 223.208731][T11836] syzkaller0: entered allmulticast mode [ 223.375736][T11857] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 223.607534][T11868] netlink: 'syz.2.1629': attribute type 1 has an invalid length. [ 223.617045][T11868] __nla_validate_parse: 10 callbacks suppressed [ 223.617065][T11868] netlink: 212 bytes leftover after parsing attributes in process `syz.2.1629'. [ 223.635519][T11868] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1629'. [ 223.666732][T11873] netlink: 'syz.2.1629': attribute type 1 has an invalid length. [ 223.698900][T11873] netlink: 212 bytes leftover after parsing attributes in process `syz.2.1629'. [ 223.711815][T11873] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1629'. [ 225.264802][T11899] netlink: 'syz.2.1637': attribute type 10 has an invalid length. [ 225.275284][T11896] netlink: 'syz.3.1635': attribute type 1 has an invalid length. [ 225.347553][T11905] x_tables: unsorted entry at hook 1 [ 225.462731][T11913] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1642'. [ 225.890787][T11936] netlink: 'syz.1.1646': attribute type 12 has an invalid length. [ 226.409170][T11972] netlink: 212304 bytes leftover after parsing attributes in process `syz.1.1655'. [ 226.419863][T11972] openvswitch: netlink: Message has 6 unknown bytes. [ 226.429690][T11976] netlink: 'syz.0.1657': attribute type 5 has an invalid length. [ 226.444720][ T5983] IPVS: starting estimator thread 0... [ 226.539212][T11977] IPVS: using max 30 ests per chain, 72000 per kthread [ 226.661005][T11993] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1661'. [ 226.717503][T11999] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1664'. [ 226.728079][T11997] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1663'. [ 226.744006][T11997] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1663'. [ 226.998163][T12011] syzkaller0: entered promiscuous mode [ 227.017724][T12011] syzkaller0: entered allmulticast mode [ 227.101584][T12011] sctp: [Deprecated]: syz.1.1667 (pid 12011) Use of struct sctp_assoc_value in delayed_ack socket option. [ 227.101584][T12011] Use struct sctp_sack_info instead [ 227.238659][T12028] tc_dump_action: action bad kind [ 227.606923][T12054] netlink: 'syz.1.1680': attribute type 5 has an invalid length. [ 228.734117][T12106] v: renamed from dummy0 (while UP) [ 228.751411][T12107] sctp: [Deprecated]: syz.1.1692 (pid 12107) Use of int in max_burst socket option. [ 228.751411][T12107] Use struct sctp_assoc_value instead [ 228.810711][T12106] bridge0: port 1(macsec0) entered blocking state [ 228.831454][T12106] bridge0: port 1(macsec0) entered disabled state [ 228.838245][T12106] macsec0: entered allmulticast mode [ 228.860097][T12110] __nla_validate_parse: 6 callbacks suppressed [ 228.860120][T12110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1694'. [ 228.877715][T12106] veth1_macvtap: entered allmulticast mode [ 228.899592][T12106] bridge0: port 1(macsec0) entered blocking state [ 228.906415][T12106] bridge0: port 1(macsec0) entered listening state [ 229.054172][T12120] unsupported nla_type 33542 [ 229.170145][T12128] xt_hashlimit: size too large, truncated to 1048576 [ 229.215341][T12131] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1700'. [ 229.371799][T12139] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1704'. [ 229.459658][T12139] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 229.664832][T12150] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1702'. [ 229.686256][T12161] x_tables: duplicate underflow at hook 1 [ 229.905770][T12164] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 230.121382][T12182] netlink: 'syz.3.1716': attribute type 21 has an invalid length. [ 230.262884][T12195] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1717'. [ 230.735140][T12213] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 230.970770][T12235] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1723'. [ 231.022639][T12237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1723'. [ 231.107680][T12248] netlink: 'syz.3.1725': attribute type 14 has an invalid length. [ 231.398014][T12263] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.508533][T12265] sctp: [Deprecated]: syz.0.1730 (pid 12265) Use of int in maxseg socket option. [ 231.508533][T12265] Use struct sctp_assoc_value instead [ 232.004678][T12287] netlink: 'syz.3.1736': attribute type 1 has an invalid length. [ 232.021326][T12289] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1738'. [ 232.107801][T12295] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1739'. [ 232.187276][T12301] netlink: 'syz.2.1739': attribute type 10 has an invalid length. [ 232.228285][T12301] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1739'. [ 232.292526][T12301] team0: Port device geneve0 added [ 232.441892][T12311] xt_addrtype: ipv6 does not support BROADCAST matching [ 232.451609][T12310] xt_addrtype: ipv6 does not support BROADCAST matching [ 232.534332][T12317] netlink: 'syz.3.1746': attribute type 1 has an invalid length. [ 232.552722][T12317] netlink: 'syz.3.1746': attribute type 1 has an invalid length. [ 232.839948][T12342] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 232.853514][T12340] netlink: 'syz.1.1752': attribute type 1 has an invalid length. [ 232.863306][T12340] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 233.076950][T12357] syzkaller1: entered promiscuous mode [ 233.101338][T12357] syzkaller1: entered allmulticast mode [ 233.235979][T12363] bond1: (slave lo): Releasing backup interface [ 233.260811][T12363] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 233.382279][T12363] bridge_slave_0: left promiscuous mode [ 233.388472][T12363] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.561294][T12363] bridge_slave_1: left allmulticast mode [ 233.643220][T12385] netlink: 'syz.3.1765': attribute type 8 has an invalid length. [ 233.672001][T12363] bridge_slave_1: left promiscuous mode [ 233.679692][T12363] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.766012][T12363] bond0: (slave bond_slave_0): Releasing backup interface [ 233.788574][T12363] bond0: (slave bond_slave_1): Releasing backup interface [ 233.809663][T12363] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 233.817583][T12363] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 233.925044][T12363] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 233.932923][T12363] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 233.959878][T12363] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 233.995125][T12380] vcan0: entered allmulticast mode [ 234.134299][T12400] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 234.211136][T12400] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1767'. [ 234.230699][T12405] tipc: Enabled bearer , priority 0 [ 234.262867][T12405] syzkaller0: entered promiscuous mode [ 234.268409][T12405] syzkaller0: entered allmulticast mode [ 234.334241][T12416] netlink: 'syz.0.1767': attribute type 11 has an invalid length. [ 234.342862][T12416] netlink: 182072 bytes leftover after parsing attributes in process `syz.0.1767'. [ 234.353891][T12414] tc_dump_action: action bad kind [ 234.363308][T12414] syzkaller0: entered promiscuous mode [ 234.368836][T12414] syzkaller0: entered allmulticast mode [ 234.395062][T12404] tipc: Resetting bearer [ 234.463539][T12404] tipc: Disabling bearer [ 235.119905][T12420] netlink: 'syz.0.1772': attribute type 1 has an invalid length. [ 235.128867][T12420] netlink: 'syz.0.1772': attribute type 11 has an invalid length. [ 235.137130][T12420] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1772'. [ 235.281633][T12435] tipc: Enabled bearer , priority 0 [ 235.314963][T12435] syzkaller0: left promiscuous mode [ 235.323261][T12439] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1777'. [ 235.325221][T12435] syzkaller0: left allmulticast mode [ 235.393818][T12444] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1779'. [ 235.497795][T12450] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1782'. [ 235.724503][T12461] openvswitch: netlink: Missing valid actions attribute. [ 235.740065][T12461] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 235.886040][T12463] openvswitch: netlink: IP tunnel dst address not specified [ 235.896629][T12463] netlink: 260 bytes leftover after parsing attributes in process `syz.4.1786'. [ 236.302570][T12493] netlink: 'syz.0.1792': attribute type 10 has an invalid length. [ 236.328591][T12493] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1792'. [ 236.354280][T12493] 8021q: adding VLAN 0 to HW filter on device team0 [ 236.457790][T12502] tipc: Enabling of bearer rejected, failed to enable media [ 237.228103][T12531] netlink: 'syz.1.1807': attribute type 2 has an invalid length. [ 237.238777][T12531] netlink: 119 bytes leftover after parsing attributes in process `syz.1.1807'. [ 237.678968][T12551] pim6reg1: entered promiscuous mode [ 237.704478][T12551] pim6reg1: entered allmulticast mode [ 237.751405][T12558] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1814'. [ 237.839491][ T30] audit: type=1800 audit(1767110607.845:2): pid=12561 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1815" name="memory.events" dev="tmpfs" ino=2023 res=0 errno=0 [ 237.966985][T12567] netlink: 'syz.3.1817': attribute type 1 has an invalid length. [ 238.294529][T12590] openvswitch: netlink: Flow key attr not present in new flow. [ 238.552525][T12610] sctp: [Deprecated]: syz.2.1829 (pid 12610) Use of int in maxseg socket option. [ 238.552525][T12610] Use struct sctp_assoc_value instead [ 238.848251][T12638] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 239.121090][T12658] x_tables: unsorted entry at hook 1 [ 239.741343][T12697] IPVS: set_ctl: invalid protocol: 47 224.0.0.1:20000 [ 239.755719][T12697] IPVS: Unknown mcast interface: vcan0 [ 239.768559][T12699] __nla_validate_parse: 9 callbacks suppressed [ 239.768579][T12699] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1853'. [ 239.786114][T12699] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1853'. [ 239.795669][T12697] netlink: 'syz.0.1855': attribute type 3 has an invalid length. [ 239.805018][T12697] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1855'. [ 239.830771][T12699] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.1853'. [ 239.841912][T12699] TCP: TCP_TX_DELAY enabled [ 239.847889][T12699] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1853'. [ 239.992781][T12712] geneve2: entered promiscuous mode [ 240.009992][T12712] geneve2: entered allmulticast mode [ 240.031428][ T37] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 19999 - 0 [ 240.044967][T12712] netlink: 'syz.1.1858': attribute type 13 has an invalid length. [ 240.064270][ T37] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 19999 - 0 [ 240.084385][T12712] macvtap0: entered allmulticast mode [ 240.100978][T12712] macvtap0: refused to change device tx_queue_len [ 240.121572][ T37] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 19999 - 0 [ 240.146425][T12720] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 240.718636][T12762] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 241.077339][T12778] netlink: 'syz.1.1874': attribute type 11 has an invalid length. [ 241.295598][T12791] sit0: Caught tx_queue_len zero misconfig [ 241.321641][T12791] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1878'. [ 241.335770][T12791] netlink: 'syz.1.1878': attribute type 9 has an invalid length. [ 241.448830][T12803] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 241.951625][T12842] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 242.268887][T12850] tipc: Started in network mode [ 242.274464][T12850] tipc: Node identity 0a36f2555e93, cluster identity 4711 [ 242.284167][T12850] tipc: Enabled bearer , priority 0 [ 242.362224][T12850] syzkaller0: entered promiscuous mode [ 242.367889][T12850] syzkaller0: entered allmulticast mode [ 242.374326][T12850] tipc: Resetting bearer [ 242.413777][T12866] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1898'. [ 242.424400][T12849] tipc: Resetting bearer [ 242.433326][T12867] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1898'. [ 243.887213][T12849] tipc: Disabling bearer [ 243.898998][T12869] mac80211_hwsim hwsim7 wlan1: Caught tx_queue_len zero misconfig [ 244.076059][T12885] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1905'. [ 244.092504][ T10] tipc: Node number set to 1420161621 [ 244.103516][T12888] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1904'. [ 244.435479][T12911] netlink: 'syz.3.1910': attribute type 1 has an invalid length. [ 244.695772][ T12] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 244.722256][ T12] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 244.734252][ T12] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 244.743318][ T12] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 244.743329][T12931] openvswitch: netlink: VXLAN extension 30 out of range max 1 [ 244.744841][T12932] xt_hashlimit: max too large, truncated to 1048576 [ 244.787894][T12930] __nla_validate_parse: 9 callbacks suppressed [ 244.787916][T12930] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.1921'. [ 244.830424][T12932] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1917'. [ 244.843230][T12931] bond6: option mode: invalid value (133) [ 244.887683][T12931] bond6 (unregistering): Released all slaves [ 244.988972][T12941] bond6: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 245.010918][T12941] bond6 (unregistering): Released all slaves [ 245.080739][T12949] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1918'. [ 245.165780][T12951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1924'. [ 245.174837][T12951] netlink: 'syz.1.1924': attribute type 5 has an invalid length. [ 245.183134][T12951] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1924'. [ 245.285447][T12960] netlink: 'syz.1.1927': attribute type 2 has an invalid length. [ 245.307828][T12960] netlink: 'syz.1.1927': attribute type 1 has an invalid length. [ 245.486284][T12955] netlink: 240 bytes leftover after parsing attributes in process `syz.0.1925'. [ 245.832708][T13018] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1933'. [ 245.913723][T13023] net veth1_virt_wifi .: renamed from virt_wifi0 [ 246.103714][T13035] team0: No ports can be present during mode change [ 246.327576][T13051] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1940'. [ 246.373855][T13051] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1940'. [ 246.705452][T13068] bond5: entered promiscuous mode [ 246.717892][T13068] bond5: entered allmulticast mode [ 246.728769][T13068] 8021q: adding VLAN 0 to HW filter on device bond5 [ 246.972773][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 30 seconds [ 247.237265][T13106] netlink: 'syz.2.1955': attribute type 9 has an invalid length. [ 247.270527][T13106] netlink: 'syz.2.1955': attribute type 11 has an invalid length. [ 247.278424][T13106] netlink: 'syz.2.1955': attribute type 12 has an invalid length. [ 247.308723][T13106] netlink: 210020 bytes leftover after parsing attributes in process `syz.2.1955'. [ 247.445168][T13120] sctp: [Deprecated]: syz.4.1957 (pid 13120) Use of struct sctp_assoc_value in delayed_ack socket option. [ 247.445168][T13120] Use struct sctp_sack_info instead [ 247.790406][T13135] netlink: 'syz.2.1962': attribute type 1 has an invalid length. [ 247.886549][T13135] bond6: entered promiscuous mode [ 247.898719][T13135] 8021q: adding VLAN 0 to HW filter on device bond6 [ 247.945211][T13147] bond6: (slave bridge5): making interface the new active one [ 247.953803][T13147] bridge5: entered promiscuous mode [ 247.961606][T13147] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 248.114699][T13161] vlan4: entered promiscuous mode [ 248.137704][T13161] erspan0: entered promiscuous mode [ 248.205518][T13166] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 248.242325][T13168] netlink: 'syz.3.1971': attribute type 4 has an invalid length. [ 248.253205][T13168] xt_l2tp: v2 sid > 0xffff: 1114112 [ 248.436587][T13171] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 248.505315][T13171] team1: entered promiscuous mode [ 248.519354][T13171] team1: entered allmulticast mode [ 248.656383][T13184] vxcan2: entered allmulticast mode [ 249.665281][T13252] netlink: 'syz.3.1992': attribute type 14 has an invalid length. [ 249.775824][T13256] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.819986][T13256] __nla_validate_parse: 9 callbacks suppressed [ 249.820008][T13256] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1995'. [ 249.878936][T13253] bond7: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 249.900342][T13253] bond7 (unregistering): Released all slaves [ 249.908126][T13264] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1996'. [ 250.019030][T13260] openvswitch: netlink: Flow key attr not present in new flow. [ 250.086799][T13264] bond11: (slave bridge8): Enslaving as an active interface with an up link [ 250.203236][T13282] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 250.223696][T13280] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2000'. [ 250.247803][T13282] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1999'. [ 250.342993][T13286] xt_hashlimit: size too large, truncated to 1048576 [ 250.345348][T13282] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 250.395377][T13290] 8021q: VLANs not supported on ip6tnl0 [ 250.600700][T13296] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2005'. [ 250.759337][T13299] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2006'. [ 250.792361][T13301] xt_hashlimit: size too large, truncated to 1048576 [ 251.101721][T13322] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2009'. [ 251.126801][T13323] ipt_REJECT: TCP_RESET invalid for non-tcp [ 251.396361][T13328] veth6: entered promiscuous mode [ 251.419559][T13328] veth6: entered allmulticast mode [ 251.561859][T13341] netlink: 'syz.1.2018': attribute type 7 has an invalid length. [ 251.654017][T13344] netlink: 'syz.2.2021': attribute type 11 has an invalid length. [ 251.852386][T13349] netlink: 'syz.2.2022': attribute type 39 has an invalid length. [ 252.166050][T13361] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 252.341359][T13370] netlink: 'syz.0.2028': attribute type 83 has an invalid length. [ 252.460033][T13376] netlink: 294 bytes leftover after parsing attributes in process `syz.2.2029'. [ 252.491893][T13376] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.643593][T13387] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.689669][T13387] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.712707][T13387] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.879690][T13397] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2034'. [ 252.988783][T13396] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2035'. [ 253.195391][T13417] netlink: 'syz.3.2040': attribute type 1 has an invalid length. [ 253.241246][T13417] 8021q: adding VLAN 0 to HW filter on device bond6 [ 253.272960][T13422] bond6: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 253.312371][T13422] bond6: entered allmulticast mode [ 253.336415][T13417] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 253.350717][T13422] netlink: 'syz.3.2040': attribute type 1 has an invalid length. [ 253.364511][T13422] bond6: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 253.465832][T13438] xt_hashlimit: size too large, truncated to 1048576 [ 253.532737][T13428] sctp: [Deprecated]: syz.4.2042 (pid 13428) Use of int in max_burst socket option. [ 253.532737][T13428] Use struct sctp_assoc_value instead [ 253.640339][T13452] netlink: 'syz.3.2049': attribute type 1 has an invalid length. [ 253.746699][T13456] syzkaller0: entered promiscuous mode [ 253.757834][T13456] syzkaller0: entered allmulticast mode [ 253.804727][T13456] : entered promiscuous mode [ 254.172822][T13483] netlink: 'syz.0.2058': attribute type 11 has an invalid length. [ 254.345406][T13492] netlink: 'syz.2.2059': attribute type 8 has an invalid length. [ 254.526853][T13500] syzkaller1: entered promiscuous mode [ 254.532772][T13500] syzkaller1: entered allmulticast mode [ 254.548336][T13500] netlink: 'syz.2.2062': attribute type 6 has an invalid length. [ 254.566725][T13503] netlink: 'syz.3.2064': attribute type 26 has an invalid length. [ 254.777635][T13515] syzkaller0: entered promiscuous mode [ 254.784891][T13515] syzkaller0: entered allmulticast mode [ 254.796361][T13515] tipc: Enabled bearer , priority 0 [ 254.808977][T13512] tipc: Resetting bearer [ 254.841476][T13512] tipc: Disabling bearer [ 254.882231][T13523] syzkaller1: entered promiscuous mode [ 254.888545][T13523] syzkaller1: entered allmulticast mode [ 255.101505][T13541] __nla_validate_parse: 7 callbacks suppressed [ 255.101526][T13541] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2070'. [ 255.277427][T13552] netlink: 'syz.0.2076': attribute type 1 has an invalid length. [ 255.285942][T13552] netlink: 'syz.0.2076': attribute type 2 has an invalid length. [ 255.435457][T13560] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 255.479773][T13560] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 255.488762][T13560] gretap3: entered promiscuous mode [ 255.494828][T13560] gretap3: entered allmulticast mode [ 255.609054][T13567] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2080'. [ 255.647604][T13568] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 255.678702][T13568] bond3: (slave lo): Enslaving as a backup interface with an up link [ 255.694545][T13568] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 255.732203][T13573] sock: sock_timestamping_bind_phc: sock not bind to device [ 255.831005][T13576] netlink: 'syz.4.2081': attribute type 1 has an invalid length. [ 255.898765][T13576] bond3: entered promiscuous mode [ 255.906760][T13576] 8021q: adding VLAN 0 to HW filter on device bond3 [ 256.008729][T13594] netlink: 'syz.4.2081': attribute type 1 has an invalid length. [ 256.102087][T13576] bond3: (slave bridge2): making interface the new active one [ 256.110349][T13576] bridge2: entered promiscuous mode [ 256.117310][T13576] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 256.760770][T13634] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2096'. [ 256.863638][T13641] xt_TCPMSS: Only works on TCP SYN packets [ 256.916718][T13644] bond13: entered promiscuous mode [ 256.922303][T13644] bond13: entered allmulticast mode [ 256.946212][T13644] 8021q: adding VLAN 0 to HW filter on device bond13 [ 257.006035][T13658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2099'. [ 257.275093][T13666] geneve2: entered promiscuous mode [ 257.299028][T13666] geneve2: entered allmulticast mode [ 257.343958][ T3546] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 257.361326][ T3546] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 257.393169][ T3546] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 257.503539][T13677] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2104'. [ 257.523880][T13679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2103'. [ 257.539529][T13679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2103'. [ 257.549012][T13679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2103'. [ 257.616678][T13686] netlink: 'syz.2.2105': attribute type 5 has an invalid length. [ 257.638441][ T3546] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 257.689048][T13681] sit1: entered promiscuous mode [ 257.695589][T13681] sit1: entered allmulticast mode [ 257.908317][T13696] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2109'. [ 258.087296][T13712] netlink: 'syz.0.2112': attribute type 1 has an invalid length. [ 258.237630][T13716] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2113'. [ 258.390845][T13729] ipt_ECN: cannot use operation on non-tcp rule [ 259.130704][ C0] bridge0: port 1(macsec0) entered learning state [ 259.410190][T13794] lo: MTU too low for tipc bearer [ 259.415391][T13794] tipc: Enabling of bearer rejected, failed to enable media [ 259.516117][T13798] netlink: 'syz.4.2121': attribute type 15 has an invalid length. [ 259.526690][T13798] syzkaller1: entered promiscuous mode [ 259.532957][T13798] syzkaller1: entered allmulticast mode [ 259.651026][T13808] x_tables: duplicate entry at hook 1 [ 259.688056][T13810] x_tables: duplicate underflow at hook 2 [ 260.760435][T13850] __nla_validate_parse: 15 callbacks suppressed [ 260.760456][T13850] netlink: 596 bytes leftover after parsing attributes in process `syz.3.2153'. [ 260.780341][T13853] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2151'. [ 260.831203][T13853] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.2151'. [ 261.058197][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.173309][T13868] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2158'. [ 261.205915][T13868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2158'. [ 261.362992][T13879] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2162'. [ 261.372013][T13881] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2163'. [ 261.372494][T13881] netlink: 'syz.1.2163': attribute type 1 has an invalid length. [ 261.395572][T13881] netlink: 'syz.1.2163': attribute type 2 has an invalid length. [ 261.758729][T13911] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2170'. [ 262.013790][T13929] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2174'. [ 262.548186][T13949] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2180'. [ 263.250397][T13989] sock: sock_set_timeout: `syz.0.2192' (pid 13989) tries to set negative timeout [ 263.979587][T14025] net veth1_virt_wifi .: renamed from virt_wifi0 [ 264.002926][T14028] ip6t_srh: unknown srh match flags 5F28 [ 264.241486][T14044] xt_socket: unknown flags 0x50 [ 264.253199][T14044] IPVS: ip_vs_add_dest(): server weight less than zero [ 265.126428][T14097] bridge_slave_0: invalid flags given to default FDB implementation [ 265.148804][T14097] lo speed is unknown, defaulting to 1000 [ 265.167564][T14097] lo speed is unknown, defaulting to 1000 [ 265.185800][T14097] lo speed is unknown, defaulting to 1000 [ 265.534859][T14097] infiniband syz2: set active [ 265.539889][T14097] infiniband syz2: added lo [ 265.547037][T12976] lo speed is unknown, defaulting to 1000 [ 265.590601][T14097] RDS/IB: syz2: added [ 265.594977][T14097] smc: adding ib device syz2 with port count 1 [ 265.601382][T14097] smc: ib device syz2 port 1 has no pnetid [ 265.726041][T12976] lo speed is unknown, defaulting to 1000 [ 265.738925][T14097] lo speed is unknown, defaulting to 1000 [ 265.899801][T14118] netlink: 'syz.1.2218': attribute type 1 has an invalid length. [ 266.102811][T14097] lo speed is unknown, defaulting to 1000 [ 266.143948][T14129] IPVS: set_ctl: invalid protocol: 92 0.0.0.0:2069 [ 266.163678][T14129] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 266.402286][T14142] xt_l2tp: unknown flags: 10 [ 266.463986][T14148] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 266.602479][T14153] netlink: 'syz.0.2227': attribute type 21 has an invalid length. [ 266.616396][T14153] __nla_validate_parse: 6 callbacks suppressed [ 266.616414][T14153] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2227'. [ 266.644472][T14097] lo speed is unknown, defaulting to 1000 [ 266.819035][T14161] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2231'. [ 266.862869][T14161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2231'. [ 266.884668][T14161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2231'. [ 266.906843][T14161] netlink: 'syz.3.2231': attribute type 3 has an invalid length. [ 267.061788][T14166] openvswitch: netlink: Flow key attribute not present in set flow. [ 267.178202][T14097] lo speed is unknown, defaulting to 1000 [ 267.220347][T14173] syzkaller0: entered promiscuous mode [ 267.235377][T14173] syzkaller0: entered allmulticast mode [ 267.520663][T14097] lo speed is unknown, defaulting to 1000 [ 267.898340][T14097] lo speed is unknown, defaulting to 1000 [ 268.286502][T14097] lo speed is unknown, defaulting to 1000 [ 269.003178][T14212] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2249'. [ 269.136724][T14214] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2250'. [ 269.146214][T14214] tipc: Invalid UDP bearer configuration [ 269.146275][T14214] tipc: Enabling of bearer rejected, failed to enable media [ 269.426883][T14223] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 269.695745][T14229] IPVS: set_ctl: invalid protocol: 47 172.20.20.39:20004 [ 269.754605][T14238] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2257'. [ 270.042465][T14253] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2263'. [ 270.095957][T14253] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2263'. [ 270.173191][T14253] vcan0 (unregistering): left allmulticast mode [ 270.263167][T14263] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 270.296610][T14254] lo speed is unknown, defaulting to 1000 [ 270.463034][T14274] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2267'. [ 270.509323][T14277] x_tables: unsorted underflow at hook 1 [ 270.971346][T14299] netlink: 'syz.1.2272': attribute type 32 has an invalid length. [ 271.153812][T14303] netlink: 'syz.2.2273': attribute type 1 has an invalid length. [ 271.162386][T14303] netlink: 'syz.2.2273': attribute type 2 has an invalid length. [ 271.190064][T14303] netlink: 'syz.2.2273': attribute type 1 has an invalid length. [ 271.203896][T14303] netlink: 'syz.2.2273': attribute type 3 has an invalid length. [ 271.964317][T14338] syzkaller0: entered promiscuous mode [ 271.981044][T14338] syzkaller0: entered allmulticast mode [ 272.259313][T14346] tipc: Enabling of bearer rejected, failed to enable media [ 272.385268][T14349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.416800][T14354] __nla_validate_parse: 3 callbacks suppressed [ 272.416819][T14354] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2285'. [ 272.510335][T14358] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2285'. [ 272.531167][T14356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2286'. [ 272.549998][T14356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2286'. [ 272.626615][T14360] openvswitch: netlink: Message has 592 unknown bytes. [ 272.652636][T14360] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.922215][T14379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2293'. [ 273.035535][T14381] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2294'. [ 273.095530][T14388] netlink: 'syz.1.2296': attribute type 39 has an invalid length. [ 273.275587][T14395] netlink: 'syz.2.2300': attribute type 1 has an invalid length. [ 273.404846][T14404] lo speed is unknown, defaulting to 1000 [ 273.495818][T14413] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2303'. [ 273.561648][T14413] erspan0: entered promiscuous mode [ 273.798103][T14429] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 273.805939][T14429] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 273.831839][T14428] tipc: Enabled bearer , priority 0 [ 273.945608][T14432] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2308'. [ 274.079027][T14438] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2309'. [ 274.763872][T14461] netlink: 184 bytes leftover after parsing attributes in process `syz.0.2313'. [ 274.832756][ T5983] tipc: Node number set to 2114358959 [ 275.447239][T14495] netlink: 'syz.0.2318': attribute type 1 has an invalid length. [ 275.593703][T14505] lo speed is unknown, defaulting to 1000 [ 276.456634][T14540] netlink: 'syz.2.2331': attribute type 1 has an invalid length. [ 276.721122][T14542] bond7: (slave ip6gretap1): making interface the new active one [ 276.755927][T14542] bond7: (slave ip6gretap1): Enslaving as an active interface with an up link [ 276.976397][T14558] netlink: 'syz.1.2338': attribute type 39 has an invalid length. [ 277.032318][T14562] tipc: Enabled bearer , priority 13 [ 277.050134][T14562] x_tables: duplicate underflow at hook 2 [ 277.050235][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 60 seconds [ 277.074830][T14562] xt_CT: You must specify a L4 protocol and not use inversions on it [ 277.284154][T14568] lo speed is unknown, defaulting to 1000 [ 277.489504][T14584] __nla_validate_parse: 7 callbacks suppressed [ 277.489525][T14584] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2344'. [ 277.626206][T14575] netlink: 179596 bytes leftover after parsing attributes in process `syz.0.2344'. [ 277.828968][T14599] netlink: 656 bytes leftover after parsing attributes in process `syz.2.2351'. [ 277.854842][T14600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2352'. [ 277.965450][T14605] netlink: 830 bytes leftover after parsing attributes in process `syz.2.2353'. [ 278.040730][ T5920] tipc: Node number set to 392762667 [ 278.298776][T14617] bond9: option arp_interval: invalid value (18446744072484814856) [ 278.310482][T14617] bond9: option arp_interval: allowed values 0 - 2147483647 [ 278.332944][T14617] bond9 (unregistering): Released all slaves [ 278.377431][T14622] bridge9: entered promiscuous mode [ 278.385118][T14622] bridge9: entered allmulticast mode [ 278.512672][T14624] bridge10: entered promiscuous mode [ 278.528664][T14624] bridge10: entered allmulticast mode [ 278.662580][ T5841] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 278.677136][ T5841] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 278.702896][ T5841] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 278.714478][ T5841] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 278.731858][ T5841] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 278.765462][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 278.773148][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 278.780897][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 278.789008][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 278.798012][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 278.958568][T14640] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2362'. [ 279.045088][T14640] vcan0 (unregistering): left allmulticast mode [ 279.118475][T14629] lo speed is unknown, defaulting to 1000 [ 279.247060][T14648] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 279.305965][T14650] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2365'. [ 279.722150][T14665] ipvlan2: entered allmulticast mode [ 279.727519][T14665] batadv_slave_1: entered allmulticast mode [ 279.737226][T14665] batman_adv: batadv0: Adding interface: ipvlan2 [ 279.744887][T14665] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.820843][T14665] batman_adv: batadv0: Interface activated: ipvlan2 [ 280.143164][T14685] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2374'. [ 280.204839][T14685] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2374'. [ 280.418868][T14700] netlink: 'syz.0.2378': attribute type 1 has an invalid length. [ 280.436150][T14629] chnl_net:caif_netlink_parms(): no params data found [ 280.461274][T14700] syzkaller1: entered promiscuous mode [ 280.469995][T14700] syzkaller1: entered allmulticast mode [ 280.528370][T14700] syzkaller1: left promiscuous mode [ 280.535883][T14700] syzkaller1: left allmulticast mode [ 280.659852][T14709] macvlan0: entered promiscuous mode [ 280.889930][ T52] Bluetooth: hci5: command tx timeout [ 280.981399][T14629] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.009915][T14629] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.029452][T14629] bridge_slave_0: entered allmulticast mode [ 281.047991][T14629] bridge_slave_0: entered promiscuous mode [ 281.062453][T14629] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.079042][T14629] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.101379][T14733] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2384'. [ 281.103520][T14629] bridge_slave_1: entered allmulticast mode [ 281.132792][T14629] bridge_slave_1: entered promiscuous mode [ 281.152181][T14711] lo speed is unknown, defaulting to 1000 [ 281.283146][T14629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 281.312969][T14629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.429395][T14629] team0: Port device team_slave_0 added [ 281.449046][T14629] team0: Port device team_slave_1 added [ 281.565414][T14629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 281.575615][T14629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.616000][T14629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 281.634347][T14746] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 281.675282][T14742] syzkaller0: entered promiscuous mode [ 281.681689][T14742] syzkaller0: entered allmulticast mode [ 281.695849][T14629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 281.716711][T14629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 281.778548][T14749] Unsupported ieee802154 address type: 0 [ 281.791316][T14629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 281.820316][T14749] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 281.928040][T14755] nbd: nbd1 already in use [ 281.933519][T14755] block nbd1: NBD_DISCONNECT [ 281.938372][T14755] block nbd1: Send disconnect failed -32 [ 281.947244][T14755] block nbd1: shutting down sockets [ 282.971877][ T52] Bluetooth: hci5: command tx timeout [ 283.681792][T14753] : entered promiscuous mode [ 283.953698][T14629] hsr_slave_0: entered promiscuous mode [ 283.963142][T14629] hsr_slave_1: entered promiscuous mode [ 283.969883][T14629] debugfs: 'hsr0' already exists in 'hsr' [ 283.975876][T14629] Cannot create hsr debugfs directory [ 284.516524][T14808] bond9: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 284.533374][T14808] bond9 (unregistering): Released all slaves [ 284.596154][T14810] __nla_validate_parse: 1 callbacks suppressed [ 284.596174][T14810] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2404'. [ 284.676680][T14808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2404'. [ 284.711807][T14808] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2404'. [ 284.914314][T14629] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 284.956107][T14629] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 284.992949][T14629] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 285.019033][T14629] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 285.049578][ T52] Bluetooth: hci5: command tx timeout [ 285.061220][T14830] netlink: 'syz.3.2411': attribute type 2 has an invalid length. [ 285.079247][T14830] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2411'. [ 285.207745][T14840] netlink: 'syz.0.2413': attribute type 13 has an invalid length. [ 285.228524][T14840] erspan0: refused to change device tx_queue_len [ 285.237657][T14840] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 285.315484][T14629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 285.387739][T14629] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.412945][T14850] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2415'. [ 285.467877][ T987] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.475571][ T987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 285.484456][T14855] netlink: 'syz.0.2416': attribute type 3 has an invalid length. [ 285.496404][T14855] netlink: 666 bytes leftover after parsing attributes in process `syz.0.2416'. [ 285.521492][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.528773][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 285.648880][T14859] syzkaller0: entered promiscuous mode [ 285.657406][T14859] syzkaller0: entered allmulticast mode [ 285.957845][T14872] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2422'. [ 285.984867][T14872] tc_dump_action: action bad kind [ 286.008127][T14869] lo speed is unknown, defaulting to 1000 [ 286.008153][T14872] xt_socket: unknown flags 0x50 [ 286.021745][T14878] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 286.036766][T14878] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 286.197334][T14886] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 286.323131][T14890] netlink: 'syz.3.2425': attribute type 1 has an invalid length. [ 286.328644][T14629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 286.366769][T14890] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2425'. [ 287.129516][ T52] Bluetooth: hci5: command tx timeout [ 287.248534][T14629] veth0_vlan: entered promiscuous mode [ 287.291757][T14929] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2431'. [ 287.325296][T14629] veth1_vlan: entered promiscuous mode [ 287.427320][T14936] netlink: 'syz.1.2433': attribute type 7 has an invalid length. [ 287.437122][T14936] netlink: 140 bytes leftover after parsing attributes in process `syz.1.2433'. [ 287.453656][T14629] veth0_macvtap: entered promiscuous mode [ 287.462960][T14937] netlink: 'syz.2.2432': attribute type 1 has an invalid length. [ 287.496754][T14629] veth1_macvtap: entered promiscuous mode [ 287.628013][T14938] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 287.642128][T14938] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 287.712728][T14629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 287.849509][T14629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 287.890089][ T3531] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.911972][ T3531] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.931165][ T3531] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.065633][ T3531] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.321694][ T6176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 288.336549][ T6176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 288.561459][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 288.576909][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 288.775242][ T5930] lo speed is unknown, defaulting to 1000 [ 289.209188][ C0] bridge0: port 1(macsec0) entered forwarding state [ 289.215900][ C0] bridge0: topology change detected, propagating [ 289.391895][T15007] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 289.431572][T15007] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 289.445446][T15007] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 289.460880][T15007] gretap2: entered promiscuous mode [ 289.473925][T15007] gretap2: entered allmulticast mode [ 289.601576][T15015] lo speed is unknown, defaulting to 1000 [ 289.639389][T15018] netlink: 'syz.5.2458': attribute type 1 has an invalid length. [ 289.676145][T15023] netlink: 'syz.3.2459': attribute type 1 has an invalid length. [ 289.770653][T15023] 8021q: adding VLAN 0 to HW filter on device bond7 [ 289.798802][T15028] syzkaller1: entered promiscuous mode [ 289.807164][T15028] syzkaller1: entered allmulticast mode [ 289.815956][T15029] __nla_validate_parse: 7 callbacks suppressed [ 289.815972][T15029] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2461'. [ 289.915703][T15032] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2462'. [ 290.198989][T15045] xt_l2tp: v2 doesn't support IP mode [ 290.554727][T15052] netlink: 'syz.0.2467': attribute type 1 has an invalid length. [ 290.870684][T15071] veth1_to_bond: entered allmulticast mode [ 290.978441][T15068] veth1_to_bond: left allmulticast mode [ 291.345457][T15096] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2478'. [ 291.373204][T15096] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 291.464309][T15098] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 291.516811][T15104] vlan2: entered promiscuous mode [ 291.539141][T15104] bridge0: entered promiscuous mode [ 291.827745][T15119] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2488'. [ 291.866823][T15119] netlink: 'syz.5.2488': attribute type 21 has an invalid length. [ 291.883163][T15119] netlink: 14 bytes leftover after parsing attributes in process `syz.5.2488'. [ 292.208151][T15134] veth13: entered allmulticast mode [ 292.543878][T15155] lo speed is unknown, defaulting to 1000 [ 292.721673][T15163] netlink: 220 bytes leftover after parsing attributes in process `syz.0.2504'. [ 292.810669][ T6215] tipc: Subscription rejected, illegal request [ 293.303562][T15178] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2506'. [ 293.810359][T15205] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2512'. [ 293.819502][T15205] openvswitch: netlink: Key type 8529 is out of range max 32 [ 293.863927][T15209] netlink: 13 bytes leftover after parsing attributes in process `syz.0.2515'. [ 294.027597][T15217] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2518'. [ 294.169002][T15225] netlink: 'syz.5.2520': attribute type 5 has an invalid length. [ 294.318209][T15230] netlink: 'syz.0.2522': attribute type 1 has an invalid length. [ 294.339858][T15232] tipc: Resetting bearer [ 294.346014][T15232] tipc: Resetting bearer [ 294.589444][T15239] netlink: 'syz.1.2526': attribute type 1 has an invalid length. [ 294.785356][T15234] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 294.802794][T15234] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 294.891111][T15234] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 294.915262][T15234] gretap1: left promiscuous mode [ 294.924153][T15234] macvtap1: left promiscuous mode [ 294.938171][T15234] veth1_vlan: left allmulticast mode [ 294.944081][T15234] veth1_vlan: left promiscuous mode [ 294.950310][T15234] macvtap2: left promiscuous mode [ 294.962229][T15234] gtp0: left promiscuous mode [ 295.037807][T15239] 8021q: adding VLAN 0 to HW filter on device bond9 [ 295.096637][T15243] bond9: (slave veth11): Enslaving as an active interface with a down link [ 295.137769][T15244] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 295.148797][ T6176] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.197861][ T6176] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 295.257140][ T6176] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.277246][T15259] __nla_validate_parse: 2 callbacks suppressed [ 295.277265][T15259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2532'. [ 295.279343][ T6176] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 295.309921][ T6176] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.321589][ T6176] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 295.334848][ T6176] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.340899][T15259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2532'. [ 295.345309][ T6176] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 295.420530][T15265] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 295.656353][T15277] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2539'. [ 295.827552][T15286] netlink: 'syz.0.2542': attribute type 1 has an invalid length. [ 295.838271][T15286] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2542'. [ 295.940399][T15287] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2544'. [ 296.101407][T15302] netlink: 'syz.0.2547': attribute type 1 has an invalid length. [ 296.118877][T15306] netlink: 80 bytes leftover after parsing attributes in process `syz.5.2548'. [ 297.006756][T15358] netlink: 'syz.0.2555': attribute type 1 has an invalid length. [ 297.069529][T15364] netem: change failed [ 297.220590][T15372] tipc: Started in network mode [ 297.225529][T15372] tipc: Node identity , cluster identity 4711 [ 297.243259][T15372] tipc: Failed to set node id, please configure manually [ 297.254017][T15372] tipc: Enabling of bearer rejected, failed to enable media [ 297.483161][T15390] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2565'. [ 297.494217][T15391] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2565'. [ 297.632981][T15390] 8021q: adding VLAN 0 to HW filter on device bond1 [ 297.656650][T15391] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 298.136893][T15434] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2580'. [ 298.188434][T15432] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2579'. [ 298.299786][T15442] netlink: 'syz.0.2581': attribute type 16 has an invalid length. [ 298.326042][T15442] netlink: 'syz.0.2581': attribute type 17 has an invalid length. [ 298.343168][T15445] x_tables: duplicate underflow at hook 2 [ 298.406144][T15446] nbd: must specify at least one socket [ 298.646478][T15442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 298.668472][T15462] netlink: 'syz.2.2587': attribute type 24 has an invalid length. [ 298.730460][T15442] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 298.780748][T15465] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 298.942693][T15465] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 299.273743][T15493] netlink: 'syz.3.2596': attribute type 21 has an invalid length. [ 299.297154][T15493] IPv6: NLM_F_CREATE should be specified when creating new route [ 299.777442][T15526] veth0_to_team: entered promiscuous mode [ 299.927415][T15539] netlink: 'syz.3.2611': attribute type 29 has an invalid length. [ 299.974101][T15539] netlink: 'syz.3.2611': attribute type 29 has an invalid length. [ 300.332472][T15557] __nla_validate_parse: 9 callbacks suppressed [ 300.332496][T15557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2616'. [ 300.396613][ T5841] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 300.412680][ T5841] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 300.423426][ T5841] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 300.433031][ T5841] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 300.443138][ T5841] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 300.710222][T15560] lo speed is unknown, defaulting to 1000 [ 300.807255][T15563] sit2: entered promiscuous mode [ 300.817077][T15563] sit2: entered allmulticast mode [ 300.967242][T15571] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2622'. [ 301.019980][T15575] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 301.039492][T15576] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2622'. [ 301.077521][T15582] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2626'. [ 301.389768][T15595] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2629'. [ 301.415059][T15595] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2629'. [ 301.438263][T15595] netlink: 'syz.2.2629': attribute type 5 has an invalid length. [ 301.459029][T15595] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2629'. [ 301.531489][T15597] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2630'. [ 301.606119][T15604] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2633'. [ 301.628546][T15600] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2632'. [ 301.663871][T15604] xfrm1: entered promiscuous mode [ 301.673085][T15604] xfrm1: entered allmulticast mode [ 301.896271][T15560] chnl_net:caif_netlink_parms(): no params data found [ 302.129898][T15623] syz.0.2638 uses old SIOCAX25GETINFO [ 302.314659][T15632] macsec0: entered promiscuous mode [ 302.326891][T15632] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping [ 302.345376][T15560] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.353777][T15560] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.363968][T15560] bridge_slave_0: entered allmulticast mode [ 302.373369][T15560] bridge_slave_0: entered promiscuous mode [ 302.381516][T15636] : renamed from hsr0 (while UP) [ 302.391386][T15560] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.415995][T15560] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.433812][T15636] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 302.435014][T15560] bridge_slave_1: entered allmulticast mode [ 302.441225][T15636] IPv6: NLM_F_CREATE should be set when creating new route [ 302.461247][T15560] bridge_slave_1: entered promiscuous mode [ 302.491376][ T5841] Bluetooth: hci6: command tx timeout [ 302.543387][T15634] lo speed is unknown, defaulting to 1000 [ 302.701577][T15560] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 302.738187][T15560] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 302.950712][T15560] team0: Port device team_slave_0 added [ 302.978609][T15560] team0: Port device team_slave_1 added [ 303.045366][T15660] netlink: 'syz.3.2649': attribute type 1 has an invalid length. [ 303.191069][T15660] bond8: entered promiscuous mode [ 303.199566][T15660] 8021q: adding VLAN 0 to HW filter on device bond8 [ 303.296055][T15671] bond8: (slave bridge50): making interface the new active one [ 303.324284][T15671] bridge50: entered promiscuous mode [ 303.335465][T15671] bond8: (slave bridge50): Enslaving as an active interface with an up link [ 303.345751][T15560] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 303.369950][T15560] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 303.411549][T15560] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 303.496056][T15560] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 303.505808][T15560] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 303.533999][T15560] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 303.565981][T15679] sctp: [Deprecated]: syz.3.2653 (pid 15679) Use of int in max_burst socket option. [ 303.565981][T15679] Use struct sctp_assoc_value instead [ 303.660980][T15681] block nbd0: reconnected socket [ 303.683820][ T5841] block nbd0: Receive control failed (result -32) [ 303.959002][T15560] hsr_slave_0: entered promiscuous mode [ 303.984276][T15560] hsr_slave_1: entered promiscuous mode [ 304.368682][T15560] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 304.494979][T15560] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 304.571229][ T52] Bluetooth: hci6: command tx timeout [ 304.597565][T15560] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 304.615219][T15560] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 304.812295][T15727] tipc: Enabling of bearer rejected, failed to enable media [ 305.141625][T15745] siw: device registration error -23 [ 305.205669][T15560] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 305.274969][T15560] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 305.312554][T15560] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 305.400844][T15560] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 305.645473][T15560] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.663383][ T1134] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 305.730784][T15560] 8021q: adding VLAN 0 to HW filter on device team0 [ 305.776414][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.783701][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 305.810823][ T6215] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.818052][ T6215] bridge0: port 2(bridge_slave_1) entered forwarding state [ 305.851087][T15789] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 305.916759][T15791] __nla_validate_parse: 24 callbacks suppressed [ 305.916779][T15791] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2686'. [ 306.108139][T15802] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2688'. [ 306.167589][T15802] bond9 (unregistering): Released all slaves [ 306.298028][T15560] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 306.394922][T15560] veth0_vlan: entered promiscuous mode [ 306.413635][T15560] veth1_vlan: entered promiscuous mode [ 306.557643][T15560] veth0_macvtap: entered promiscuous mode [ 306.605664][T15560] veth1_macvtap: entered promiscuous mode [ 306.651094][ T5841] Bluetooth: hci6: command tx timeout [ 306.662844][T15560] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 306.683358][T15560] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 306.712921][T15818] tipc: Enabled bearer , priority 10 [ 306.754265][ T61] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.772455][ T61] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.804751][ T61] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.840859][T15824] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2694'. [ 306.852642][ T61] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.898025][T15828] netlink: 'syz.3.2695': attribute type 1 has an invalid length. [ 306.906546][T15828] netlink: 'syz.3.2695': attribute type 2 has an invalid length. [ 307.008408][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 307.037231][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 307.131864][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 90 seconds [ 307.172514][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 307.211772][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 307.440418][T15846] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.2612'. [ 307.453693][T15844] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2700'. [ 307.736147][T15858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2704'. [ 307.814089][T15858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2704'. [ 307.832622][T15858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2704'. [ 308.188085][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 308.200154][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 308.210784][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 308.221036][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 308.229915][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 308.523214][T15875] lo speed is unknown, defaulting to 1000 [ 308.729909][ T52] Bluetooth: hci6: command tx timeout [ 308.770708][T15894] netlink: 'syz.0.2717': attribute type 28 has an invalid length. [ 308.778748][T15894] netlink: 'syz.0.2717': attribute type 3 has an invalid length. [ 308.788544][T15894] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2717'. [ 308.824664][T15896] netdevsim netdevsim5: Firmware load for '..' refused, path contains '..' component [ 308.872350][T15896] IPVS: set_ctl: invalid protocol: 43 172.30.1.6:20000 [ 308.881337][ T44] IPVS: starting estimator thread 0... [ 309.003844][T15902] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2720'. [ 309.013575][T15899] IPVS: using max 29 ests per chain, 69600 per kthread [ 309.833913][ T6215] bond6 (unregistering): (slave ip6gretap1): Releasing active interface [ 309.981845][ T6215] bond1 (unregistering): (slave xfrm1): Releasing backup interface [ 310.201897][ T6215] bond3 (unregistering): (slave geneve2): Releasing active interface [ 310.330153][ T52] Bluetooth: hci3: command tx timeout [ 310.851003][T15939] sctp: [Deprecated]: syz.5.2734 (pid 15939) Use of int in maxseg socket option. [ 310.851003][T15939] Use struct sctp_assoc_value instead [ 312.351262][ T6215] bond8 (unregistering): (slave bridge50): Releasing backup interface [ 312.359943][ T6215] bridge50 (unregistering): left promiscuous mode [ 312.404829][ T6215] bond1 (unregistering): Released all slaves [ 312.410712][ T52] Bluetooth: hci3: command tx timeout [ 312.423630][ T6215] bond2 (unregistering): Released all slaves [ 312.440869][ T6215] bond0 (unregistering): Released all slaves [ 312.455861][ T6215] bond3 (unregistering): Released all slaves [ 312.476194][ T6215] bond4 (unregistering): Released all slaves [ 312.496447][ T6215] bond5 (unregistering): Released all slaves [ 312.605751][ T6215] bond6 (unregistering): Released all slaves [ 312.713516][ T6215] bond7 (unregistering): Released all slaves [ 312.822861][ T6215] bond8 (unregistering): Released all slaves [ 313.088810][ T6215] tipc: Disabling bearer [ 313.113277][T15963] __nla_validate_parse: 4 callbacks suppressed [ 313.113299][T15963] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2741'. [ 313.156387][ T6215] tipc: Left network mode [ 313.301757][T15972] block nbd1: Unsupported socket: should be TCP or UNIX. [ 313.432897][T15973] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2744'. [ 313.666239][T15994] netlink: 548 bytes leftover after parsing attributes in process `syz.1.2744'. [ 314.419356][T15875] chnl_net:caif_netlink_parms(): no params data found [ 314.502633][ T52] Bluetooth: hci3: command tx timeout [ 314.899423][T16033] ipvlan3: entered allmulticast mode [ 314.904916][T16033] batadv_slave_1: entered allmulticast mode [ 315.011197][T16044] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2755'. [ 315.036547][T16042] IPVS: sh: FWM 3 0x00000003 - no destination available [ 315.044183][T16038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2756'. [ 315.044429][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 315.106231][ T6215] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 315.123475][ T6215] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 315.123638][T16047] netlink: 13 bytes leftover after parsing attributes in process `syz.5.2755'. [ 315.208402][ T6215] pim6reg527 (unregistering): left allmulticast mode [ 315.226066][T16052] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 315.285817][ T6215] pimreg3 (unregistering): left allmulticast mode [ 315.439684][ T6215] vlan1 (unregistering): left allmulticast mode [ 315.446276][ T6215] veth0_vlan (unregistering): left allmulticast mode [ 316.035784][T15875] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.043771][T15875] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.051377][T15875] bridge_slave_0: entered allmulticast mode [ 316.061267][T15875] bridge_slave_0: entered promiscuous mode [ 316.074352][T15875] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.081984][T15875] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.099687][T15875] bridge_slave_1: entered allmulticast mode [ 316.107843][T15875] bridge_slave_1: entered promiscuous mode [ 316.154451][T16058] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2758'. [ 316.174013][T16058] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2758'. [ 316.199451][T16058] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2758'. [ 316.400250][T16058] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2758'. [ 316.418380][T15875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 316.541917][T16079] netlink: 'syz.1.2764': attribute type 1 has an invalid length. [ 316.564745][T16080] netlink: 'syz.1.2764': attribute type 1 has an invalid length. [ 316.572887][ T52] Bluetooth: hci3: command tx timeout [ 316.636832][T15875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 316.829745][T15875] team0: Port device team_slave_0 added [ 316.838541][T15875] team0: Port device team_slave_1 added [ 317.061295][T15875] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 317.068377][T15875] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 317.148972][T15875] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 317.173494][T15875] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 317.190144][T15875] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 317.256237][T15875] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 317.280721][T16103] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 317.295584][T16107] IPVS: Error connecting to the multicast addr [ 317.435892][T16117] team0: left allmulticast mode [ 317.441851][T16117] team0: left promiscuous mode [ 317.447868][T16117] bridge0: port 1(team0) entered disabled state [ 317.540222][T16099] tipc: Enabling of bearer rejected, failed to enable media [ 317.564175][ T6215] IPVS: stop unused estimator thread 0... [ 317.609692][T16119] syzkaller1: entered promiscuous mode [ 317.618063][T16119] syzkaller1: entered allmulticast mode [ 317.762330][T16108] lo speed is unknown, defaulting to 1000 [ 317.868102][T15875] hsr_slave_0: entered promiscuous mode [ 317.913989][T15875] hsr_slave_1: entered promiscuous mode [ 317.942150][T15875] debugfs: 'hsr0' already exists in 'hsr' [ 317.970296][T15875] Cannot create hsr debugfs directory [ 318.403905][T16157] mac80211_hwsim hwsim24 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 318.513246][T16155] __nla_validate_parse: 6 callbacks suppressed [ 318.513267][T16155] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2778'. [ 318.535439][T16155] RDS: rds_bind could not find a transport for ::ffff:172.30.0.3, load rds_tcp or rds_rdma? [ 318.685596][T16167] netlink: 'syz.2.2782': attribute type 21 has an invalid length. [ 318.777681][T16167] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2782'. [ 318.946057][T16176] syzkaller0: entered promiscuous mode [ 318.969402][T16176] syzkaller0: entered allmulticast mode [ 319.263489][T16193] sctp: [Deprecated]: syz.2.2789 (pid 16193) Use of int in maxseg socket option. [ 319.263489][T16193] Use struct sctp_assoc_value instead [ 319.294084][T16189] tipc: Invalid UDP bearer configuration [ 319.294182][T16189] tipc: Enabling of bearer rejected, failed to enable media [ 319.440897][T16198] tipc: Enabling of bearer rejected, already enabled [ 319.660793][T15875] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 319.751104][T15875] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 319.798025][T15875] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 319.840318][T15875] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 320.234782][T16235] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2798'. [ 320.267630][T16236] netlink: 64 bytes leftover after parsing attributes in process `syz.5.2797'. [ 320.294976][T15875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 320.321098][T16236] block nbd0: reconnected socket [ 320.336914][ T52] block nbd0: Receive control failed (result -32) [ 320.420931][T15875] 8021q: adding VLAN 0 to HW filter on device team0 [ 320.501746][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.508993][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 320.592024][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.599321][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 321.035008][T16273] 8021q: adding VLAN 0 to HW filter on device bond2 [ 321.052019][ T61] wlan1: Trigger new scan to find an IBSS to join [ 321.065736][T16273] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2808'. [ 321.100731][T16276] netlink: 'syz.1.2806': attribute type 14 has an invalid length. [ 321.120517][T16278] netlink: 'syz.5.2808': attribute type 1 has an invalid length. [ 321.435736][T15875] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 321.561769][T15875] veth0_vlan: entered promiscuous mode [ 321.597447][T15875] veth1_vlan: entered promiscuous mode [ 321.673269][T15875] veth0_macvtap: entered promiscuous mode [ 321.705702][T15875] veth1_macvtap: entered promiscuous mode [ 321.832522][T15875] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 321.912166][T15875] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 321.977400][ T6215] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.996434][T16316] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2815'. [ 322.006687][T16316] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2815'. [ 322.018859][ T6215] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.030288][ T6215] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.044950][T16313] syzkaller0: entered promiscuous mode [ 322.051563][T16313] syzkaller0: entered allmulticast mode [ 322.074168][T16316] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2815'. [ 322.083660][T16316] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2815'. [ 322.093244][ T6215] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.336468][ T3546] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 322.351296][ T3546] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 322.454147][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 322.474660][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 322.495592][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 322.734865][T16343] netlink: 'syz.1.2818': attribute type 16 has an invalid length. [ 322.831064][T16341] bond14: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 322.924625][T16341] bond14 (unregistering): Released all slaves [ 323.245587][ T5841] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 323.257661][ T5841] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 323.266468][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 323.276627][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 323.286755][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 323.335351][T16365] netlink: 332 bytes leftover after parsing attributes in process `syz.0.2825'. [ 323.445619][T16360] lo speed is unknown, defaulting to 1000 [ 323.672101][T16377] netlink: 'syz.0.2826': attribute type 1 has an invalid length. [ 323.801505][T16377] netlink: 'syz.0.2826': attribute type 1 has an invalid length. [ 324.061481][T12767] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 324.090137][ T6148] wlan1: Trigger new scan to find an IBSS to join [ 324.109441][T12767] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 324.129921][T12767] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.397721][T16407] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.2833'. [ 324.416434][T12767] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 324.457436][T12767] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 324.495652][T12767] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.637300][T12767] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 324.664637][T12767] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 324.675358][T12767] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.765041][T12767] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 324.777538][T12767] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 324.789484][T12767] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.123273][T16435] tipc: Started in network mode [ 325.128261][T16435] tipc: Node identity 7611847f97c9, cluster identity 4711 [ 325.220775][T16435] tipc: Enabled bearer , priority 0 [ 325.370854][ T52] Bluetooth: hci2: command tx timeout [ 325.513631][T16435] tipc: Disabling bearer [ 325.621910][T16360] chnl_net:caif_netlink_parms(): no params data found [ 325.786694][T16454] netlink: 'syz.1.2841': attribute type 10 has an invalid length. [ 325.836714][T16454] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2841'. [ 325.986927][T12767] macsec0: left allmulticast mode [ 326.012752][T12767] veth1_macvtap: left allmulticast mode [ 326.050491][T12767] macsec0: left promiscuous mode [ 326.071646][T12767] bridge0: port 1(macsec0) entered disabled state [ 326.233311][T12767] tipc: Resetting bearer [ 327.039382][T12767] bond7 (unregistering): (slave ip6gretap1): Releasing active interface [ 327.049653][ T37] wlan1: Creating new IBSS network, BSSID 0a:9a:71:ca:e5:9e [ 327.406314][T16479] netlink: 596 bytes leftover after parsing attributes in process `syz.5.2846'. [ 327.451046][T16479] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2846'. [ 327.460128][ T52] Bluetooth: hci2: command tx timeout [ 328.335365][T12767] team0: Port device geneve0 removed [ 329.031289][T12767] tipc: Disabling bearer [ 329.185215][T12767] bond6 (unregistering): (slave bridge5): Releasing backup interface [ 329.232103][T12767] bridge5 (unregistering): left promiscuous mode [ 329.534048][ T52] Bluetooth: hci2: command tx timeout [ 330.141623][T12767] bond0 (unregistering): Released all slaves [ 330.741320][T12767] bond1 (unregistering): Released all slaves [ 330.801831][T12767] bond2 (unregistering): Released all slaves [ 330.875341][T12767] bond3 (unregistering): (slave bond4): Releasing backup interface [ 330.920211][T12767] bond3 (unregistering): Released all slaves [ 331.491939][T12767] bond4 (unregistering): Released all slaves [ 331.610924][ T52] Bluetooth: hci2: command tx timeout [ 332.031606][T12767] bond5 (unregistering): Released all slaves [ 332.442495][T12767] bond6 (unregistering): Released all slaves [ 332.491973][T12767] bond7 (unregistering): Released all slaves [ 332.565905][T12767] bond8 (unregistering): Released all slaves [ 332.621056][T12767] bond9 (unregistering): Released all slaves [ 332.728832][T16454] team0: Port device geneve0 added [ 334.229707][T16523] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2849'. [ 334.401739][T16360] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.430306][T16360] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.437654][T16360] bridge_slave_0: entered allmulticast mode [ 334.482197][T16360] bridge_slave_0: entered promiscuous mode [ 334.522518][T16360] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.571645][T16360] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.578993][T16360] bridge_slave_1: entered allmulticast mode [ 334.653684][T16360] bridge_slave_1: entered promiscuous mode [ 334.930331][T12767] tipc: Disabling bearer [ 334.954979][T12767] tipc: Disabling bearer [ 334.989542][T12767] tipc: Left network mode [ 334.995385][T16360] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 335.087665][T16534] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2853'. [ 335.114685][T16360] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 335.151884][T12767] IPVS: stopping master sync thread 15575 ... [ 335.217450][T16539] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2854'. [ 335.312430][T16542] netlink: 'syz.5.2854': attribute type 1 has an invalid length. [ 335.404965][T16544] netlink: 'syz.0.2855': attribute type 21 has an invalid length. [ 335.573257][T16544] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2855'. [ 335.871447][T16360] team0: Port device team_slave_0 added [ 335.919999][T16360] team0: Port device team_slave_1 added [ 336.346923][T16562] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2857'. [ 336.514155][T16360] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.590307][T16360] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.731759][T16360] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.784096][T16558] syzkaller1: entered promiscuous mode [ 336.799273][T16558] syzkaller1: entered allmulticast mode [ 336.859341][T16360] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.898788][T16360] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.049637][T16360] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 337.229242][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 120 seconds [ 337.864434][T16552] lo speed is unknown, defaulting to 1000 [ 337.991607][T16360] hsr_slave_0: entered promiscuous mode [ 338.019730][T16360] hsr_slave_1: entered promiscuous mode [ 338.050756][T16360] debugfs: 'hsr0' already exists in 'hsr' [ 338.056567][T16360] Cannot create hsr debugfs directory [ 338.320954][T16586] bond14: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 338.740864][T16591] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2863'. [ 340.243306][T12767] hsr_slave_0: left promiscuous mode [ 340.319259][T12767] hsr_slave_1: left promiscuous mode [ 340.341616][T12767] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 340.370716][T12767] batman_adv: batadv0: Removing interface: ipvlan2 [ 340.517412][T12767] veth1_macvtap: left promiscuous mode [ 340.551839][T12767] veth1_vlan: left promiscuous mode [ 340.591655][T12767] veth0_vlan: left promiscuous mode [ 340.992344][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 341.002691][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 341.012803][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 341.034283][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 341.043087][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 341.911296][T16635] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2872'. [ 343.133078][ T52] Bluetooth: hci1: command tx timeout [ 344.774205][ T37] smc: removing ib device syz2 [ 345.217340][ T52] Bluetooth: hci1: command tx timeout [ 345.581390][T13000] lo speed is unknown, defaulting to 1000 [ 345.587193][T13000] syz2: Port: 1 Link DOWN [ 345.649837][T16635] veth0_macvtap: left promiscuous mode [ 345.981446][T16640] netlink: 71 bytes leftover after parsing attributes in process `syz.1.2873'. [ 347.289281][ T52] Bluetooth: hci1: command tx timeout [ 348.982261][T16360] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 349.084034][T16360] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 349.193264][T16360] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 349.317592][T16360] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 349.370991][ T52] Bluetooth: hci1: command tx timeout [ 349.431277][T16622] chnl_net:caif_netlink_parms(): no params data found [ 350.090537][T16698] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2886'. [ 350.419748][T16622] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.457174][T12767] IPVS: stop unused estimator thread 0... [ 350.479427][T16622] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.486869][T16622] bridge_slave_0: entered allmulticast mode [ 350.541216][T16622] bridge_slave_0: entered promiscuous mode [ 350.603500][T16622] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.640300][T16622] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.647834][T16622] bridge_slave_1: entered allmulticast mode [ 350.756678][T16622] bridge_slave_1: entered promiscuous mode [ 350.781870][T16713] bond0: Error: Cannot enslave bond to itself. [ 351.124122][T16622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 351.226434][T16622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 351.594436][T16622] team0: Port device team_slave_0 added [ 351.643740][T16622] team0: Port device team_slave_1 added [ 351.961662][T16622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 351.968688][T16622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.169158][T16622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 352.322558][T16622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 352.351615][ T5841] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 352.362070][ T5841] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 352.370447][T16622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.404288][ T5841] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 352.431103][ T5841] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 352.450846][ T5841] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 352.474652][T16736] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 352.549192][T16622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 352.703245][T16715] netlink: 'syz.1.2888': attribute type 2 has an invalid length. [ 352.861520][T16715] 9: entered promiscuous mode [ 353.546906][T16622] hsr_slave_0: entered promiscuous mode [ 353.590532][T16622] hsr_slave_1: entered promiscuous mode [ 353.617103][T16622] debugfs: 'hsr0' already exists in 'hsr' [ 353.649325][T16622] Cannot create hsr debugfs directory [ 353.862332][T16748] netlink: 220 bytes leftover after parsing attributes in process `syz.1.2894'. [ 353.940775][T16748] openvswitch: netlink: Duplicate or invalid key (type 0). [ 353.971163][T16360] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.999819][T16748] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.277781][ T5841] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 354.288375][ T5841] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 354.298372][ T5841] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 354.307161][ T5841] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 354.317226][ T5841] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 354.370500][T16360] 8021q: adding VLAN 0 to HW filter on device team0 [ 354.533291][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.540569][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 354.668396][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.675662][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 354.891546][T16758] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2897'. [ 355.102442][ T3546] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 355.213278][T16766] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2897'. [ 355.372166][T16771] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2897'. [ 355.417952][T16360] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 355.463820][T16360] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 355.740905][T16622] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 355.843266][T16622] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 356.012383][T16622] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 356.146590][T16622] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 356.412484][ T52] Bluetooth: hci5: command tx timeout [ 356.688308][T16793] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 356.918288][T16360] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 357.039455][T16750] chnl_net:caif_netlink_parms(): no params data found [ 357.470619][T16819] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2905'. [ 357.941928][T16750] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.983756][T16750] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.019356][T16750] bridge_slave_0: entered allmulticast mode [ 358.027412][T16750] bridge_slave_0: entered promiscuous mode [ 358.073202][T16750] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.099454][T16750] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.127538][T16750] bridge_slave_1: entered allmulticast mode [ 358.149957][T16750] bridge_slave_1: entered promiscuous mode [ 358.264105][T16622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 358.489285][ T52] Bluetooth: hci5: command tx timeout [ 358.679498][T16833] syzkaller0: entered promiscuous mode [ 358.689250][T16833] syzkaller0: entered allmulticast mode [ 358.865221][T16750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 359.110184][T16843] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2910'. [ 360.569493][ T52] Bluetooth: hci5: command tx timeout [ 362.650293][ T52] Bluetooth: hci5: command tx timeout [ 365.273248][T16750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.412720][T16622] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.572462][T16750] team0: Port device team_slave_0 added [ 365.601760][T16850] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2912'. [ 365.693197][T16750] team0: Port device team_slave_1 added [ 365.782647][ T6148] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.789937][ T6148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.130922][T16750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 366.168621][T16750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.299151][T16750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 366.343870][T16360] veth0_vlan: entered promiscuous mode [ 366.369985][T16750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 366.407614][T16750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.524039][T16750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.569922][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 366.682002][ T3007] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.689270][ T3007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 367.111015][T16750] hsr_slave_0: entered promiscuous mode [ 367.142048][T16750] hsr_slave_1: entered promiscuous mode [ 367.169400][T16750] debugfs: 'hsr0' already exists in 'hsr' [ 367.175289][T16750] Cannot create hsr debugfs directory [ 367.211632][T16360] veth1_vlan: entered promiscuous mode [ 367.319809][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 150 seconds [ 368.220978][T16898] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2921'. [ 368.273954][T16360] veth0_macvtap: entered promiscuous mode [ 368.650749][T16910] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 368.767620][T16360] veth1_macvtap: entered promiscuous mode [ 368.921003][T16911] xt_TPROXY: Can be used only with -p tcp or -p udp [ 369.062280][T16360] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 369.203064][T16360] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 369.425925][T15349] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.449875][T15349] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.555455][T15349] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.582594][T15349] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.627128][T16750] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 369.705330][T16938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2926'. [ 369.744970][T16938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2926'. [ 369.822593][T16750] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 369.891997][T16750] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 370.062106][T16750] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 370.225761][T16622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 370.313641][T16948] netlink: 256 bytes leftover after parsing attributes in process `syz.1.2929'. [ 370.390153][T16951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2930'. [ 370.432705][T16951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2930'. [ 370.443544][T16930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.452595][T16951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2930'. [ 370.490364][T16930] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.677564][T16951] netlink: 'syz.0.2930': attribute type 1 has an invalid length. [ 370.744625][T16951] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2930'. [ 370.781886][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.804385][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.185596][T16750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.357870][T16750] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.448488][ T6176] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.455785][ T6176] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.560944][T16980] IPv6: NLM_F_CREATE should be specified when creating new route [ 371.640028][ T6176] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.647247][ T6176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.698611][T16980] C: renamed from team_slave_0 (while UP) [ 371.739488][T16980] netlink: 'syz.1.2935': attribute type 1 has an invalid length. [ 371.770148][T16980] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 371.849354][T16981] tipc: Started in network mode [ 371.854394][T16981] tipc: Node identity 16e99687392f, cluster identity 4711 [ 371.866876][T16981] tipc: Enabled bearer , priority 0 [ 371.910087][T16985] vlan5: entered allmulticast mode [ 371.915370][T16985] bridge_slave_0: entered allmulticast mode [ 371.982426][T16988] syzkaller0: MTU too low for tipc bearer [ 371.988226][T16988] tipc: Disabling bearer [ 372.350363][T16995] netlink: 'syz.0.2938': attribute type 1 has an invalid length. [ 372.471013][T16997] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2938'. [ 372.533264][T16995] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 372.564609][T16999] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2939'. [ 373.140547][T16622] veth0_vlan: entered promiscuous mode [ 373.253128][T16622] veth1_vlan: entered promiscuous mode [ 373.502601][T16622] veth0_macvtap: entered promiscuous mode [ 373.529727][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.580107][T16622] veth1_macvtap: entered promiscuous mode [ 373.820836][T16750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 373.859922][T16622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 373.914666][T16622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 373.972230][ T1148] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.008460][T17019] netlink: 'syz.0.2944': attribute type 1 has an invalid length. [ 374.029773][ T1148] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.038573][ T1148] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.060910][T17020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2944'. [ 374.124466][T17020] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2944'. [ 374.282835][ T1148] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.639372][T15349] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 374.680339][T15349] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 374.744578][T17030] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 374.908397][T12767] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 374.957811][T12767] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 375.341782][T17043] netdevsim netdevsim0: Direct firmware load for  failed with error -2 [ 375.414057][T17043] netdevsim netdevsim0: Falling back to sysfs fallback for:  [ 375.594145][T17046] netlink: 'syz.1.2951': attribute type 10 has an invalid length. [ 375.623062][T16750] veth0_vlan: entered promiscuous mode [ 375.642617][T17046] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2951'. [ 375.713648][T16750] veth1_vlan: entered promiscuous mode [ 376.086221][T16750] veth0_macvtap: entered promiscuous mode [ 376.157856][T16750] veth1_macvtap: entered promiscuous mode [ 376.218040][T17058] tipc: Resetting bearer [ 377.326190][T16750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.560779][T17081] netlink: 'syz.1.2960': attribute type 11 has an invalid length. [ 377.649552][T16750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.040188][T16931] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.109240][T16931] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.330547][T16931] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.412401][T16931] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.580764][ T5841] Bluetooth: hci5: command 0x0405 tx timeout [ 379.680651][ T3531] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.789173][ T3531] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.036648][T17114] can: request_module (can-proto-0) failed. [ 380.108420][ T1148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.205998][ T1148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.314990][T17133] veth0_to_bond: entered allmulticast mode [ 381.442159][T17146] netlink: 65039 bytes leftover after parsing attributes in process `syz.7.2890'. [ 382.436303][T17156] gtp0: entered promiscuous mode [ 382.569233][T17156] gtp0: entered allmulticast mode [ 383.730216][T17174] IPVS: Scheduler module ip_vs_sip not found [ 383.870385][ T52] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 383.890861][ T52] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 383.939919][ T52] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 383.949569][ T52] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 383.957591][ T52] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 383.966819][T17183] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 383.973501][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 384.252871][T17190] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2982'. [ 387.276909][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 387.287309][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 387.300597][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 387.375313][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 387.384178][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 387.395457][T17233] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 387.579376][T17238] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 388.199233][T17246] netlink: 72 bytes leftover after parsing attributes in process `syz.7.2994'. [ 390.906763][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 390.934940][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 390.946927][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 390.958109][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 390.990589][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 393.059273][ T5841] Bluetooth: hci0: command tx timeout [ 395.129283][ T5841] Bluetooth: hci0: command tx timeout [ 397.211532][ T5841] Bluetooth: hci0: command tx timeout [ 397.384620][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 180 seconds [ 399.299193][ T5841] Bluetooth: hci0: command tx timeout [ 402.944143][ T52] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 402.959328][ T52] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 402.968911][ T52] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 402.978188][ T52] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 402.987429][ T52] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 404.382401][ T52] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 404.402913][ T52] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 404.418098][ T52] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 404.427155][ T52] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 404.440473][ T52] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 404.453997][T17285] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 404.531156][ T52] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 404.541790][ T52] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 404.550392][ T52] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 404.561092][ T52] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 404.570748][ T52] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 405.050457][ T52] Bluetooth: hci7: command tx timeout [ 406.270105][ T5841] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 406.314098][ T5841] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 406.326521][ T5841] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 406.337981][ T5841] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 406.346215][ T5841] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 406.355692][T17290] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 406.651268][ T52] Bluetooth: hci9: command tx timeout [ 406.773881][T17253] macvtap1: entered promiscuous mode [ 406.880036][T17253] macvtap1: entered allmulticast mode [ 406.885647][T17253] veth1_vlan: entered allmulticast mode [ 407.139186][ T52] Bluetooth: hci7: command tx timeout [ 407.714235][ T5841] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 407.726701][ T5841] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 407.736049][ T5841] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 407.761002][ T5841] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 407.825057][ T5841] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 408.140554][ T52] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 408.192147][ T52] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 408.201770][ T52] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 408.210282][ T52] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 408.261311][ T52] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 408.730080][ T5841] Bluetooth: hci9: command tx timeout [ 409.215545][ T5841] Bluetooth: hci7: command tx timeout [ 409.849474][ T5841] Bluetooth: hci8: command tx timeout [ 410.329243][ T5841] Bluetooth: hci10: command tx timeout [ 410.811423][ T5841] Bluetooth: hci9: command tx timeout [ 411.295203][ T5841] Bluetooth: hci7: command tx timeout [ 411.940270][ T5841] Bluetooth: hci8: command tx timeout [ 412.409725][ T5841] Bluetooth: hci10: command tx timeout [ 412.889252][ T5841] Bluetooth: hci9: command tx timeout [ 414.010439][ T5841] Bluetooth: hci8: command tx timeout [ 414.489288][ T5841] Bluetooth: hci10: command tx timeout [ 416.089887][ T5841] Bluetooth: hci8: command tx timeout [ 416.569937][ T5841] Bluetooth: hci10: command tx timeout [ 425.953733][T16929] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.742481][T16929] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.972154][ T5841] Bluetooth: hci6: command 0x0406 tx timeout [ 427.464593][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 210 seconds [ 427.941177][T16929] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.234808][T16929] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 431.445644][T17287] chnl_net:caif_netlink_parms(): no params data found [ 431.756181][T17296] chnl_net:caif_netlink_parms(): no params data found [ 432.080520][T17277] chnl_net:caif_netlink_parms(): no params data found [ 432.659320][T16929] bridge_slave_1: left allmulticast mode [ 432.665039][T16929] bridge_slave_1: left promiscuous mode [ 432.730118][T16929] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.812765][T16929] bridge_slave_0: left allmulticast mode [ 432.818635][T16929] bridge_slave_0: left promiscuous mode [ 432.890099][T16929] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.861521][T16929] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.997012][T16929] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 436.080318][T16929] bond0 (unregistering): Released all slaves [ 436.321978][T16929] tipc: Left network mode [ 436.503067][T17281] chnl_net:caif_netlink_parms(): no params data found [ 438.490017][T17287] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.497334][T17287] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.594741][T17287] bridge_slave_0: entered allmulticast mode [ 438.671317][T17287] bridge_slave_0: entered promiscuous mode [ 438.865698][T17293] chnl_net:caif_netlink_parms(): no params data found [ 439.370724][T17287] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.377947][T17287] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.499333][T17287] bridge_slave_1: entered allmulticast mode [ 439.507539][T17287] bridge_slave_1: entered promiscuous mode [ 439.871291][T17281] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.878463][T17281] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.909316][T17281] bridge_slave_0: entered allmulticast mode [ 439.917426][T17281] bridge_slave_0: entered promiscuous mode [ 439.926803][T17281] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.934111][T17281] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.941485][T17281] bridge_slave_1: entered allmulticast mode [ 439.979802][T17281] bridge_slave_1: entered promiscuous mode [ 440.219308][T17296] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.226525][T17296] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.333110][T17296] bridge_slave_0: entered allmulticast mode [ 440.399676][T17296] bridge_slave_0: entered promiscuous mode [ 440.859967][T16929] hsr_slave_0: left promiscuous mode [ 440.909169][T16929] hsr_slave_1: left promiscuous mode [ 440.950096][T16929] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 440.957544][T16929] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 441.060396][T16929] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 441.067853][T16929] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 441.369660][T16929] veth1_macvtap: left promiscuous mode [ 441.375294][T16929] veth0_macvtap: left promiscuous mode [ 441.440757][T16929] veth1_vlan: left promiscuous mode [ 441.446185][T16929] veth0_vlan: left promiscuous mode [ 445.373377][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 445.890975][T16929] team0 (unregistering): Port device team_slave_1 removed [ 446.231452][T16929] team0 (unregistering): Port device team_slave_0 removed [ 447.449257][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 450.214040][T17287] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 450.275235][T17296] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.333389][T17296] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.382143][T17296] bridge_slave_1: entered allmulticast mode [ 450.451049][T17296] bridge_slave_1: entered promiscuous mode [ 450.793888][T17281] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 450.998148][T17287] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.453149][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 451.464566][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 451.475459][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 451.483941][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 451.493711][T17281] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.510254][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 452.232161][T17287] team0: Port device team_slave_0 added [ 452.312846][T17296] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 452.690889][T17287] team0: Port device team_slave_1 added [ 452.711219][T17296] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 452.997961][T17281] team0: Port device team_slave_0 added [ 453.609332][ T52] Bluetooth: hci1: command tx timeout [ 453.742742][T17281] team0: Port device team_slave_1 added [ 453.748568][T17293] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.889260][T17293] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.896648][T17293] bridge_slave_0: entered allmulticast mode [ 453.994160][T17293] bridge_slave_0: entered promiscuous mode [ 454.259309][T17287] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 454.266514][T17287] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 454.535146][T17287] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 454.920472][T17293] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.933204][T17293] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.019620][T17293] bridge_slave_1: entered allmulticast mode [ 455.027948][T17293] bridge_slave_1: entered promiscuous mode [ 455.161477][T17287] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 455.168951][T17287] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 455.449306][T17287] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 455.542090][T17296] team0: Port device team_slave_0 added [ 455.689245][ T52] Bluetooth: hci1: command tx timeout [ 455.922960][T17281] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 456.029385][T17281] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.250198][T17281] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 456.713352][T17296] team0: Port device team_slave_1 added [ 456.840011][T17281] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 456.847026][T17281] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.099398][T17281] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 457.216656][T17293] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 457.331072][T17293] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 457.569617][ T11] block nbd2: Possible stuck request ffff888025c00000: control (read@0,4096B). Runtime 240 seconds [ 457.769314][ T52] Bluetooth: hci1: command tx timeout [ 458.399868][T17296] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 458.407013][T17296] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 458.629125][T17296] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 459.068574][T17296] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 459.179140][T17296] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 459.349262][T17296] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 459.481169][T17287] hsr_slave_0: entered promiscuous mode [ 459.541490][T17287] hsr_slave_1: entered promiscuous mode [ 459.639689][T17287] debugfs: 'hsr0' already exists in 'hsr' [ 459.645489][T17287] Cannot create hsr debugfs directory [ 459.732221][T17293] team0: Port device team_slave_0 added [ 459.849388][ T52] Bluetooth: hci1: command tx timeout [ 459.901209][T17293] team0: Port device team_slave_1 added [ 460.214602][T16929] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.047618][T17281] hsr_slave_0: entered promiscuous mode [ 461.140606][T17281] hsr_slave_1: entered promiscuous mode [ 461.147407][T17281] debugfs: 'hsr0' already exists in 'hsr' [ 461.219778][T17281] Cannot create hsr debugfs directory [ 461.539471][T17293] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.546600][T17293] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.759385][T17293] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.923250][T16929] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.076446][T17296] hsr_slave_0: entered promiscuous mode [ 462.180602][T17296] hsr_slave_1: entered promiscuous mode [ 462.187214][T17296] debugfs: 'hsr0' already exists in 'hsr' [ 462.289077][T17296] Cannot create hsr debugfs directory [ 462.681031][T17293] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 462.688049][T17293] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.879273][T17293] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.680089][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 463.694386][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 463.711421][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 463.741655][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 463.749752][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 463.854769][T16929] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.912131][T16929] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.930491][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 464.942588][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 464.951364][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 464.996970][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 465.010457][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 465.022334][T17367] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 465.357258][T17293] hsr_slave_0: entered promiscuous mode [ 465.440835][T17293] hsr_slave_1: entered promiscuous mode [ 465.511097][T17293] debugfs: 'hsr0' already exists in 'hsr' [ 465.517038][T17293] Cannot create hsr debugfs directory [ 465.851788][ T5841] Bluetooth: hci0: command tx timeout [ 467.939677][ T52] Bluetooth: hci0: command tx timeout [ 468.093067][ T5841] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 468.104254][ T5841] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 468.119396][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 468.141740][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 468.151751][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 468.770768][T17296] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.024844][T17340] chnl_net:caif_netlink_parms(): no params data found [ 469.350972][T17296] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 469.470670][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 469.482804][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 469.492662][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 469.501888][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 469.511865][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 469.550823][T17381] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 469.688573][ T52] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 469.702702][ T52] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 469.711683][ T52] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 469.722072][ T52] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 469.730172][ T52] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 469.742101][T17383] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 470.020065][ T5841] Bluetooth: hci0: command tx timeout [ 470.233625][T17296] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.339418][ T5841] Bluetooth: hci2: command tx timeout [ 470.970700][ T31] INFO: task syz.3.2834:16413 blocked for more than 143 seconds. [ 470.978772][ T31] Not tainted syzkaller #0 [ 471.079161][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 471.119139][ T31] task:syz.3.2834 state:D stack:26952 pid:16413 tgid:16412 ppid:15875 task_flags:0x400040 flags:0x00080002 [ 471.209302][ T31] Call Trace: [ 471.212677][ T31] [ 471.215664][ T31] __schedule+0x14bc/0x5000 [ 471.329160][ T31] ? __pfx___schedule+0x10/0x10 [ 471.334138][ T31] ? schedule+0x91/0x360 [ 471.338527][ T31] schedule+0x165/0x360 [ 471.469340][ T31] schedule_preempt_disabled+0x13/0x30 [ 471.475170][ T31] __mutex_lock+0x7e6/0x1350 [ 471.559338][ T31] ? __mutex_lock+0x5bb/0x1350 [ 471.564208][ T31] ? nfsd_nl_threads_get_doit+0x1b6/0x6f0 [ 471.669066][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 471.674372][ T31] ? __nlmsg_put+0xef/0x1b0 [ 471.678945][ T31] ? genlmsg_put+0x137/0x2e0 [ 471.744528][ T31] nfsd_nl_threads_get_doit+0x1b6/0x6f0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 471.837161][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 471.919186][ T31] ? __local_bh_enable_ip+0x12d/0x1c0 [ 471.924686][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 471.999598][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 472.005238][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 472.119300][ T5841] Bluetooth: hci0: command tx timeout [ 472.129148][ T31] genl_rcv_msg+0x60e/0x790 [ 472.133745][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 472.138813][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 472.360099][ T31] netlink_rcv_skb+0x208/0x470 [ 472.365202][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 472.409369][ T5841] Bluetooth: hci2: command tx timeout [ 472.417477][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 472.441395][ T31] ? down_read+0x274/0x2e0 [ 472.445900][ T31] ? genl_rcv+0xd/0x40 [ 472.469281][ T31] genl_rcv+0x28/0x40 [ 472.473414][ T31] netlink_unicast+0x82f/0x9e0 [ 472.478339][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 472.505017][ T31] ? netlink_sendmsg+0x642/0xb30 [ 472.529065][ T31] ? skb_put+0x11b/0x210 [ 472.533427][ T31] netlink_sendmsg+0x805/0xb30 [ 472.538503][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.629066][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 472.634111][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 472.689258][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.694640][ T31] __sock_sendmsg+0x21c/0x270 [ 472.758836][ T31] ____sys_sendmsg+0x505/0x820 [ 472.789743][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 472.795135][ T31] ? import_iovec+0x74/0xa0 [ 472.861383][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 472.866372][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 472.929171][ T31] ? futex_wake+0x4b2/0x560 [ 472.933820][ T31] ? __fget_files+0x2a/0x420 [ 472.938745][ T31] ? __fget_files+0x3a0/0x420 [ 473.019174][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 473.024234][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 473.069127][ T31] ? do_syscall_64+0xbe/0xf80 [ 473.073909][ T31] do_syscall_64+0xfa/0xf80 [ 473.078461][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.168587][ T31] ? clear_bhb_loop+0x60/0xb0 [ 473.212152][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.218152][ T31] RIP: 0033:0x7f1ad678f749 [ 473.282261][ T31] RSP: 002b:00007f1ad7577038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.349234][ T31] RAX: ffffffffffffffda RBX: 00007f1ad69e5fa0 RCX: 00007f1ad678f749 [ 473.357310][ T31] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 473.479140][ T31] RBP: 00007f1ad6813f91 R08: 0000000000000000 R09: 0000000000000000 [ 473.487205][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.589159][ T31] R13: 00007f1ad69e6038 R14: 00007f1ad69e5fa0 R15: 00007ffe3be11538 [ 473.597251][ T31] [ 473.660624][ T31] INFO: task syz.3.2834:16415 blocked for more than 146 seconds. [ 473.679268][ T31] Not tainted syzkaller #0 [ 473.684932][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 473.770154][ T31] task:syz.3.2834 state:D stack:25920 pid:16415 tgid:16412 ppid:15875 task_flags:0x400140 flags:0x00080002 [ 473.829163][ T31] Call Trace: [ 473.832529][ T31] [ 473.835500][ T31] __schedule+0x14bc/0x5000 [ 473.909330][ T31] ? __pfx___schedule+0x10/0x10 [ 473.914291][ T31] ? schedule+0x91/0x360 [ 473.918577][ T31] schedule+0x165/0x360 [ 473.987541][ T31] schedule_preempt_disabled+0x13/0x30 [ 474.029103][ T31] __mutex_lock+0x7e6/0x1350 [ 474.033801][ T31] ? __mutex_lock+0x5bb/0x1350 [ 474.038653][ T31] ? nfsd_nl_threads_get_doit+0x1b6/0x6f0 [ 474.159138][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 474.164279][ T31] ? __nlmsg_put+0xef/0x1b0 [ 474.168855][ T31] ? genlmsg_put+0x137/0x2e0 [ 474.250605][ T31] nfsd_nl_threads_get_doit+0x1b6/0x6f0 [ 474.256273][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 474.332323][ T31] ? __local_bh_enable_ip+0x12d/0x1c0 [ 474.337785][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 474.410498][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 474.416233][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 474.489413][ T5841] Bluetooth: hci2: command tx timeout [ 474.495395][ T31] genl_rcv_msg+0x60e/0x790 [ 474.553700][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 474.558819][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 474.649084][ T31] netlink_rcv_skb+0x208/0x470 [ 474.653971][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 474.704411][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 474.731287][ T31] ? down_read+0x274/0x2e0 [ 474.735784][ T31] ? genl_rcv+0xd/0x40 [ 474.784027][ T31] genl_rcv+0x28/0x40 [ 474.788098][ T31] netlink_unicast+0x82f/0x9e0 [ 474.859054][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 474.864431][ T31] ? plist_check_list+0x2f4/0x310 [ 474.929125][ T31] ? netlink_sendmsg+0x642/0xb30 [ 474.934202][ T31] ? skb_put+0x11b/0x210 [ 474.938491][ T31] netlink_sendmsg+0x805/0xb30 [ 475.020556][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.025954][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 475.119039][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 475.124416][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 475.189414][ T31] __sock_sendmsg+0x21c/0x270 [ 475.194201][ T31] ____sys_sendmsg+0x505/0x820 [ 475.249476][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 475.254880][ T31] ? import_iovec+0x74/0xa0 [ 475.329236][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 475.334012][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 475.409159][ T31] ? __fget_files+0x2a/0x420 [ 475.413858][ T31] ? __fget_files+0x3a0/0x420 [ 475.418602][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 475.509060][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 475.514830][ T31] ? rcu_is_watching+0x15/0xb0 [ 475.580610][ T31] do_syscall_64+0xfa/0xf80 [ 475.585213][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.659170][ T31] ? clear_bhb_loop+0x60/0xb0 [ 475.663946][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.739359][ T31] RIP: 0033:0x7f1ad678f749 [ 475.744137][ T31] RSP: 002b:00007f1ad7556038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 475.819074][ T31] RAX: ffffffffffffffda RBX: 00007f1ad69e6090 RCX: 00007f1ad678f749 [ 475.827226][ T31] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 475.930016][ T31] RBP: 00007f1ad6813f91 R08: 0000000000000000 R09: 0000000000000000 [ 475.938084][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 476.049123][ T31] R13: 00007f1ad69e6128 R14: 00007f1ad69e6090 R15: 00007ffe3be11538 [ 476.057220][ T31] [ 476.122348][ T31] [ 476.122348][ T31] Showing all locks held in the system: [ 476.229344][ T31] 1 lock held by khungtaskd/31: [ 476.234279][ T31] #0: ffffffff8df41a20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 476.339116][ T31] 3 locks held by kworker/u8:4/61: [ 476.379099][ T31] #0: ffff8880306da948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 476.459027][ T31] #1: ffffc9000212fb80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 476.549120][ T31] #2: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 476.558946][ T31] 1 lock held by dhcpcd/5496: [ 476.579076][ T5841] Bluetooth: hci2: command tx timeout [ 476.599417][ T31] #0: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x323/0x1b20 [ 476.608868][ T31] 2 locks held by getty/5595: [ 476.619607][ T31] #0: ffff8880351840a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 476.636896][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 [ 476.648346][ T31] 1 lock held by udevd/11161: [ 476.657270][ T31] 1 lock held by udevd/11383: [ 476.679418][ T31] #0: ffff88802571d358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 476.688797][ T31] 2 locks held by syz.4.2193/14016: [ 476.779385][ T31] #0: ffffffff8f3798f0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 476.787696][ T31] #1: ffffffff8e237ac8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1660 [ 476.919026][ T31] 1 lock held by udevd/14635: [ 476.923781][ T31] 1 lock held by udevd/14641: [ 476.928564][ T31] 3 locks held by kworker/u8:20/15349: [ 477.000362][ T31] #0: ffff88813ff29948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 477.100171][ T31] #1: ffffc90003d9fb80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 477.179425][ T31] #2: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 477.188515][ T31] 2 locks held by syz.3.2834/16413: [ 477.279029][ T31] #0: ffffffff8f3798f0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 477.287327][ T31] #1: ffffffff8e237ac8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_get_doit+0x1b6/0x6f0 [ 477.409040][ T31] 2 locks held by syz.3.2834/16415: [ 477.414322][ T31] #0: ffffffff8f3798f0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 477.489409][ T31] #1: ffffffff8e237ac8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_get_doit+0x1b6/0x6f0 [ 477.559057][ T31] 6 locks held by kworker/u8:30/16929: [ 477.564598][ T31] #0: ffff88801aa9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 477.669064][ T31] #1: ffffc9000410fb80 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 477.759163][ T31] #2: ffffffff8f304bf0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x7a0 [ 477.839196][ T31] #3: ffff8880339730e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x10a/0x3d0 [ 477.909095][ T31] #4: ffff888024c42250 (&devlink->lock_key#10){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x3d0 [ 477.979398][ T31] #5: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 [ 478.049465][ T31] 1 lock held by udevd/17106: [ 478.054222][ T31] 5 locks held by syz-executor/17293: [ 478.119107][ T31] #0: ffff888027850ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 [ 478.189096][ T31] #1: ffff8880278500c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 [ 478.198913][ T31] #2: ffffffff8f483848 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 478.329661][ T31] #3: ffff88803510e338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 [ 478.389413][ T31] #4: ffffffff8df47578 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 478.469262][ T31] 9 locks held by syz-executor/17296: [ 478.474716][ T31] #0: ffff888034c0c420 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x211/0xb30 [ 478.559156][ T31] #1: ffff888061becc88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 [ 478.630013][ T31] #2: ffff888027c7e1e8 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 [ 478.709126][ T31] #3: ffffffff8eb9f9e8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x360 [ 478.779270][ T31] #4: ffff888032b7d0e8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x800 [ 478.859421][ T31] #5: ffff88807d213250 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 478.919573][ T31] #6: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0xed/0x680 [ 478.989044][ T31] #7: ffff88805fa50d38 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1198/0x2340 [ 479.069182][ T31] #8: ffffffff8df47578 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 479.149043][ T31] 2 locks held by syz-executor/17340: [ 479.154521][ T31] #0: ffffffff8f825b30 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 479.259090][ T31] #1: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 [ 479.268340][ T31] 2 locks held by syz-executor/17364: [ 479.359681][ T31] #0: ffffffff8f304bf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 [ 479.419456][ T31] #1: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x200 [ 479.428904][ T31] 2 locks held by syz-executor/17373: [ 479.519424][ T31] #0: ffffffff8f304bf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 [ 479.579796][ T31] #1: ffffffff8f311c88 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 479.649323][ T31] [ 479.651829][ T31] ============================================= [ 479.651829][ T31] [ 479.674497][T17296] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.759049][ T31] NMI backtrace for cpu 1 [ 479.759076][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 479.759118][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 479.759131][ T31] Call Trace: [ 479.759140][ T31] [ 479.759149][ T31] dump_stack_lvl+0x189/0x250 [ 479.759182][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.759207][ T31] ? __pfx__printk+0x10/0x10 [ 479.759251][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 479.759283][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 479.759315][ T31] ? __pfx__printk+0x10/0x10 [ 479.759350][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 479.759387][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 479.759419][ T31] sys_info+0x135/0x170 [ 479.759443][ T31] watchdog+0xf95/0xfe0 [ 479.759478][ T31] ? watchdog+0x20a/0xfe0 [ 479.759516][ T31] kthread+0x711/0x8a0 [ 479.759548][ T31] ? __pfx_watchdog+0x10/0x10 [ 479.759576][ T31] ? __pfx_kthread+0x10/0x10 [ 479.759604][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.759636][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 479.759655][ T31] ? __pfx_kthread+0x10/0x10 [ 479.759684][ T31] ret_from_fork+0x599/0xb30 [ 479.759708][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 479.759740][ T31] ? __switch_to_asm+0x39/0x70 [ 479.759766][ T31] ? __switch_to_asm+0x33/0x70 [ 479.759792][ T31] ? __pfx_kthread+0x10/0x10 [ 479.759820][ T31] ret_from_fork_asm+0x1a/0x30 [ 479.759867][ T31] [ 479.759875][ T31] Sending NMI from CPU 1 to CPUs 0: [ 479.913260][ C0] NMI backtrace for cpu 0 [ 479.913278][ C0] CPU: 0 UID: 0 PID: 16933 Comm: kworker/u8:34 Not tainted syzkaller #0 PREEMPT(full) [ 479.913298][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 479.913309][ C0] Workqueue: events_unbound nsim_dev_trap_report_work [ 479.913339][ C0] RIP: 0010:lock_is_held_type+0x4/0x190 [ 479.913366][ C0] Code: 29 04 48 c7 c6 8a 31 91 8d 67 48 0f b9 3a 90 eb bb e8 50 fc ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 41 57 41 56 41 55 41 54 53 48 83 ec 10 65 48 8b 05 66 eb 22 07 [ 479.913381][ C0] RSP: 0018:ffffc9000454f658 EFLAGS: 00000002 [ 479.913395][ C0] RAX: 1ffffffff1be8d01 RBX: 0000000000000000 RCX: 8a577734deccaf00 [ 479.913408][ C0] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8df41ae0 [ 479.913420][ C0] RBP: ffffc9000454f6d8 R08: ffffffff8f822177 R09: 1ffffffff1f0442e [ 479.913433][ C0] R10: dffffc0000000000 R11: fffffbfff1f0442f R12: ffff88802f961e80 [ 479.913446][ C0] R13: ffffffff8df7da60 R14: 1ffff920008a9ecc R15: dffffc0000000000 [ 479.913460][ C0] FS: 0000000000000000(0000) GS:ffff888125e35000(0000) knlGS:0000000000000000 [ 479.913473][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 479.913485][ C0] CR2: 0000563bc4b83138 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 479.913506][ C0] Call Trace: [ 479.913513][ C0] [ 479.913520][ C0] rcu_read_lock_sched_held+0x89/0x100 [ 479.913545][ C0] ? __pfx_rcu_read_lock_sched_held+0x10/0x10 [ 479.913573][ C0] cpuacct_charge+0x117/0x320 [ 479.913595][ C0] update_se+0x2b1/0x5e0 [ 479.913616][ C0] update_curr+0x76/0x500 [ 479.913640][ C0] ? __lock_acquire+0x6b6/0x2cf0 [ 479.913660][ C0] ? rcu_is_watching+0x15/0xb0 [ 479.913683][ C0] enqueue_task_fair+0x2bc/0x28b0 [ 479.913716][ C0] enqueue_task+0xb3/0x4c0 [ 479.913738][ C0] ttwu_do_activate+0x1dc/0x860 [ 479.913767][ C0] try_to_wake_up+0x721/0x12b0 [ 479.913795][ C0] kick_pool+0x47d/0x640 [ 479.913818][ C0] process_scheduled_works+0x7a1/0x1770 [ 479.913853][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 479.913881][ C0] worker_thread+0x8a0/0xda0 [ 479.913901][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 479.913933][ C0] ? __kthread_parkme+0x7b/0x200 [ 479.913959][ C0] kthread+0x711/0x8a0 [ 479.913982][ C0] ? __pfx_worker_thread+0x10/0x10 [ 479.914000][ C0] ? __pfx_kthread+0x10/0x10 [ 479.914023][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 479.914048][ C0] ? lockdep_hardirqs_on+0x98/0x140 [ 479.914064][ C0] ? __pfx_kthread+0x10/0x10 [ 479.914086][ C0] ret_from_fork+0x599/0xb30 [ 479.914105][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 479.914129][ C0] ? __switch_to_asm+0x39/0x70 [ 479.914151][ C0] ? __switch_to_asm+0x33/0x70 [ 479.914173][ C0] ? __pfx_kthread+0x10/0x10 [ 479.914195][ C0] ret_from_fork_asm+0x1a/0x30 [ 479.914228][ C0] [ 480.416720][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 480.423633][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 480.432784][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 480.442972][ T31] Call Trace: [ 480.446317][ T31] [ 480.449372][ T31] dump_stack_lvl+0x99/0x250 [ 480.454012][ T31] ? __asan_memcpy+0x40/0x70 [ 480.458681][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 480.463950][ T31] ? __pfx__printk+0x10/0x10 [ 480.468627][ T31] vpanic+0x237/0x6d0 [ 480.472659][ T31] ? __pfx_vpanic+0x10/0x10 [ 480.477225][ T31] ? preempt_schedule_common+0x83/0xd0 [ 480.482740][ T31] panic+0xb9/0xc0 [ 480.486520][ T31] ? __pfx_panic+0x10/0x10 [ 480.490989][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 480.496415][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 480.502710][ T31] watchdog+0xfdf/0xfe0 [ 480.506930][ T31] ? watchdog+0x20a/0xfe0 [ 480.511311][ T31] kthread+0x711/0x8a0 [ 480.515432][ T31] ? __pfx_watchdog+0x10/0x10 [ 480.520160][ T31] ? __pfx_kthread+0x10/0x10 [ 480.524799][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 480.530066][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 480.535394][ T31] ? __pfx_kthread+0x10/0x10 [ 480.540036][ T31] ret_from_fork+0x599/0xb30 [ 480.544664][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 480.549832][ T31] ? __switch_to_asm+0x39/0x70 [ 480.554644][ T31] ? __switch_to_asm+0x33/0x70 [ 480.559462][ T31] ? __pfx_kthread+0x10/0x10 [ 480.564136][ T31] ret_from_fork_asm+0x1a/0x30 [ 480.568979][ T31] [ 480.572644][ T31] Kernel Offset: disabled [ 480.576985][ T31] Rebooting in 86400 seconds..