last executing test programs: 2.310952636s ago: executing program 0 (id=3056): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000002ec0)={'netdevsim0\x00', &(0x7f0000002e40)=@ethtool_coalesce={0x4b, 0x3169, 0x9, 0x1, 0x6, 0x9, 0x8, 0x2, 0xfff, 0x10000, 0x4, 0x7, 0x4, 0x5, 0x4, 0x1, 0x5, 0x1, 0x2400, 0x3, 0x6, 0xede, 0x80000000}}) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="180800ee000000000000008500a85665b3004f0004000000"], 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000100)={r0, r0, 0x0, 0x0, 0x0, 0x42, 0x58, 0x0, 0x5886, 0x61, 0x0, 0x8, 'syz1\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000080), &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbf, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0x7c, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYRES8=r0], 0x50) socket$netlink(0x10, 0x3, 0xe) socket$netlink(0x10, 0x3, 0x6) r6 = socket$inet(0x2b, 0x801, 0x0) listen(r6, 0x200) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r6, 0x6, 0x3, &(0x7f0000000180)="5f4a57db02b4002de7000008a8b000", 0x10) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300020c000000000000000000000003000600000000000200000000000000000000000000000002000100000008000000000000000000030005000000000002000000ac1414aa0000000000000000020008001000"], 0x60}, 0x1, 0x7}, 0x0) r8 = socket(0x2, 0x80001, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000440)=0x1002, 0x4) r10 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f00000000c0)={r11, 0xff, 0x30}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd606410a600006c0006000000000000000000ffff0a010100fe8000800000000000000000000000aaf86d4d918d50bd18aa3aef14978bc0ca797cce158226624b88bde821f3a91d96abd517ff79ad3bd5c8e0bcd6084190fad6365070cdc611ba57c876eea011af3ee44e892a8d9df8e0f28c04597c0e30cdded573fd777366054424ce4bd29147c76a7cef3c158ba311493f"], 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r8, 0x84, 0x17, &(0x7f00000005c0)=ANY=[@ANYRESOCT=r5], 0x1008) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000006c0)={r12, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2f}}}, 0xc210, 0x800, 0x9, 0x10008, 0x60, 0x9, 0xff}, 0x9c) 2.173853844s ago: executing program 0 (id=3060): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket(0x2, 0x5, 0x0) setsockopt$CAIFSO_REQ_PARAM(r1, 0x84, 0x80, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000580)=0x8, 0x6d5a0a95) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) r2 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r2) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x3, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r3, 0x8, 0x0, 0x0, 0x18, &(0x7f0000000200), 0x1}, 0x6d) (rerun: 64) r4 = socket(0x10, 0x803, 0x0) (async, rerun: 32) r5 = socket$nl_rdma(0x10, 0x3, 0x14) (rerun: 32) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x24, 0x1402, 0x1, 0x70bd2a, 0x25dfdc02, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000180), r2) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r4, 0x89f4, &(0x7f0000000140)={'sit0\x00', 0x0}) (rerun: 64) sendmsg$alg(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x840}, 0x4040880) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001dc0)=@newchain={0x80, 0x64, 0xf09d2fbf8b68c555, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x8}, {0xfff1, 0xd}, {0x9, 0xfff1}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0x7, 0xa}}]}}, @filter_kind_options=@f_flower={{0xb}, {0x38, 0x2, [@TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @loopback}, @TCA_FLOWER_KEY_ETH_DST_MASK={0xa, 0x5, [0xff, 0x0, 0xff]}, @TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0xffffffff, 0x0, 0xffffff00, 0xffffff00]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x80}, 0x44000) 1.883837217s ago: executing program 0 (id=3066): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r2, &(0x7f0000000180)='cpu.weight\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000001c0)={[{0x2d, 'cpu'}]}, 0x5) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x1000005, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0x400, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x82, 0xd, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x84ac, 0xd9a, 0x5, 0x82a2, 0xfff, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r3 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000280), 0x800) ioctl$sock_bt_hci(r3, 0x400448e7, &(0x7f0000000580)="cdfe23509d0f8d234f461841cf710bd9c17c2bce37ae097bd24d6520a949588f3e7a5e91a35a2d55a2fb5e8e40988a0a392a3833b5d45b598423bb683daee30dfeb8bd012c6ca7de01ecf9e0dc9989a29c9880997165182dd61862f44753f750a981d3a48c005623e0c685954d19ae4d7aa99a85d0c7dfe4f5e36faedb9e47201e349b00579d8c8695b22bb0bffbe4a9052b68f6fa594ccb8ad5977f43b05619325a2159537736f7c80522a16fedca054f3796180bea25f6bbd294ae828db25b47821fbc8e72679cd9da8ea367661e24857e7678152c4df55b6fbd6124be8f8e64e524ba6ee578f48b6bbd1d20ebf5f1c91db7ef237008e3c1f750983b222d9b77f351275ee6541d6a88bef8d9f0e4cf42d962890004b26d43492933482a049314fbf80cd3c2d92adfd06be5a6ff16a054e3f393ab241f13a0f279e7fccfb1fb765596a8350e1ea161504f83bc560092bc24cf8d6e588a159e2cd156b968fc5800c7a0b77594c9d40e0f1b6e3cb8a3b34be6da74206f7f190b442ef10e9b974902ecd00eae6f15d17f2ff70babfce72c51ca58d30d07f9db69c344ca729eb4539acfdd51a01719331dde2961027ffcb4abff67ead01fa7e03798fdaff7c64d0d89042cd03ab57a329f68cc1b6f3260f9ce76873674bf4753b5c25d2ff3b8f185063962755dbde53ff6d586753b3d49bcc44f26b778a36d955ad1fb4ecb416af8a89c8d0079039bbc9a2bdc7ac4b60798e5b30871d79548ea6d9af757db7619606728c3a8e9909336ff213f37d9f6daec57b218d78abada726ab52f592c2637e0f6460573e633a4e35d1e92080770e1109afffd82ba74556929696cb0a5b3a7cd91df746d9dfb7bd95cb66da1c8c541bed52c96d7667f0f9b217330c5b89448e12ea9777ece4ec5221569d26e8a98a5d0733a1f85e30ac89af53b9734ba8f0ae5e40ecc853fb4e6fbc862a42064fb4151eb1b694fb6b844f04b7fd271b5f9d0a5357fa4f3ea274387a7bd2e4ac8a613c8b7248afc981a9a70150f17a7bab6527f2e6977dfd40045dd06e0731d2bd861f7b06e2f5dcfaa8970158d54ca2691567b16e6a8792eae9b359a7c736a3c9647ba303eb498eb9ffa578e2ed95f0877124f1b056f96e33f3121c4fc3d5ebef99b9fdfdea1d8d53686eea5bc8363f668853fd27b6c86bc03ae66de28d25045211701fdae3529e3ef1666dbadb7cd2b350c5803ec275c680f91bff1e86145a18a83eaa6f46975724f69be2386e9b6cbcc5855b9cd3869993faaee6c8d59d7c5ce359cc5223c23a2ed6265148f51ce3e3b941c250ae2559401ac2aea44bf548aba22c60ab49c3addc9ca84289ab95e88605441198bd3dfe3808c530067ed0f2958ad1b8c10f3c5636a404eccd5af3de65fef15b48732396caeeb1a9f0c1ac2a3a1e3a44a863c84e7cddcaea04aabe5bcdf2bfcc78ebfcf75e8dea64f3fee574a2245027b7ed07898d68fd2ce972c6a318aa3d1be5c0fef4e65d19ac05a4948916871e0c5a33be4562a92e7e4222b3016b07ea1d94153ff96ba767cc42c31bea03f244a8ef832e5292a980938da769e91af1abf9d8aaeaf2c7eabb191b8277c8432cef10b0c5dfef1b0f9ff59e83f3dbcbaebea126a9c5205058568e062bec2ada6b9af08d2a5c32374b214a39be685fdfcae2be3cb95235646d1bf84a797583f1f4c2f1c238c9cc9e96ad59357f464073287b4a57f22393559a3263b963b8123ca1e2a6eaf63395ff21baec7302ca5a3723adcc5048ec114288d56b89e4439d68c306350d40d15443548e0553741d552ad86c7b3160b7c39cdc9a411446a0fe1fd31171730de7688b9d9292521b0a4501ac87b812072ba9fdc5e378ffce2f41145525af54958a709e8d5e7a9d70203fee4e89f493d820fe49b0898c7573f560977a72f0f089f22aa1f2b8b0919f6584ff7bb3b3037716194c45f3386ab45b334d96a4afd5223994f26d63ae06a1730f39781e9f77ba3413d22d2befb9747fe36575acac8b44372888cf32b2463c6b42b32e58b2a755862c6d2db913d76ec2ba714feacd919f478136dadad6c3b75c38d4b774f1b437ff4ac5ba95cbdf59c95ee8a1c2ea80ff594899e17c7ad244c074d7b1fd8f8a719fd7909e1873c2008f174d80efffe012730af768da2e5096d83746aa8556d3229a117f05f3324148ccb8f7474917c4f50e9460351f13ecaa2f370353f4ba2eb10c1f6150dd9911330dafcfe35548b75e6d525e02a2a0d3e3ac954015a06e22882c556f50275f3c39aa6a5e188322586c269ddc04aa8e2733dfb3634746fbdced8140b88c57acbf870407b95f937b900af0a3724972dcbb216763dd8aa29a70c4271ff21c096952ab2a8996477478d325ffa6ccf09b7e127c85daeb5f8330c1cb3d92dff08b858562267f44f7c74835d5b828c5fdb136bb4157edbc2d39b3688c821f7be1e3e6594b7faf65b3d835c794171a5a55b0345fd325950d9752f984561fb9a0f06f82a6be7f9ad072a28aa9d6a3c712b1e842322a605ee2304f2cb94257d77813511497d61aca2c099c478facff38a81c6f28a197894fe172919109f898642ea2a8d877a4cc6bd8f60adfa06256fb412c3d409bdb9d44c37dafa591937fafeb236e2c8517710558464abdaef3dc6fa9fd558ad3598ec532ba93b493102fb37a6655bed4d831ef9684b8ca09c4560cee5b2eb9c7b9cc15b43117a582bbb4fe6955b262aada727bb8f329f7200b44b5ad5086a6d972eb18c8103c184104244967467d10f217ed1d556e4083cab3f5df9588a11d14faf715eaf8aacabf5bfef47eb9261bfb1674957460dd0ee5a221848cef8ffa87cc4ab91774534ff00ba7f947764579a8cfc69b0aaa43ee3dbb7ea878d3b2b5bf020122b9393559e0300310f4dbc5bfb104e4e19eccfde0bbf0d38ea242ea14dbf40eff81a10b507f8ee7b4e34de84e727af671e1a45d129053312245ab1d8b1d3819a41dd67585414039e78959afff511af2dad5a37d9fc804ae7708b541cec35d5ec7bfddad2de049055b759d2fa6c39002861c7bc268b991b49ff8897a3269041f35439b3ee77b05e3b76dbbe43fecd5599bf91989cf03e01e13010bf69656476fc28169614c7f5c50a415c4afc2d083dd39314b4294747792004e01d4a454c1db4054ac6a2d714bf4be6bed2550a41902a0757e744ad5bfff714de195d13d528a422016fb4dd30cc213908648e2a5b245d0f08bfd2675efa274f9e2e467e62eaab1ea9deb05a97b5e4e98f4693827d581462a70716b3f9858c91ea60280f108e2a11ed880666d4e004f70962933504b9364a369d6d2e496a9321a93723821a800041944add178a00cd212b52dc4499cc2ea16c0612f6bf5174ca971abe229c179d50b14d026d22fec168a59d9e994de277ac15c253ccadf71bd67e4b5d14e5cdff3f8ae1cdc6141f5e332a151e1e7256fe82b4e6aef49d20124d39b0c800b7a1a1d09a8bf1b62739ff9367f388bbdd74cc808dc1710405bcbfa916b5f831c6f491ff3d50fd5b4a42b0c76a3c0a97c86b161d51d6663e1c758d3098aa6ed1a602eb6e19d23f7069abe58d6f04430bbafde33454a1e2b4917c26f64173d225580db0df13ca44e2aaa3919bb6703d67fc33c00203b11a5b9af5ae3d74a117e231efb6c4ed54b30c72e9cc78234c20d9775ae5701ebe776188ec29d3f0090b0ffaaf4bae906b9c6ee9c8ff0b8600d1b07f8331abe5d22eb9cf75875b5d57aecc64acf7c134c1a515f6f060c186f216ce71ea308a208f58c27a5be8e59647ea5dd93cdb91bdcaca4cbb29464fb5033385c34dec1a855c0bd2f92744b8e502c7f29f0c98dcea0d3bc2f73b99a8e739a5dab0e54ffc07738872000eaa8be883dfbe90c9efca5b60a076955a74187c11213132ef5659bc64db97769342395e0e639bd9bbc04fd03f4e169c57eb68eedba83b2740c27c06b5c27e714adbf64cd86aa782b626facb6969d7799cbd83413da0da622ba1c5933d118b5ccba871b801b58a84b1390ac8a6882f1ae5db6d0fcaab58725bf70dac32010f0b6afdaa91815ff5021c7ce7dfd39ba72da92632377e33673458bf546d63d3fb6810189d3acc7f349b2aa2db89952dc56eb45f17a2f0d92c24790e9fc94b759f9a82824b22af02275c9bfb1e1327f62da37f53f2482a7def171087112f2af914b74e4bf087d9854e06c38f8164637495d2c7486f0bc14660beceae04e3fc03fa136c0530c3a55c42f14d36004a0ae1ab70c1774f28861c2da10776048cae2c4d6eb131f264da2507ff312ee13b892aefb6d5c66c4f7d2cd5f2d83d74367f34eb36afa52519b6dc60ddc9115d08f86ceab871dd42e9d594471b4e37b3bc3c6e6e943845d438396f67cff32bdf1591985bce0d9212aec3997df59bcf8ae02ee4a4a4a81573177d9b525b5eca10dfeca26abaf0f76dafd48d1af2e651d188c2872d2354a067a509a38b75e437d31eb2467e9efaacce0d78347c675b2ca58ca4f1c7ba1cf1d3b8b9d30b1cdb3efbf37d57e88867fba69742897a81420c1adc8a887e1acc5243fc5339779f62bf177dcc98e3ddb65ad1f1588a05d1386e7453921c430b5a23a5c7b98eaa0db68fe2c68811f9eb742e8c23da74ce2c22d85790a2cc5c0659a70d9713e4f6697c9933ce57fbe777b400e7f6985fe954ec4bb43e465b2416fb8dab6e176fcbe28ab4288271422b26cf588d5fbf908c452cc618d1916b6cf962fcc6c5c99424110b1893145cb203c90851c2e55a6ba157254ce744f0280fee1047f020115e7239b5eba0ca2e4481fc9011044fc0b9c3921edad1c6a26b14b495e744461a7c0fd119e01c3bf29901c9e0d7e1a545e306b716aacb102f3da249476b64d0c302b82ea166f54b15d30bad968a009e6312456713e8ea2df58c625286128c27f7388b96fe29eced7732b62840fe8ac22fba6dd05eb62d7a50c701f3f554949e708d252f7413f80a81588af86a71c596a1e6b2241b55592e3b27ac7c6dbf513c2501d0692840ec7e86d06fdc594cef381402fc07f18ec95ec86bb236c2a588c07ce665ace36db017b2dc2eec5f6b996cb4782e99908f9724856c56982cff1c32bc0182da7c2d1023b23cdb2e70b2254de2f6352c870fa54240aa21b4fbfbb59c0b616ad2860688706ee0dfe4b57c966e4ce7514a762a211ffe1a7b31a1b62aba2b20968ca37be3ca328c238592d8d019da61975e08cc9d59a9612e3a0eb4101b14adb2fae3f6bf5ca98a0bb0db5919276941f854fd2b462330b978b3c30aa17e3ab66da43124c8d7d060465349f4c161b5112b71e7d0b2ae75a4550ac8a7a39366bb30520732d4dfc1cf66fb9fc4620cd2edf4805c1a9f9cfb4913a7e93e297f69ac028e621749d68624b01477145693c59f831276421c770605ea3b2e9d4843718ca25fc6090c95f6ab4868919497e04a81b89e1b58c04333f5e78910053253fa5f85e429735520367e58cac6b922f6a68a2ea4b2d3bdb2ef0f4235d67e493832d860b2c6bbdefd3d2821d5b5e2f14efbf4b6561e3a44cecc93f7da7260eaadde18c9dbff9fac93612a404b892e15e94bb766c252bc4c74359f858581599d9aadff72a2779ce1fa0cad2a368bd19a6a86b604d846ca3ab085b9791bf7cc792b86db7aad3f9df67568b2b609c5c7596137fd488c7f02ea6a42e415dc3a8d3bdbddc5e24452040ba448766e36e2aa4de9776c7346fcd242041c6318ad670494250f8b1b95e65165b46f07f6a932eadc8d91af1316764d453e63e9763626043c4dcc5136823c623094a9bc") r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, &(0x7f0000000000), &(0x7f00000001c0)=0xc) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2, 0x4, 0x8, 0x3, 0x20, 0x0, 0x0, 0x0, [@sadb_key={0x1e, 0x8, 0x730, 0x0, "636472ddfef22bede770be34024ae2d95d499eefd4b5975d12387696107b1b9c3a90d89d7a3ad624c9ff58bc310e25d1709bf5e8131cbd1e86b38b3d01f1f1768a7b3063a25a213e7ae880d9cb27e5388c3486e8bbcac9d5e8eeb89900d72b96b4380c5f334dd73399870debd9a8cadf8b366f9417216f5fe623eb9b95baf17e8d2fde41152ae5b0e50343c294a0962b4e73c154c198e180f1a49a1ead3818fa1e7bae87e5450623432dfdd6886438bb3be7b6e0c02133a6b4a24bedfedf141c1e153b5aa9ca8eeb4c59c36042123fb182c2c6f78a3a3cbfce7ed81e8229ed4336ba63369fff"}]}, 0x100}, 0x1, 0x7}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r9 = socket$inet_sctp(0x2, 0x5, 0x84) listen(r9, 0xbabc) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r9, 0x84, 0x1e, &(0x7f00000002c0)=0x400, 0x4) ioctl$F2FS_IOC_GARBAGE_COLLECT(r5, 0x4004f506, &(0x7f0000000240)) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r9, 0x84, 0x1e, &(0x7f0000000000), 0x4) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r8, @ANYRES16=r9, @ANYRES64=r5], 0x48}}, 0x0) 1.675164115s ago: executing program 0 (id=3070): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) 1.547954794s ago: executing program 0 (id=3072): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="d800000019008111e0020f060d8107040a600200640f040b067c55a12a00090008000699e3ffffff14000500fe8081780c000567b8b7b9400200", 0x3a}], 0x1}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x500, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="020300090c0000000000000000000000030006000000000002000000e00000010000000000000000020001000000000000000300000000000300050000000000020000007f0000010000000000000000020013"], 0x60}}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000100)={0x28, 0x0, 0x0, @my=0x0}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r4, 0x28, 0x0, &(0x7f0000000340)=0x3, 0x8) r5 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$inet6(r5, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000f40)="29908231db0794467111ed689e0866f8fe322148afedf55e8765ea2b41d85d17f55285f4d73a9d86028cd80c59a6cdc148a0092564ac6b191138381eb17a606bb994a0f41c36283dad5331e3eefc6692", 0x50}], 0x1}, 0x40000) recvmsg$qrtr(r5, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ec0)=""/64, 0x40}, {&(0x7f0000000740)=""/178, 0xb2}], 0x2, 0x0, 0x0, 0x2}, 0x38, 0x2) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 568.999431ms ago: executing program 3 (id=3078): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000740)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_bpf={0x2c, 0x2, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x5}}}}]}]}, 0x70}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd502000000090001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002eb0e00000000000000000105000600200000000a00000040010000000500e50000070000001f00001a000000030000a95a6e870200010000e9ff070040000200000000050005000000cc580a"], 0x80}}, 0x0) sendmmsg(r4, &(0x7f0000000180), 0x400008a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x10}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r2}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 568.43572ms ago: executing program 1 (id=3079): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000180)=0x8, 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000001c0)=0x51) pwritev(r1, &(0x7f0000000040)=[{&(0x7f0000000200)="80fd020000400a9eb2020b8e17db1e6e6d2195f77c9a7fb556d8a445d9716fdc85b71be1719c926bab75ed78f8e8d39eba3994dd63ecf313c0fc4fcc05565e5b4af9", 0x42}], 0x1, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x8, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x5}, 0x1c) 567.771489ms ago: executing program 4 (id=3080): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x24, &(0x7f0000000440), &(0x7f0000000100)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f00000004c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x55}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 564.051309ms ago: executing program 3 (id=3082): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@RTM_DELMDB={0xf8, 0x55, 0xb24, 0x70bd2c, 0x25dfdbfd, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x2, 0x0, {@in6_addr=@rand_addr=' \x01\x00', 0x8edd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x0, 0x3, {@in6_addr=@empty, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x0, 0x2, {@ip4=@multicast1}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x1, 0x4, {@ip4=@multicast2, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x1, 0x3, 0x3, {@ip4=@local}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x2, 0x0, 0x0, {@ip4=@broadcast, 0x8edd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r2, 0x0, 0x2, 0x3, {@ip4=@broadcast, 0x10dba}}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x24048800}, 0x4000000) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r3, 0x10c, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000280)=@newlink={0x48, 0x10, 0x503, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000002}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x48}, 0x1, 0x0, 0x0, 0x8090}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000014000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b33e0f32f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3cd3cedd01fdc59589ea6bacde1e40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8b0100010000000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7a7216f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe00000000000000000000000000fdba1133066c4a21a7149f32"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) 563.382906ms ago: executing program 4 (id=3083): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='blkio.bfq.io_service_bytes_recursive\x00', 0x26e1, 0x0) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa", 0x1c}], 0x1, 0x0, 0x6b}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) connect$unix(r4, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="b2", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES8=r3], 0x18, 0x10}}], 0x1, 0x0) accept(r3, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c00000044000701fcffffff00000000017c000038000480312d"], 0x4c}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) sendto$inet(r2, &(0x7f00000007c0)='%', 0x1, 0xe044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$unix(r1, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) 557.869165ms ago: executing program 1 (id=3084): r0 = socket$netlink(0x10, 0x3, 0x2) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x14}, 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000800)={'batadv_slave_0\x00', 0x0}) sendmsg$inet(r0, &(0x7f0000000940)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000740)=[{&(0x7f0000000200)="45e3418c8a712169d2e02bda38426a372d33c16ddb468942e796cf16970e2ef26458d6d70e33b0191a7e327d4dc7a588afb4805b156aa73285a606962904509bd7a079d3fa0b031a2cba4c4e293ed3cdf6cc52d17e669be911223f364a81f8cf33eb4f6ca41d534786d73007b7b72e819de1f950161b855393946e85f7cc0b1143ec8f567caa0ed1961fb79dd3c1abfed25da67a5f946f1e3bdf024001b9d05231408381289a152e41e8c7b3e4dea1343ce14b7113b4f99c1dbe25d7f03632fc83337a4313c64eabdd1cf0169a83615816098833a1f1ba923c2d8773ddca4dd878fadae93b1d26d5b89dc7dc632f6b11a5", 0xf1}, {&(0x7f00000000c0)="95d4842a1f2a771d1f2c5088f62b93686c97ba834dedb71394e95234dab8437165e820598a68b246cea2a25f3aebce00b9ab36b6d84a1e59841d651b029d8707d64df1bc18013b9fa653096bc8cb", 0x4e}, {&(0x7f0000000300)="a950f0aaa21ffea71eb2c0e0f9e30d1a422e6430e7d5eba86f8b319c46b8928d2074c3bb1488acf3fb937bdbb73d314dcdfbda73b8129a7e08007d3cb1bd68852d8f8ee1a12dbd50f50868a12ea66a91e5c5c0a28c8d4bb4ac0f037f1d8f28017cf2272e18f2454d9fb86ffcc1070acdd22574cdc23aecc8ccb39f8a68db27f15c05cd099cd43de46850bec5b2a91be0189e3753482a5064afcdc002ae6345d869a810942aeff6b759206d7f22e6b36dcd09cccba998551aa2bbafa03c2eb082de6ebde6c36b945508e08afd465da2f25e7f20e4056225695d", 0xd9}, {&(0x7f0000000400)="4f4b4c0a1266337f01dfc3a00760adac43d66ea9cb375c19d9479eb8c6643b7c5a56c2e96b52c228f9854b2a5a62af46ac24de0c227fbfb7005d96fd3810f8a422866e7e3bab00455bc20d2e13a6b8645eb493d917635b5a8a", 0x59}, {&(0x7f0000000480)="21eef7d3b18f4c64fee71558a6365f622491b031bc0cd2d32d5f1534e73757c1a191e0091a01a1769500f27aeedbb789887906d0d1ee0d8e9d66044a6d4f3cc6456eec5a4c2dac28211aac4bfdc9f2a4f74e518184b9f24276b099617721cc09ef7a93aa540825c6efea35570ae6fe120fada01da928c2d94787e4ef976af0af88ac52ae03a30f4e83fb4ab4925c7d33bbd6f791ecae42657b7a8c7c0b9a5ccb870563be788a7068410a5d3dd51cfda8cbb6d6e7e183ec3dc5a5a3", 0xbb}, {&(0x7f0000000540)="bc8eeddfd9a8862c118bd0a0f0fae1b6abce23d80ad646a8eb966e9672eca017a4787ae359dbd9159176c6a6ccac6f14f27f506deab0e793eb579f953668f8a290b0d073e1a4335e6d3f0fcd3ca578e4af3c203df0955bb9669a55baff169446dcb36b90597b809ee67b231d09b754e6df75746271", 0x75}, {&(0x7f0000000140)="1be4a4fa30d950da842615ba164d88637c2e03612119d21942385ac04aa4987d7b7a23fb8e645e", 0x27}, {&(0x7f00000005c0)="a4748a033eec3f20d105913a8f3572c212581bc151bf9a0b8baf8dc2e4559baa21132dbdacd12a3fcc6fb5fde1ddb79068f7a813b50d71e273f8c80def7f254ae75a61606d139f9e6b49842851497ec51b46ca1567946a8907795da5672681ad768bb9844b265b56e6d639ce50fc2d16ae5a5ffc8e3a9adf959c6b999336d04d8ad3794605f62bc9052b7c3658346cad5805e19f387b07f0f5e78bd20f947d4f3f2ec63afc339efebdd3143848bb4397117e1f247ba10839766ce615ed179d76a15bb94beb1ea3d1ec17e3f99cdf7137161bd606a05faa09fbe2d50a14eae318856c0694605ba65790a53f8c9b5e0897cdce1f75011c3d93915e", 0xfa}, {&(0x7f00000006c0)="f1d564265194fb33e4e27a613954359bbefa6c8b55a5460f11bf6c7fe73a7871e6f61353f26135c3f235300b7d2a7c9d9bdf242327e4ffacba60c7a6d1b9234d1ea3fdfe", 0x44}], 0x9, &(0x7f0000000840)=[@ip_retopts={{0x70, 0x0, 0x7, {[@ssrr={0x89, 0x17, 0x89, [@multicast2, @local, @loopback, @private=0xa010100, @empty]}, @ssrr={0x89, 0x7, 0xb5, [@multicast1]}, @generic={0x83, 0x8, "8c6538905a17"}, @noop, @lsrr={0x83, 0x1f, 0x35, [@multicast2, @local, @loopback, @dev={0xac, 0x14, 0x14, 0x17}, @multicast1, @private=0xa010101, @private=0xa010101]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x8a, [@private=0xa010100, @remote, @dev={0xac, 0x14, 0x14, 0x14}, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x37}}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xf}}], 0xf0}, 0x80) 553.088391ms ago: executing program 4 (id=3085): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {0xc, 0xd}, {0xffff, 0xffff}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x20, 0x0, 0x0, 0x0, 0x1, 0x2c, 0x9, 0x0, 0x0, 0x2], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20]}}]}}]}, 0x8c}}, 0x0) (async, rerun: 64) r1 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) (async, rerun: 32) r10 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r5, @ANYBLOB="05005b"], 0x24}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) (async) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r13, 0x1, 0x0, 0xfffffffe, {{0x8}, {@val={0x8, 0x3, r12}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x2000080) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r14, @ANYBLOB="4000aa000a0002"], 0x28}}, 0x0) (async) sendmsg$NFT_BATCH(r0, 0x0, 0x0) (async, rerun: 64) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000500)={0xe0, 0xa, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x80000001}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}, @IPSET_ATTR_ADT={0x88, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x94}}, {0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0x0, 0x18, 0x1, 0x0, 0xe}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0xffffffffffffff4d, 0x9, 0x1, 0x0, 0xa6f}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x7f}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x29}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x3e}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x7, 0x1a, '\'*\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}}]}, @IPSET_ATTR_DATA={0x20}]}, 0x13a}, 0x1, 0x0, 0x0, 0x4800}, 0x48080) (async, rerun: 64) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r15, 0x0, 0x0) 550.949337ms ago: executing program 2 (id=3086): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000300)={{0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, [@null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) bind$netrom(r1, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES16=r0, @ANYBLOB="c23d130c408e8304006ca830c08fe9da118fb54400e00d48fef92cf8ff000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00001e000000000000000000007b1613af5c98100f00000000000000", @ANYRES16=r0, @ANYRES8=r1, @ANYRESDEC=r0, @ANYRES32, @ANYRESOCT, @ANYRES64=r0, @ANYRESOCT=r0], 0x48) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='nr0\x00', 0x10) (async) sendmmsg$inet(r2, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) (async, rerun: 32) r3 = socket$netlink(0x10, 0x3, 0x15) (rerun: 32) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x4, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x408c4) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x50, 0x10, 0x49920d862a92153b, 0xc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90c1, 0x5c81}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private0={0xfc, 0x0, '\x00', 0x3}}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x50}}, 0x48010) (async, rerun: 32) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00042dbd7009fddbdf2504000000db312de286b6115936964580b92f282b9042530850cae94931913c6d69904db17a3e427e4e1aab806f588f2d7f54ed4b7779e1471eb65667bb537c1520e249aa1613c73d2b583c62a18bf6135d2a55a7d0c738d0"], 0x14}, 0x1, 0x0, 0x0, 0x6040000}, 0x10) (async, rerun: 32) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWSET={0x22c, 0x9, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_USERDATA={0x8c, 0xd, 0x1, 0x0, "e1596dcbef58f86fb0d37e443d7a80b4d9088791981eaefa204f2261ad55d4c38ccb55d7c2be6fb4fb8ec467a445d997d8e55988da8c21d7325b37e23778e8f7302dc8901a8a911aed04a38c46c21ffb2dfac2375b1b583c698d9c9be4002e6eed9328fd4d6b7a51ce3285adb6b5a2d30d8e5b54944d7f04ace98877f4af7b9090c32ee05c1ff31b"}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3c}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x108}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x161}, @NFTA_SET_EXPRESSIONS={0x7c, 0x12, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @quota={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @redir={{0xa}, @void}}, {0x18, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x291}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x401}, @NFTA_SET_DESC={0xd8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_DESC_CONCAT={0xb4, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xc00}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x800}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7fffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5b9a}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5d}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xff}]}]}], {0x14}}, 0x254}}, 0x0) (async, rerun: 64) socket$inet6(0xa, 0x2, 0x0) (async, rerun: 64) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) (async, rerun: 32) socket(0x10, 0x3, 0x0) (rerun: 32) syz_emit_ethernet(0x2e, &(0x7f0000000400)=ANY=[], 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000fcdbdf2512000000180001801400020076657468300000000000000008000000080009"], 0x3c}, 0x1, 0x0, 0x0, 0x400c000}, 0x2004c0a0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) (async, rerun: 32) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="5000000003080101000000000000000000000000050003001100000006000240004000002c0004"], 0x50}}, 0x0) ioctl$int_in(r7, 0x5421, &(0x7f0000000100)=0x9) 549.534714ms ago: executing program 0 (id=3087): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000080)=@newtaction={0x18, 0x30, 0x9, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) r2 = socket(0x11, 0x800000003, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000fc0), r3) sendmsg$NFC_CMD_SE_IO(r4, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001080)={0x24, r5, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NFC_ATTR_SE_INDEX={0x8, 0x15, 0x2}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x44040}, 0x2400cc84) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24040800) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000640)=@newqdisc={0xb0, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x12, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x80, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x0, [0x8, 0x1], [0x0, 0x8, 0x0, 0xfffe, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffd]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0xc0}]}]}]}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f00000000c0)=0xc) getgid() setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0)={0x0, r8}, 0xc) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r10 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r10, 0x114, 0xa, &(0x7f0000000180)=ANY=[], 0x4) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b04000000000000000002000000380004803408c196b9f4975638617267657400002400028010000100434f4e4e5345434d41524b0005000300ef00000008000240000000000900010073797a30000000000900020073797a32000000001400058008000240000000000700014000006006140000001100010000000000001100000000000a"], 0xa0}}, 0x0) r11 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r11, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x3, {0x0, 0x0, 0x12, r12, {0x0, 0xe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETOFFLOAD(r14, 0x400454d0, 0x1) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000000500)={&(0x7f0000000300), 0xc, &(0x7f0000000480)={&(0x7f0000000540)={0x6c, 0x0, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x7}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c4}, 0x88001) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001e000100fdffffff0000000002000000010000070000000014000900766c616e300000000000000000000000080001"], 0x38}, 0x1, 0x0, 0x0, 0x42812}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) 549.229932ms ago: executing program 1 (id=3088): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000002b0007010000f4ffffffffff02"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000002b0007010000f4ffffffffff02"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x4000800) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)={0x78, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x64, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4c}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "a34951bc2473fb9de5bb04150bfbe00e87e9f218c911a0ed96585baa8dafc5abb81a9be2"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x1}, 0x0) 548.410402ms ago: executing program 2 (id=3089): setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0), 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x10, &(0x7f0000001640), 0x4) (async) sendmsg$unix(r0, &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x804}, 0x40) (async) listen(r0, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) r1 = socket$netlink(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) (async) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000100)=ANY=[@ANYBLOB="61ffff00"], 0x4) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) 546.951471ms ago: executing program 3 (id=3090): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000002340)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}], 0x1, 0x0) shutdown(r1, 0x1) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000002c0)={r3}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000080)={r3, 0x3, 0x40}, &(0x7f0000000100)=0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) r7 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) sendfile(r7, r6, 0x0, 0xf2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x3, 0x4, &(0x7f0000000380)=@framed={{}, [@ldst={0x0, 0x0, 0x1, 0x0, 0x7}]}, &(0x7f0000000480)='GPL\x00'}, 0x90) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=ANY=[@ANYBLOB="180000001500010029bd7000fedbdf252d"], 0x18}}, 0x20000000) 544.73657ms ago: executing program 4 (id=3091): r0 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r2, 0x80000000, 0x2, 0xff}, 0x10) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000001c0)) 463.915023ms ago: executing program 4 (id=3092): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d5000/0x3000)=nil, 0x3000, 0x0, 0x13, r2, 0x3000) (async, rerun: 32) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x1000000, 0x12, r3, 0x80000000) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000440)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff00003506000002000000170600000ee5e50cbf250000000000001f650000000000007507000002000000170700004c0001000f75000000000000bf54000000000000070400000400f9ff2d3501000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c45402000000a2d23da04d1ffc187fa1a2ba7ba030c7267c2de00435fd233cc0f0d9b2c3127c46b0f408398d09ee4dc258d726eae098804ce25df627a64ac7efde50fd7f1dd5b17ed764c33b06598bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d47dc570a385a459ef8e6ada84e987cc0000f6991078a21788cab9d53ad890206ab56506ab08b294c09ea4536e0b9bb0627a03a1eb9cbe6958812a98abad49f42a6fb2b69c0880548c39f13f4cca63a87ad7ff8d1006cc6d95e406deb61b9c7ac3f35f1fdb27e70900001fd13d4a22fc90e5f7300c53f2b6e7e001058dc04b434e379fd5526b52990b04b183c21e6b974a4bf85567348c6c6a4404d987f71d81fe988ddc82dac01bbb43e006203a31b02f9519ffb29cd3508d7da829712c98381a672db9fa6a8eb38d784c913a804557c4577a22acb7b73c4aa0e07998734fdfbb0d262ef88b3b8cd1a8518dd8326f6367ed938a05c108cf2639e8799fd7cb018f08453fa863f8fb8178569d26a0a48e4498f88d15abbb22d955a162ac1fd3710c1255fbe3c6d1e84152c81ec0192e54d13dc5beebe3de27967e5d1aa8a6139056e3fb738d0ca46b0a1c63a29002e5b12314390ca075ecb43e0c6cd5af64c8b676316b9bff845ea0b20562f53c5b34314411bf3d4af06bdc3def9f2791d6d076ca72e319e6a9e1098bab878a9f1274a61ddee47abb54d8cf901e78bdb85f47ef37dd0daeb6403820ee8414042904917ea1b80a0000000000004c84018fd19fb3581ca1ff9fb5758d76929ec0502802869c51511c2c9dc56ead1449c038e4d2382d6ef61a7d9399cb"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0xffffffffffffffa6, 0x0, 0xffffffffffffffff, 0x60}, 0x48) (async, rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 64) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r5, 0x0) mmap(&(0x7f0000692000/0x1000)=nil, 0x1000, 0x0, 0x12, r4, 0x0) (async, rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 64) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000080)={'syzkaller1\x00', @multicast}) ioctl$FS_IOC_RESVSP(r6, 0x40305829, &(0x7f0000000540)={0x1100, 0x0, 0x52, 0x10000}) 456.684144ms ago: executing program 1 (id=3093): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000006140)=ANY=[@ANYBLOB="14000000100001000000000000000000002586de3c7faa9e3cba2feb8900000a20000000000a03000000000000000000030000000900010073797a300000000000000000090a01fdffffffffffffff000300000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000023200011800e000100636f6e6e6c696d69740000000c0002800800014000000000140000001000010000000000000000000000000a4a79039d"], 0xa4}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="14010000330001000000000000000000070100800c0001"], 0x114}], 0x1}, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x28) unshare(0x26020480) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1001, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, r2}, 0x94) r3 = socket(0x40000000015, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x2719, 0x0, &(0x7f0000000080)=0x39) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff000000287110bf000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) socket(0x10, 0x803, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f00000007c0)=@newqdisc={0x160, 0x24, 0x2, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x6, 0x6}, {0xfff1, 0x8}, {0xb, 0x6}}, [@TCA_RATE={0x6, 0x5, {0x4, 0xf9}}, @TCA_RATE={0x6, 0x5, {0x7}}, @TCA_RATE={0x6, 0x5, {0x6, 0xfc}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x6}, @TCA_STAB={0x11c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0xfc, 0x7fff, 0x71c92ef8, 0x1, 0xe, 0x1, 0x1}}, {0x6, 0x2, [0x9d3]}}, {{0x1c, 0x1, {0x0, 0x3, 0xb1, 0x8, 0x1, 0x5, 0x0, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x8, 0x1, 0x800, 0x101, 0x2, 0x8, 0x175, 0x1}}, {0x6, 0x2, [0x0]}}, {{0x1c, 0x1, {0x2, 0x0, 0x61b1, 0x3, 0x0, 0x80, 0x8, 0x4}}, {0xc, 0x2, [0x9928, 0x6, 0x5, 0x40]}}, {{0x1c, 0x1, {0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x9}}, {0x16, 0x2, [0x2, 0x8, 0x3fea, 0x6, 0x7, 0x8, 0x80, 0x6, 0xd]}}, {{0x1c, 0x1, {0x3, 0x2b, 0x81, 0x2, 0x2, 0x0, 0xd, 0x6}}, {0x10, 0x2, [0x4, 0x5, 0x5, 0x0, 0x0, 0x7]}}, {{0x1c, 0x1, {0x2, 0x4, 0x70, 0xd9, 0x0, 0x3, 0x2, 0x2}}, {0x8, 0x2, [0xfffc, 0xff9d]}}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x8, 0x70b924, 0x80000, {0x0, 0x0, 0x0, r11, {0x0, 0x8}, {0x2, 0xb}, {0x9, 0xfff1}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x9}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xffff9fda}]}, 0x34}, 0x1, 0x0, 0x0, 0x24008011}, 0x4008000) ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'vcan0\x00', @random="2b0100004ec6"}) r12 = socket(0x2a, 0x2, 0x0) getsockname$packet(r12, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 455.624933ms ago: executing program 2 (id=3094): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = accept4(r2, &(0x7f0000000340)=@l2tp6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}, 0x0, 0x80000) sendmsg$nl_route_sched(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40c1}, 0x40) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f00000003c0)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000480)="10c8e17e8cfe8bbfd7c8a66bad5f86699952e0f2953876c4560101000000", 0x1e}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000001080)=@assoc_value={r5, 0x5}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000100)={r5, 0x10000}, &(0x7f0000000300)=0x8) connect$pppl2tp(r1, &(0x7f00000002c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @multicast1}, 0x3, 0x3, 0x7, 0x2}}, 0x26) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@getchain={0x4c, 0x66, 0x300, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0x3, 0x8}, {0xc, 0xd}}, [{0x8, 0xb, 0x7}, {0x8, 0xb, 0x7ff}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000000) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x30, r7, 0x1, 0x0, 0x0, {0x7}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}}, 0x2) syz_emit_ethernet(0x4c, &(0x7f0000000140)=ANY=[@ANYBLOB="176d52f95586dd6001010000161100fe8000000000000000000000000000bbfe80000000ebffffffffffffff0000b800030e22001690580203000000000000ffb00afe4e7000000000"], 0x0) 415.685943ms ago: executing program 3 (id=3095): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x34, 0x3e, 0x9, 0x0, 0x800, {0x3}, [@typed={0x4, 0x4}, @nested={0x1c, 0x1, 0x0, 0x1, [@nested={0x18, 0x10, 0x0, 0x1, [@typed={0x14, 0x12f, 0x0, 0x0, @str='veth1_virt_wifi\x00'}]}]}]}, 0x34}}, 0xc0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x30, r2, 0x70f, 0x0, 0xfffffffd, {{}, {@val={0x8, 0x1, 0x15}, @val={0x8, 0xe}, @val={0xc, 0x99, {0x0, 0x79}}}}}, 0x30}}, 0x4081) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x74, r2, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x74}, 0x1, 0x0, 0x0, 0x24008080}, 0x0) 390.177851ms ago: executing program 2 (id=3096): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001"], 0x122}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x63, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe, 0x3}, {0x6}, {0x4, 0x8}}}, 0x24}}, 0x40004) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84) (async) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa08060001"], 0x0) (async) r1 = socket$can_raw(0x1d, 0x3, 0x1) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) (async) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000000380)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000800)={0x2a0, 0x13, 0x100, 0x70bd2d, 0x25dfdbfd, {0x3, 0x41, 0x0, 0x1, {0x4e21, 0x4e21, [0xe0000000, 0x100, 0x9, 0x800], [0x8, 0xfff, 0x8, 0x8], 0x0, [0x7, 0xf5e]}, 0xa09, 0x3}, [@INET_DIAG_REQ_BYTECODE={0x7d, 0x1, "c811236099caa99807741f47d6235c3865473556eb536189c4ac3f704e4cc2ceb5a6470e4bc33eaedadf7e9f1a85bbb4877950f3e66dde5104d4babf760b4f0776d5610964991d49d9305b995ef668b697c0c9ae79f64728dbe5d7288981fdfce5dd048f41b4e01ae26b85310e4c2dfa2d96dc1185c65e5c49"}, @INET_DIAG_REQ_BYTECODE={0x6c, 0x1, "5b52f6201ab88d57b11fbde54bfb1cdf85ce6398c50fa24d12e1b52a639d201264f6d66db644158ad4192f5b32076874431a6739c1c352c8db6cfbf2ff50a4e46961ae9c5a9c83d3a4ebb21382b9c61771e4a4b2a0ef1bc6bb8243e635396c70d02c3dfac89a9c79"}, @INET_DIAG_REQ_BYTECODE={0x5d, 0x1, "3341a08ef4ad0e23683d617f288a7e6ff160b1282e41697f32104bd131fe94a337bd9df1acd3051fe3e40a2d4ce70df87cdd3e7166de93218ec809b142949ed46d3fe2150751303c32297599a8ffdcbbb2a35bf7acff57a095"}, @INET_DIAG_REQ_BYTECODE={0x97, 0x1, "2df367be6a3f8cd95cec95af66080d27c50eab0558312dcd3eed693b5cfe08da9c5627c46d8c05ecd1d860d312f034f072d65602353405304a4c888793d0d8565c2046b3b4d1c09820ca1e77f0850c227e03cee8abf850be8a8553c80a4faa8f6820804f2f1909a09292ba24a21a0d6b0850aa09959b155db5c9573d3a33675d10cfa94335dcbb2130da5730a61729a2fb3409"}, @INET_DIAG_REQ_BYTECODE={0x6d, 0x1, "e7c3ed9ec7a5418e52bc5c768172cb4c22615ee223378ed646e8005fac0cf584966072d53b3d1a253b287e22473731962fba4e4004689b38a875b30eae99e636d6c1ea196a650c54ae95654f5276f98e3a8dd5cea2b2d94d85bdf6c4e93c29619322611cdd44fdd568"}]}, 0x2a0}, 0x1, 0x0, 0x0, 0x4008041}, 0x4004000) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0xb, &(0x7f0000000000)=0x40b, 0x4) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000081f33423230273cda6c771a627e74197acf2f80dc86a41c709d43b066e5338c6c22937873218772ec24a587ec977051191203e664e3c3307b108252aed26c576b07af86df5640583603ccb223333db4ea59acd01de0fd5", @ANYRES16=r5, @ANYBLOB="0100000000000000000023000000"], 0x14}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) (async) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="030700000000000000000800000068000480"], 0x7c}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0xbc, 0x24, 0xf0b, 0x0, 0x3, {0x0, 0x0, 0x12, r6, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0xffff], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x16, 0x5, 0x1, 0x5, 0x0, 0xffffffff, 0x7fffffff}}, {0x4}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 322.845094ms ago: executing program 4 (id=3097): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x200000010, &(0x7f0000000000)=0xfffffffc, 0xfffffffffffffc40) recvfrom$unix(r2, 0x0, 0x0, 0x10102, 0x0, 0x0) close(r1) ioctl$HCIINQUIRY(r0, 0x400448dd, &(0x7f0000000240)={0x0, 0x0, "101000", 0x7f}) 314.806694ms ago: executing program 2 (id=3099): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYRES16=r0], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000280)='mctp_key_acquire\x00', r1, 0x0, 0xd}, 0x18) sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000080)={r0}) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x3, &(0x7f0000000d00)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffeffff}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000280)='mctp_key_acquire\x00', r3, 0x0, 0x9}, 0x18) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000240)={r2}) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYRES32=r5, @ANYBLOB="914a3edada43e107854242e98cbbc239d05d52f12d3ed5b8151675816edafe9db9598d4fc62a5e73da29b82c9dd29b1504bd7ebfe35f6d6b8f7d3ad834416f2694582b107271d4462e70d8637eaee5b7a9", @ANYRESOCT=r4], 0x2c}, 0x1, 0x0, 0x0, 0x4005d}, 0x20040000) 239.449544ms ago: executing program 2 (id=3100): ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x2c, r4, 0x1, 0xfffffffe, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x4, &(0x7f0000000200)=ANY=[@ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000400)={@map, r5, 0x5}, 0x10) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000040)={@empty, @empty, @private2, 0x3, 0xf1, 0x26bd, 0x100, 0xe, 0x80000, r3}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r6, 0x29, 0x3a, &(0x7f00000000c0), &(0x7f0000000100)=0x4) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x3, 0x103, @empty, 0x20010}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000080)={0x2, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020a0000796900000010000000000000"], 0x10}}, 0x0) recvmmsg(r7, &(0x7f0000000740)=[{{&(0x7f00000005c0)=@tipc, 0x80, &(0x7f0000000800)=[{&(0x7f0000001740)=""/4081, 0xff1}, {&(0x7f0000000640)=""/251, 0xfb}, {&(0x7f0000000300)=""/52, 0x34}, {&(0x7f0000000180)=""/51, 0x33}, {&(0x7f0000000240)=""/140, 0x8c}], 0x5}}], 0x4000000000000b7, 0x2, 0x0) read(r7, &(0x7f0000000200)=""/7, 0x7) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x303}, "41328ac34a4ad2ba", "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "89b06aff130000fd"}, 0x38) socket$key(0xf, 0x3, 0x2) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000019600)=[@ip_tos_int={{0x14, 0x11a, 0x1, 0x2}}], 0x28}, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00'}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}}, 0x0) 192.059633ms ago: executing program 3 (id=3101): r0 = socket(0xa, 0x1, 0x0) close(r0) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x8, 0x0, &(0x7f0000003c00)) (async, rerun: 64) setsockopt$MRT_DONE(r0, 0x0, 0xc9, 0x0, 0x0) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x18, 0x13, 0x301, 0x70bd25, 0xfffffffc, {0x1}, [@typed={0x4, 0x14e, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) 154.61789ms ago: executing program 1 (id=3102): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xffffffffffffffff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x1}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@newchain={0x3c, 0x64, 0x100, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xfff3, 0xe}, {0x7, 0xffff}, {0xa, 0x3}}, [@TCA_RATE={0x6, 0x5, {0x81, 0x6}}, @filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4e141bfa6139c790) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="dc01000010000000180000000000000000000000000000009500"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x4}, 0x94) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0xa, [@struct={0x9, 0x7, 0x0, 0x4, 0x0, 0x80, [{0x6, 0x4, 0xcb0e}, {0x7, 0x0, 0x10000}, {0x10, 0x3, 0x8}, {0x7, 0x2, 0x2}, {0x3, 0x5, 0x6}, {0x7, 0x2, 0x6c54}, {0x2, 0x5, 0x4}]}, @int={0x3, 0x0, 0x0, 0x1, 0x0, 0x2f, 0x0, 0x72, 0x5}]}, {0x0, [0x61, 0x61, 0x0, 0x61, 0x61, 0x7f, 0x0, 0x5f]}}, &(0x7f0000000380)=""/120, 0x92, 0x78, 0x1, 0x7}, 0x28) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r6, r7, 0x8f5, 0x100000000000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{0x1, 0xffffffffffffffff}, &(0x7f0000000480), &(0x7f00000004c0)}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_tracing={0x1a, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x7fff}, [@btf_id={0x18, 0x8, 0x3, 0x0, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x10, 0x56, &(0x7f0000000180)=""/86, 0x40f00, 0x10, '\x00', r3, 0x18, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x4}, 0x10, 0x2f59f, r5, 0x4, &(0x7f0000000540)=[r6, 0x1, r8], &(0x7f0000000580)=[{0x2, 0x3, 0x10, 0x4}, {0x1, 0x5, 0xb, 0x1}, {0x1, 0x3, 0xa, 0x5}, {0x1, 0x4, 0xa}], 0x10, 0x401}, 0x94) r9 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r9, 0x8922, &(0x7f0000000080)={'team_slave_1\x00', 0x80}) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) 129.549116ms ago: executing program 3 (id=3103): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, r1, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004000}, 0x8) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ec0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)=0x1) ioctl$PPPIOCSMAXCID(r2, 0x4004743c, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r3, @ANYBLOB="08000600", @ANYRES32=r0], 0x24}}, 0x4000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r0) 0s ago: executing program 1 (id=3104): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000080)={0x4}, 0x1f) (async, rerun: 64) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000000), &(0x7f00000000c0)=0x4) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8}]}}}]}, 0x38}}, 0x0) kernel console output (not intermixed with test programs): s an invalid length. [ 94.273097][ T7434] ip6gre1: entered allmulticast mode [ 94.376955][ T7449] gretap0: left promiscuous mode [ 94.416844][ T7449] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 94.486733][ T7461] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode [ 95.137020][ T7518] gtp0: entered promiscuous mode [ 95.159866][ T7518] gtp0: entered allmulticast mode [ 95.933971][ T7598] : renamed from vlan0 [ 96.457892][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 96.486862][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 96.510580][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 96.536332][ T7645] netlink: 'syz.2.468': attribute type 1 has an invalid length. [ 96.606841][ T7645] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 96.626558][ T7655] team0: Port device dummy0 removed [ 96.634797][ T7655] bridge_slave_0: left allmulticast mode [ 96.642472][ T7655] bridge_slave_0: left promiscuous mode [ 96.652528][ T7655] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.664526][ T7655] bridge_slave_1: left allmulticast mode [ 96.667663][ T7639] infiniband syz2: set active [ 96.672241][ T7655] bridge_slave_1: left promiscuous mode [ 96.678439][ T7639] infiniband syz2: added vxcan1 [ 96.681218][ T7655] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.703432][ T7655] bond0: (slave bond_slave_0): Releasing backup interface [ 96.712440][ T7639] RDS/IB: syz2: added [ 96.717740][ T7639] smc: adding ib device syz2 with port count 1 [ 96.724361][ T7639] smc: ib device syz2 port 1 has pnetid [ 96.724822][ T7655] bond0: (slave bond_slave_1): Releasing backup interface [ 96.743509][ T7655] team0: Port device team_slave_0 removed [ 96.752252][ T7655] team0: Port device team_slave_1 removed [ 96.759296][ T7655] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.766828][ T7655] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.775418][ T7655] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.783664][ T7655] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.826992][ T7658] veth3: entered promiscuous mode [ 96.844142][ T7658] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 96.871528][ T918] vxcan1 speed is unknown, defaulting to 1000 [ 96.877731][ T10] vxcan1 speed is unknown, defaulting to 1000 [ 96.927385][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 97.122156][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 97.497803][ T7707] __nla_validate_parse: 26 callbacks suppressed [ 97.497821][ T7707] netlink: 452 bytes leftover after parsing attributes in process `syz.0.488'. [ 97.519802][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 97.619946][ T5857] Bluetooth: hci4: command 0x0405 tx timeout [ 97.686550][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 97.767301][ T7723] netlink: 12 bytes leftover after parsing attributes in process `syz.2.493'. [ 97.816288][ T7729] netlink: 40 bytes leftover after parsing attributes in process `syz.3.495'. [ 97.837776][ T7639] vxcan1 speed is unknown, defaulting to 1000 [ 97.915538][ T7731] netlink: 120 bytes leftover after parsing attributes in process `syz.2.496'. [ 98.043200][ T7742] netlink: 24 bytes leftover after parsing attributes in process `syz.1.498'. [ 98.233515][ T7763] netlink: 9 bytes leftover after parsing attributes in process `syz.1.504'. [ 98.244697][ T7763] gretap0: entered promiscuous mode [ 98.366168][ T7772] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 98.445311][ T7775] syzkaller1: entered promiscuous mode [ 98.461020][ T7775] syzkaller1: entered allmulticast mode [ 98.678797][ T7796] openvswitch: netlink: IP tunnel dst address not specified [ 98.758761][ T7803] netlink: 'syz.0.520': attribute type 1 has an invalid length. [ 98.766731][ T7804] netlink: 28 bytes leftover after parsing attributes in process `syz.3.518'. [ 98.773196][ T7803] netlink: 236 bytes leftover after parsing attributes in process `syz.0.520'. [ 98.778474][ T7804] netlink: 24 bytes leftover after parsing attributes in process `syz.3.518'. [ 98.856441][ T7811] netlink: 28 bytes leftover after parsing attributes in process `syz.1.522'. [ 98.900328][ T7811] batadv_slave_1: entered promiscuous mode [ 98.927498][ T7811] hsr1: Slave A (gretap0) is not up; please bring it up to get a fully working HSR network [ 99.485222][ T7871] netlink: 'syz.3.539': attribute type 3 has an invalid length. [ 99.550063][ T7867] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 99.688145][ T7890] syzkaller0: entered promiscuous mode [ 99.697639][ T7890] syzkaller0: entered allmulticast mode [ 99.806776][ T7901] team0: Port device team_slave_1 removed [ 99.857491][ T7913] netlink: 'syz.0.556': attribute type 1 has an invalid length. [ 99.883745][ T7913] veth3: entered promiscuous mode [ 99.913152][ T7915] netlink: 'syz.4.557': attribute type 1 has an invalid length. [ 99.931585][ T7920] netlink: 'syz.2.559': attribute type 2 has an invalid length. [ 100.025442][ T7929] trusted_key: syz.1.561 sent an empty control message without MSG_MORE. [ 100.085776][ T7932] vlan0: entered promiscuous mode [ 100.106672][ T7932] bridge0: entered promiscuous mode [ 100.122570][ T7932] netlink: 'syz.0.562': attribute type 8 has an invalid length. [ 100.125034][ T7937] tipc: Enabled bearer , priority 0 [ 100.140499][ T7937] syzkaller0: entered promiscuous mode [ 100.146005][ T7937] syzkaller0: entered allmulticast mode [ 100.178491][ T7937] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 100.217036][ T7937] tipc: Resetting bearer [ 100.232727][ T7936] tipc: Resetting bearer [ 100.264048][ T7936] tipc: Disabling bearer [ 100.323859][ T7951] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 100.333285][ T7951] tipc: Can't bind to reserved service type 0 [ 100.806417][ T8006] netlink: 'syz.4.588': attribute type 1 has an invalid length. [ 101.016048][ T8035] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 101.422402][ T8067] team0: Device wireguard0 is of different type [ 101.532662][ T8073] netdevsim netdevsim4: Firmware load for '..' refused, path contains '..' component [ 101.543819][ T30] audit: type=1804 audit(1756324381.410:3): pid=8073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.607" name="/newroot/151/memory.events" dev="tmpfs" ino=789 res=1 errno=0 [ 101.565803][ T30] audit: type=1800 audit(1756324381.410:4): pid=8073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.607" name="memory.events" dev="tmpfs" ino=789 res=0 errno=0 [ 101.719335][ T8084] tipc: Enabled bearer , priority 0 [ 101.781832][ T8089] syzkaller0: entered promiscuous mode [ 101.787589][ T8089] syzkaller0: entered allmulticast mode [ 101.838189][ T8098] tipc: Resetting bearer [ 101.863741][ T8099] netdevsim netdevsim2: Direct firmware load for .. failed with error -2 [ 101.892371][ T8099] netdevsim netdevsim2: Falling back to sysfs fallback for: .. [ 101.983248][ T8083] tipc: Resetting bearer [ 101.993374][ T8109] netlink: 'syz.0.620': attribute type 83 has an invalid length. [ 102.008981][ T8083] tipc: Disabling bearer [ 102.137540][ T8123] openvswitch: netlink: Multiple metadata blocks provided [ 102.167114][ T8127] netlink: 'syz.4.626': attribute type 10 has an invalid length. [ 102.193839][ T8127] ipvlan1: entered promiscuous mode [ 102.199224][ T8127] ipvlan1: entered allmulticast mode [ 102.204569][ T8127] veth0_vlan: entered allmulticast mode [ 102.212451][ T8127] bridge0: port 3(ipvlan1) entered blocking state [ 102.224912][ T8127] bridge0: port 3(ipvlan1) entered disabled state [ 102.234003][ T8127] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 102.252870][ T8135] sit0: entered promiscuous mode [ 102.271498][ T8135] netlink: 'syz.3.628': attribute type 1 has an invalid length. [ 102.452342][ T8161] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 102.507889][ T8168] __nla_validate_parse: 34 callbacks suppressed [ 102.507903][ T8168] netlink: 36 bytes leftover after parsing attributes in process `syz.0.638'. [ 102.537116][ T8168] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.638'. [ 102.701714][ T8189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.645'. [ 102.790981][ T8200] netlink: 16 bytes leftover after parsing attributes in process `syz.2.649'. [ 102.851454][ T8207] IPv6: NLM_F_REPLACE set, but no existing node found! [ 102.948143][ T8216] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 103.152196][ T8237] syzkaller1: entered promiscuous mode [ 103.157813][ T8237] syzkaller1: entered allmulticast mode [ 103.237248][ T8249] netlink: 28 bytes leftover after parsing attributes in process `syz.4.667'. [ 103.272629][ T8251] netlink: 48 bytes leftover after parsing attributes in process `syz.2.668'. [ 103.283218][ T8251] netlink: 48 bytes leftover after parsing attributes in process `syz.2.668'. [ 103.426711][ T8271] lo: entered allmulticast mode [ 103.433793][ T8271] lo: left allmulticast mode [ 103.521372][ T8282] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 103.540088][ T8282] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.809821][ T8304] team0 (unregistering): Port device team_slave_0 removed [ 103.820798][ T8304] team0 (unregistering): Port device team_slave_1 removed [ 104.081812][ T8330] netlink: 4 bytes leftover after parsing attributes in process `syz.1.691'. [ 104.096750][ T1103] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.096834][ T8330] netlink: 4 bytes leftover after parsing attributes in process `syz.1.691'. [ 104.106284][ T1103] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.150197][ T1103] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.169206][ T1103] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.211757][ T8336] tipc: Enabled bearer , priority 0 [ 104.221045][ T8336] syzkaller0: entered promiscuous mode [ 104.240794][ T8336] syzkaller0: entered allmulticast mode [ 104.262150][ T8336] tipc: Resetting bearer [ 104.275673][ T8335] tipc: Resetting bearer [ 104.291669][ T8335] tipc: Disabling bearer [ 104.445297][ T8361] unsupported nla_type 52263 [ 104.545834][ T8369] netlink: 80 bytes leftover after parsing attributes in process `syz.0.704'. [ 104.567117][ T8369] bridge0: entered allmulticast mode [ 104.788090][ T8379] validate_nla: 1 callbacks suppressed [ 104.788109][ T8379] netlink: 'syz.1.708': attribute type 5 has an invalid length. [ 104.863095][ T8387] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 105.171731][ T8406] lo: entered promiscuous mode [ 105.185742][ T8406] tunl0: entered promiscuous mode [ 105.194501][ T8406] gre0: entered promiscuous mode [ 105.216945][ T8406] gretap0: entered promiscuous mode [ 105.228132][ T8406] erspan0: entered promiscuous mode [ 105.239867][ T8406] ip_vti0: entered promiscuous mode [ 105.332709][ T8431] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 105.386848][ T8436] netlink: 'syz.1.723': attribute type 11 has an invalid length. [ 105.398384][ T8436] netlink: 'syz.1.723': attribute type 11 has an invalid length. [ 105.439602][ T8442] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 105.580751][ T8457] : renamed from dummy0 (while UP) [ 105.660374][ T8461] openvswitch: netlink: Message has 4 unknown bytes. [ 106.002748][ T8494] geneve2: entered promiscuous mode [ 106.009854][ T8494] geneve2: entered allmulticast mode [ 106.023117][ T43] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 106.033083][ T43] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 106.043200][ T43] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 106.059468][ T43] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 106.158443][ T8511] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 106.303569][ T8522] netlink: 'syz.4.752': attribute type 10 has an invalid length. [ 106.313138][ T8522] mac80211_hwsim hwsim10 wlan1: left allmulticast mode [ 106.314281][ T8523] netlink: 'syz.3.753': attribute type 11 has an invalid length. [ 106.321917][ T8522] bond0: (slave wlan1): Opening slave failed [ 106.396688][ T8531] tap0: tun_chr_ioctl cmd 1074025677 [ 106.402646][ T8531] tap0: linktype set to 65534 [ 106.495499][ T8542] syzkaller0: entered promiscuous mode [ 106.501804][ T8542] syzkaller0: entered allmulticast mode [ 106.638750][ T8559] atomic_op ffff88802894b998 conn xmit_atomic 0000000000000000 [ 106.856611][ T8580] netlink: 'syz.3.773': attribute type 1 has an invalid length. [ 106.871626][ T8578] gtp0: entered promiscuous mode [ 107.062912][ T8597] netlink: 'syz.3.778': attribute type 1 has an invalid length. [ 107.115910][ T8597] bond2 (unregistering): Released all slaves [ 107.154995][ T8611] netlink: 'syz.3.778': attribute type 4 has an invalid length. [ 107.199614][ T8614] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 107.240787][ T8608] team_slave_0: entered promiscuous mode [ 107.246483][ T8608] team_slave_1: entered promiscuous mode [ 107.254498][ T8608] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 107.278981][ T8608] team0: Device macvtap1 is already an upper device of the team interface [ 107.288650][ T8608] team_slave_0: left promiscuous mode [ 107.294096][ T8608] team_slave_1: left promiscuous mode [ 107.315265][ T8619] netlink: 'syz.1.788': attribute type 3 has an invalid length. [ 107.329065][ T8614] gretap1: entered promiscuous mode [ 107.474694][ T8634] netlink: 'syz.4.792': attribute type 30 has an invalid length. [ 107.674818][ T8658] __nla_validate_parse: 20 callbacks suppressed [ 107.674836][ T8658] netlink: 40 bytes leftover after parsing attributes in process `syz.2.799'. [ 107.759941][ T8662] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 107.925064][ T8672] netlink: 256 bytes leftover after parsing attributes in process `syz.2.802'. [ 108.031570][ T8694] netlink: 24 bytes leftover after parsing attributes in process `syz.3.811'. [ 108.050325][ T8697] netlink: 'syz.4.813': attribute type 18 has an invalid length. [ 108.056722][ T8701] netlink: 32 bytes leftover after parsing attributes in process `syz.1.812'. [ 108.089042][ T8699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.814'. [ 108.162925][ T8703] syzkaller1: entered promiscuous mode [ 108.169036][ T8703] syzkaller1: entered allmulticast mode [ 108.207696][ T8709] syzkaller0: entered promiscuous mode [ 108.215765][ T8709] syzkaller0: entered allmulticast mode [ 108.331385][ T8728] netlink: 8 bytes leftover after parsing attributes in process `syz.4.822'. [ 108.356745][ T8726] lo: left promiscuous mode [ 108.363012][ T8726] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 108.401574][ T8731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.823'. [ 108.557774][ T8746] netlink: 18 bytes leftover after parsing attributes in process `syz.3.829'. [ 108.623014][ T8761] netlink: 12 bytes leftover after parsing attributes in process `syz.4.834'. [ 108.630052][ T8760] netlink: 8 bytes leftover after parsing attributes in process `syz.0.832'. [ 108.840312][ T5860] Bluetooth: hci4: link tx timeout [ 108.848597][ T5860] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 108.856023][ T8781] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 108.965321][ T8791] bond2: (slave geneve3): making interface the new active one [ 108.975424][ T8791] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 108.984853][ T12] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 109.000518][ T12] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 109.019279][ T12] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 109.028957][ T59] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 109.387623][ T8842] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 109.419839][ T8844] dummy0: entered promiscuous mode [ 109.426159][ T8844] bridge0: port 1(dummy0) entered blocking state [ 109.433118][ T8844] bridge0: port 1(dummy0) entered disabled state [ 109.440354][ T8844] dummy0: entered allmulticast mode [ 109.450095][ T8844] netlink: 'syz.0.863': attribute type 11 has an invalid length. [ 109.542553][ T8850] 8021q: VLANs not supported on wg1 [ 109.884520][ T8882] Unsupported ieee802154 address type: 0 [ 110.000532][ T8883] sctp: [Deprecated]: syz.2.876 (pid 8883) Use of int in max_burst socket option deprecated. [ 110.000532][ T8883] Use struct sctp_assoc_value instead [ 110.024017][ T5880] IPVS: starting estimator thread 0... [ 110.071012][ T8897] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition [ 110.111657][ T8897] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0) [ 110.118666][ T8892] IPVS: using max 42 ests per chain, 100800 per kthread [ 110.167141][ T8904] validate_nla: 5 callbacks suppressed [ 110.167161][ T8904] netlink: 'syz.2.883': attribute type 1 has an invalid length. [ 110.188638][ T8907] tipc: Enabled bearer , priority 0 [ 110.200085][ T8906] tipc: Resetting bearer [ 110.253082][ T8911] bond3: (slave geneve2): making interface the new active one [ 110.261244][ T8911] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 110.271699][ T8904] netlink: 'syz.2.883': attribute type 1 has an invalid length. [ 110.287008][ T8897] bond0: (slave bridge_slave_1): Releasing backup interface [ 110.304747][ T8902] tipc: Disabling bearer [ 110.312573][ T2925] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 110.322099][ T2925] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 110.331104][ T2925] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 110.340629][ T2925] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 110.504464][ T8936] netlink: 'syz.1.891': attribute type 2 has an invalid length. [ 110.665778][ T8947] netlink: 'syz.2.894': attribute type 39 has an invalid length. [ 110.732015][ T8953] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 110.865009][ T8968] netlink: 'syz.2.902': attribute type 8 has an invalid length. [ 110.886245][ T8968] nft_compat: unsupported protocol 0 [ 110.905753][ T5860] Bluetooth: hci4: command 0x0405 tx timeout [ 110.955064][ T8981] : renamed from hsr0 (while UP) [ 110.981008][ T8981] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 111.751367][ T9008] netlink: 'syz.2.911': attribute type 1 has an invalid length. [ 111.775112][ T9015] netlink: 'syz.4.912': attribute type 10 has an invalid length. [ 111.790288][ T9015] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 111.812272][ T9015] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 111.864641][ T9021] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 111.925736][ T9021] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 112.004365][ T9021] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 112.074531][ T9037] tipc: Enabled bearer , priority 0 [ 112.089063][ T9021] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 112.104420][ T9036] syzkaller0: entered promiscuous mode [ 112.113102][ T9036] syzkaller0: entered allmulticast mode [ 112.138096][ T9040] tipc: Resetting bearer [ 112.147652][ T9035] tipc: Resetting bearer [ 112.155465][ T9035] tipc: Disabling bearer [ 112.175842][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 112.191371][ T2925] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 112.214031][ T2925] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 112.232979][ T2925] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 112.276944][ T9054] syzkaller1: entered promiscuous mode [ 112.284062][ T9054] syzkaller1: entered allmulticast mode [ 112.293469][ T9054] only policy match revision 0 supported [ 112.293487][ T9054] unable to load match [ 112.410067][ T9065] openvswitch: netlink: IP tunnel dst address not specified [ 112.491807][ T9069] netlink: 'syz.2.931': attribute type 30 has an invalid length. [ 112.874824][ T9110] netlink: 'syz.2.941': attribute type 10 has an invalid length. [ 113.111940][ T9133] __nla_validate_parse: 32 callbacks suppressed [ 113.111958][ T9133] netlink: 240 bytes leftover after parsing attributes in process `syz.1.950'. [ 113.135279][ T9134] netlink: 240 bytes leftover after parsing attributes in process `syz.1.950'. [ 113.143440][ T9137] netlink: 28 bytes leftover after parsing attributes in process `syz.4.951'. [ 113.154019][ T9137] netlink: 28 bytes leftover after parsing attributes in process `syz.4.951'. [ 113.180687][ T9137] 8021q: adding VLAN 0 to HW filter on device bond4 [ 113.477458][ T9166] netlink: 'syz.4.959': attribute type 11 has an invalid length. [ 113.487699][ T9166] netlink: 'syz.4.959': attribute type 11 has an invalid length. [ 113.495921][ T9166] netlink: 224 bytes leftover after parsing attributes in process `syz.4.959'. [ 113.509683][ T9166] netlink: 'syz.4.959': attribute type 1 has an invalid length. [ 113.517487][ T9166] netlink: 212 bytes leftover after parsing attributes in process `syz.4.959'. [ 113.646519][ T9183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.962'. [ 113.673519][ T9183] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:0000 [ 113.693733][ T9183] tipc: Enabled bearer , priority 10 [ 113.791631][ T9198] siw: device registration error -23 [ 113.807621][ T9205] netlink: 808 bytes leftover after parsing attributes in process `syz.0.970'. [ 113.896976][ T9213] netlink: 16 bytes leftover after parsing attributes in process `syz.2.974'. [ 113.906579][ T9213] netlink: 32 bytes leftover after parsing attributes in process `syz.2.974'. [ 113.930580][ T9213] gretap1: entered promiscuous mode [ 113.937524][ T9213] gretap1: entered allmulticast mode [ 114.012478][ T9229] : renamed from hsr0 (while UP) [ 114.070265][ T9234] C: renamed from lo [ 114.183259][ T9240] vxcan1 speed is unknown, defaulting to 1000 [ 114.532051][ T9274] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 114.614442][ T9200] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 114.808978][ T49] tipc: Node number set to 819837881 [ 114.885107][ T9306] tipc: Enabled bearer , priority 10 [ 114.937804][ T9308] macvlan2: entered promiscuous mode [ 114.946410][ T9308] macvlan2: entered allmulticast mode [ 114.952855][ T9308] bond5: entered promiscuous mode [ 114.965684][ T9308] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 114.977725][ T9308] bond5: left promiscuous mode [ 115.192033][ T9331] 8021q: adding VLAN 0 to HW filter on device bond2 [ 115.275795][ T9334] bond2: (slave veth0_to_bond): making interface the new active one [ 115.287055][ T9334] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 115.322775][ T9334] bond2: (slave veth9): Enslaving as an active interface with a down link [ 115.329837][ T9349] Bluetooth: MGMT ver 1.23 [ 115.365219][ T9331] bond2: (slave veth11): Enslaving as an active interface with a down link [ 115.490182][ T9359] dvmrp0: entered allmulticast mode [ 115.611651][ T9370] delete_channel: no stack [ 115.632014][ T9370] delete_channel: no stack [ 115.651160][ T9373] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 115.678042][ T9373] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 115.690825][ T9373] gretap1: entered promiscuous mode [ 115.696124][ T9373] gretap1: entered allmulticast mode [ 115.705609][ T9383] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 115.714829][ T9383] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 115.860271][ T5857] Bluetooth: hci0: command 0x0c1a tx timeout [ 115.870311][ T9393] netlink: 'syz.4.1031': attribute type 11 has an invalid length. [ 115.950326][ T9401] validate_nla: 10 callbacks suppressed [ 115.950346][ T9401] netlink: 'syz.0.1035': attribute type 24 has an invalid length. [ 115.998551][ T49] tipc: Node number set to 1400117406 [ 116.014840][ T9410] netlink: 'syz.1.1040': attribute type 1 has an invalid length. [ 116.036973][ T9410] netlink: 'syz.1.1040': attribute type 2 has an invalid length. [ 116.063932][ T9410] netlink: 'syz.1.1040': attribute type 1 has an invalid length. [ 116.134997][ T9419] 8021q: adding VLAN 0 to HW filter on device bond3 [ 116.169486][ T9410] netlink: zone id is out of range [ 116.209619][ T9410] netlink: zone id is out of range [ 116.221995][ T9410] netlink: zone id is out of range [ 116.227141][ T9410] netlink: zone id is out of range [ 116.265574][ T9410] netlink: zone id is out of range [ 116.270935][ T9410] netlink: zone id is out of range [ 116.280603][ T9410] netlink: zone id is out of range [ 116.285857][ T9410] netlink: get zone limit has 8 unknown bytes [ 116.348510][ T9442] netdevsim netdevsim0: Firmware load for './file0/../file0' refused, path contains '..' component [ 116.352856][ T9448] vxcan1 speed is unknown, defaulting to 1000 [ 116.711370][ T9480] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 116.716442][ T9486] netlink: ct family unspecified [ 116.935662][ T9499] netlink: 'syz.0.1066': attribute type 16 has an invalid length. [ 116.961838][ T9499] netlink: 'syz.0.1066': attribute type 17 has an invalid length. [ 116.994295][ T9498] tipc: Resetting bearer [ 117.002245][ T9498] tipc: Resetting bearer [ 117.025313][ T9499] tunl0: left promiscuous mode [ 117.032935][ T9499] gre0: left promiscuous mode [ 117.076750][ T9499] gretap0: left promiscuous mode [ 117.086189][ T9499] erspan0: left promiscuous mode [ 117.094592][ T9499] ip_vti0: left promiscuous mode [ 117.106623][ T9521] netlink: 'syz.2.1074': attribute type 15 has an invalid length. [ 117.117242][ T9499] bridge0: left allmulticast mode [ 117.126939][ T9499] bridge0: port 1(dummy0) entered blocking state [ 117.133564][ T9499] bridge0: port 1(dummy0) entered forwarding state [ 117.143065][ T43] tipc: Resetting bearer [ 117.392109][ T9551] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 117.434525][ T9551] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 117.451096][ T9551] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 117.475632][ T9559] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 117.487757][ T9559] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 117.500144][ T9559] bond0 (unregistering): Released all slaves [ 117.632834][ T9566] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 117.649876][ T43] bond2: (slave veth0_to_bond): link status definitely down, disabling slave [ 117.674733][ T9566] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 117.692671][ T43] bond2: now running without any active interface! [ 117.716659][ T6004] vxcan1 speed is unknown, defaulting to 1000 [ 117.733321][ T9566] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 117.733330][ T6004] syz2: Port: 1 Link DOWN [ 117.775020][ T49] vxcan1 speed is unknown, defaulting to 1000 [ 118.056923][ T9621] netlink: 'syz.1.1101': attribute type 3 has an invalid length. [ 118.181405][ T9639] netlink: 'syz.1.1105': attribute type 29 has an invalid length. [ 118.192168][ T9639] netlink: 'syz.1.1105': attribute type 29 has an invalid length. [ 118.280983][ T9645] __nla_validate_parse: 37 callbacks suppressed [ 118.281002][ T9645] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1107'. [ 118.432606][ T9655] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1111'. [ 118.484894][ T9663] tipc: Enabling of bearer rejected, failed to enable media [ 118.517794][ T9669] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1115'. [ 118.526963][ T9670] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1115'. [ 118.542547][ T9669] tipc: Enabled bearer , priority 10 [ 118.553983][ T9670] tipc: Enabling of bearer rejected, already enabled [ 118.618223][ T9682] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1117'. [ 118.857915][ T9695] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1121'. [ 119.013228][ T9713] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1126'. [ 119.179396][ T9734] tipc: New replicast peer: 255.255.255.255 [ 119.187777][ T9734] tipc: Enabled bearer , priority 10 [ 119.220085][ T5857] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 119.226266][ T5860] Bluetooth: hci0: command 0x0c1a tx timeout [ 119.844231][ T9819] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1161'. [ 119.871686][ T9819] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1161'. [ 119.908694][ T9821] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1164'. [ 119.930666][ T9821] tc_dump_action: action bad kind [ 120.308633][ T9576] tipc: Node number set to 2465689218 [ 120.457760][ T9893] FAULT_INJECTION: forcing a failure. [ 120.457760][ T9893] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 120.474145][ T9893] CPU: 0 UID: 0 PID: 9893 Comm: syz.1.1187 Not tainted syzkaller #0 PREEMPT(full) [ 120.474171][ T9893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 120.474181][ T9893] Call Trace: [ 120.474187][ T9893] [ 120.474194][ T9893] dump_stack_lvl+0x189/0x250 [ 120.474227][ T9893] ? __pfx____ratelimit+0x10/0x10 [ 120.474255][ T9893] ? __pfx_dump_stack_lvl+0x10/0x10 [ 120.474271][ T9893] ? __pfx__printk+0x10/0x10 [ 120.474293][ T9893] ? rcu_is_watching+0x15/0xb0 [ 120.474310][ T9893] should_fail_ex+0x414/0x560 [ 120.474331][ T9893] _copy_to_user+0x31/0xb0 [ 120.474350][ T9893] simple_read_from_buffer+0xe1/0x170 [ 120.474379][ T9893] proc_fail_nth_read+0x1b3/0x220 [ 120.474398][ T9893] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 120.474415][ T9893] ? rw_verify_area+0x2a6/0x4d0 [ 120.474433][ T9893] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 120.474450][ T9893] vfs_read+0x200/0xa30 [ 120.474467][ T9893] ? fdget_pos+0x247/0x320 [ 120.474483][ T9893] ? __pfx___mutex_lock+0x10/0x10 [ 120.474506][ T9893] ? __pfx_vfs_read+0x10/0x10 [ 120.474527][ T9893] ? __fget_files+0x3a0/0x420 [ 120.474547][ T9893] ? __fget_files+0x2a/0x420 [ 120.474571][ T9893] ksys_read+0x145/0x250 [ 120.474591][ T9893] ? __pfx_ksys_read+0x10/0x10 [ 120.474609][ T9893] ? rcu_is_watching+0x15/0xb0 [ 120.474625][ T9893] ? rcu_is_watching+0x15/0xb0 [ 120.474640][ T9893] do_syscall_64+0xfa/0x3b0 [ 120.474663][ T9893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.474680][ T9893] ? clear_bhb_loop+0x60/0xb0 [ 120.474698][ T9893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.474714][ T9893] RIP: 0033:0x7fb82638d5fc [ 120.474736][ T9893] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 120.474750][ T9893] RSP: 002b:00007fb8271df030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 120.474773][ T9893] RAX: ffffffffffffffda RBX: 00007fb8265b5fa0 RCX: 00007fb82638d5fc [ 120.474786][ T9893] RDX: 000000000000000f RSI: 00007fb8271df0a0 RDI: 0000000000000004 [ 120.474797][ T9893] RBP: 00007fb8271df090 R08: 0000000000000000 R09: 0000000000000000 [ 120.474807][ T9893] R10: 0000000000004141 R11: 0000000000000246 R12: 0000000000000001 [ 120.474817][ T9893] R13: 00007fb8265b6038 R14: 00007fb8265b5fa0 R15: 00007ffe0ca87778 [ 120.474837][ T9893] [ 120.915901][ T9925] ieee802154 phy0 wpan0: encryption failed: -22 [ 122.433585][T10009] net_ratelimit: 10 callbacks suppressed [ 122.433605][T10009] openvswitch: netlink: Flow key attr not present in new flow. [ 122.474546][T10012] ipvlan2: entered promiscuous mode [ 122.530152][T10019] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 122.644145][T10034] validate_nla: 9 callbacks suppressed [ 122.644165][T10034] netlink: 'syz.0.1235': attribute type 39 has an invalid length. [ 122.763582][T10045] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 122.842730][T10045] bond2 (unregistering): Released all slaves [ 122.849604][T10058] netlink: 'syz.0.1239': attribute type 10 has an invalid length. [ 122.883425][T10058] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 122.895149][T10058] 8021q: adding VLAN 0 to HW filter on device bond0 [ 122.910698][T10058] bond0: (slave wlan1): Opening slave failed [ 122.923207][T10061] ip6tnl1: entered promiscuous mode [ 122.928870][T10061] ip6tnl1: entered allmulticast mode [ 122.970857][T10064] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 122.992501][T10064] bond6: entered promiscuous mode [ 122.997636][T10064] bond6: entered allmulticast mode [ 123.003120][T10064] 8021q: adding VLAN 0 to HW filter on device bond6 [ 123.011696][T10026] tipc: Enabled bearer , priority 0 [ 123.022010][ T13] tipc: Resetting bearer [ 123.048925][T10025] tipc: Resetting bearer [ 123.172878][T10025] tipc: Disabling bearer [ 123.181426][T10082] netlink: 'syz.2.1242': attribute type 4 has an invalid length. [ 123.296641][T10091] __nla_validate_parse: 14 callbacks suppressed [ 123.296658][T10091] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1249'. [ 123.409938][T10108] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1253'. [ 123.506669][T10117] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1256'. [ 123.508304][T10116] syzkaller1: entered promiscuous mode [ 123.522333][T10116] syzkaller1: entered allmulticast mode [ 123.534286][T10116] tipc: Enabled bearer , priority 0 [ 123.582561][T10116] syzkaller0: entered promiscuous mode [ 123.588147][T10116] syzkaller0: entered allmulticast mode [ 123.600356][T10116] tipc: Resetting bearer [ 123.627774][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.633837][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.654061][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.660916][T10131] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1263'. [ 123.663800][T10123] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 123.680002][T10112] tipc: Resetting bearer [ 123.683146][T10123] infiniband syz: RDMA CMA: cma_listen_on_dev, error -98 [ 123.782596][T10112] tipc: Disabling bearer [ 123.806495][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.813706][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.821438][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.822942][T10141] syz2: rxe_newlink: already configured on vxcan1 [ 123.834839][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.853110][T10123] wg1 speed is unknown, defaulting to 1000 [ 123.950383][T10147] syzkaller0: refused to change device tx_queue_len [ 124.273375][T10149] ieee802154 phy0 wpan0: encryption failed: -22 [ 124.282658][T10149] netlink: 'syz.1.1268': attribute type 15 has an invalid length. [ 124.292445][T10149] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1268'. [ 124.356589][T10153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1270'. [ 124.452960][T10165] tipc: Enabled bearer , priority 0 [ 124.484010][T10162] syzkaller0: MTU too low for tipc bearer [ 124.490174][T10162] tipc: Disabling bearer [ 124.512174][T10169] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1277'. [ 124.777189][T10200] syzkaller1: entered promiscuous mode [ 124.783083][T10200] syzkaller1: entered allmulticast mode [ 124.792090][T10200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1284'. [ 124.795631][T10208] netlink: 'syz.4.1289': attribute type 10 has an invalid length. [ 124.825920][T10211] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1287'. [ 124.861772][T10208] bridge0: port 3(team0) entered blocking state [ 124.870769][T10208] bridge0: port 3(team0) entered disabled state [ 124.877208][T10208] team0: entered allmulticast mode [ 124.882975][T10208] team_slave_0: entered allmulticast mode [ 124.888922][T10208] team_slave_1: entered allmulticast mode [ 124.896033][T10208] team0: entered promiscuous mode [ 124.901910][T10208] team_slave_0: entered promiscuous mode [ 124.907911][T10208] team_slave_1: entered promiscuous mode [ 124.916266][T10208] bridge0: port 3(team0) entered blocking state [ 124.922645][T10208] bridge0: port 3(team0) entered forwarding state [ 124.936061][T10218] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1291'. [ 124.993221][T10222] netlink: 'syz.0.1292': attribute type 23 has an invalid length. [ 125.151110][T10233] tipc: Enabling of bearer rejected, failed to enable media [ 125.192631][T10236] netlink: 'syz.4.1298': attribute type 13 has an invalid length. [ 125.411199][T10257] veth5: entered allmulticast mode [ 125.502057][T10265] netlink: 'syz.0.1307': attribute type 1 has an invalid length. [ 125.539615][ T5860] Bluetooth: hci4: command 0x0405 tx timeout [ 125.604578][T10265] bond7: (slave vxcan1): The slave device specified does not support setting the MAC address [ 125.617342][T10265] bond7: (slave vxcan1): Error -95 calling set_mac_address [ 125.666017][T10269] vxcan1 speed is unknown, defaulting to 1000 [ 125.759273][T10293] netlink: 'syz.1.1312': attribute type 2 has an invalid length. [ 125.767032][T10293] netlink: 'syz.1.1312': attribute type 8 has an invalid length. [ 125.851617][T10269] wg1 speed is unknown, defaulting to 1000 [ 126.159493][T10310] bond0: entered promiscuous mode [ 126.165008][T10310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 126.235211][T10310] 8021q: adding VLAN 0 to HW filter on device bond3 [ 126.266024][T10310] bond0: (slave bond3): making interface the new active one [ 126.280878][T10310] bond3: entered promiscuous mode [ 126.286720][T10310] bond0: (slave bond3): Enslaving as an active interface with an up link [ 126.415347][T10331] pim6reg1: entered promiscuous mode [ 126.433731][T10331] pim6reg1: entered allmulticast mode [ 126.693531][T10367] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 126.807790][T10378] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 126.999649][T10399] batadv_slave_1: entered promiscuous mode [ 127.023041][T10398] batadv_slave_1: left promiscuous mode [ 127.310396][T10443] openvswitch: netlink: Missing key (keys=40, expected=100) [ 128.361101][ T30] audit: type=1800 audit(1756324408.230:5): pid=10511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1374" name="memory.events" dev="tmpfs" ino=1561 res=0 errno=0 [ 128.398969][T10513] __nla_validate_parse: 25 callbacks suppressed [ 128.398987][T10513] netlink: 5 bytes leftover after parsing attributes in process `syz.0.1377'. [ 128.422438][ T30] audit: type=1804 audit(1756324408.250:6): pid=10511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1374" name="/newroot/303/memory.events" dev="tmpfs" ino=1561 res=1 errno=0 [ 128.448713][T10520] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1378'. [ 128.469499][T10529] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1373'. [ 128.623329][T10545] validate_nla: 14 callbacks suppressed [ 128.623347][T10545] netlink: 'syz.1.1384': attribute type 10 has an invalid length. [ 128.644484][T10545] team0: Device ipvlan1 failed to register rx_handler [ 128.666268][T10547] wg1: entered promiscuous mode [ 128.674546][T10547] wg1: entered allmulticast mode [ 128.748418][T10558] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1388'. [ 128.845630][T10542] syz.4.1382 (10542) used greatest stack depth: 17992 bytes left [ 128.866361][T10569] bridge_slave_0: left allmulticast mode [ 128.877393][T10569] bridge_slave_0: left promiscuous mode [ 128.895156][T10569] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.914935][T10569] bridge_slave_1: left allmulticast mode [ 128.925760][T10569] bridge_slave_1: left promiscuous mode [ 128.935685][T10569] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.948095][T10569] bond0: (slave bond_slave_0): Releasing backup interface [ 128.955843][T10581] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1394'. [ 128.966240][T10569] bond_slave_0: left allmulticast mode [ 128.974173][T10569] bond0: (slave bond_slave_1): Releasing backup interface [ 128.982197][T10569] bond_slave_1: left allmulticast mode [ 128.988007][T10569] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.998171][T10569] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 129.006262][T10569] bond1: left allmulticast mode [ 129.011397][T10569] bond1: left promiscuous mode [ 129.016394][T10569] bridge0: port 3(bond1) entered disabled state [ 129.025281][T10569] bond2: (slave ip6gretap1): Releasing backup interface [ 129.032741][T10569] bond2: (slave ip6gretap1): the permanent HWaddr of slave - da:ed:59:0a:0a:2e - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 129.054867][T10569] bond2: (slave veth3): Releasing backup interface [ 129.063589][T10569] bond3: (slave geneve2): Releasing active interface [ 129.090672][ T1103] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 129.101565][ T1103] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 129.135501][ T1103] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 129.147795][ T13] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 129.197232][T10597] netlink: 'syz.3.1397': attribute type 10 has an invalid length. [ 129.232492][T10594] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1396'. [ 129.276213][T10604] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1400'. [ 129.507905][T10630] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1406'. [ 129.579442][T10633] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1407'. [ 129.607217][T10639] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1409'. [ 129.751263][T10658] netlink: 'syz.2.1415': attribute type 29 has an invalid length. [ 130.187044][ T30] audit: type=1800 audit(1756324410.050:7): pid=10693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1427" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=1409 res=0 errno=0 [ 130.540417][T10726] netdevsim netdevsim3: Direct firmware load for lookup_extent_enter failed with error -2 [ 130.559202][T10730] netlink: 'syz.2.1435': attribute type 16 has an invalid length. [ 130.575049][T10730] netlink: 'syz.2.1435': attribute type 17 has an invalid length. [ 130.575969][T10726] netdevsim netdevsim3: Falling back to sysfs fallback for: lookup_extent_enter [ 130.639252][T10735] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 130.747533][T10749] netlink: zone id is out of range [ 130.773528][T10749] netlink: zone id is out of range [ 130.799553][T10749] netlink: get zone limit has 8 unknown bytes [ 130.959650][T10768] ipvlan0: entered promiscuous mode [ 130.976247][T10768] ipvlan0: entered allmulticast mode [ 131.081491][T10782] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.180032][T10801] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 131.252761][T10803] sctp: [Deprecated]: syz.3.1456 (pid 10803) Use of struct sctp_assoc_value in delayed_ack socket option. [ 131.252761][T10803] Use struct sctp_sack_info instead [ 131.437414][T10823] netlink: 'syz.1.1460': attribute type 1 has an invalid length. [ 131.515837][T10831] netlink: 'syz.3.1461': attribute type 10 has an invalid length. [ 131.549076][T10834] sctp: [Deprecated]: syz.1.1463 (pid 10834) Use of int in max_burst socket option. [ 131.549076][T10834] Use struct sctp_assoc_value instead [ 131.583823][T10839] Bluetooth: MGMT ver 1.23 [ 131.589462][T10831] syz_tun: entered promiscuous mode [ 131.662104][T10843] sctp: [Deprecated]: syz.2.1465 (pid 10843) Use of int in maxseg socket option. [ 131.662104][T10843] Use struct sctp_assoc_value instead [ 131.701381][T10845] tipc: Enabled bearer , priority 0 [ 131.729936][T10845] nbd: couldn't find a device at index 0 [ 131.764001][T10845] syzkaller0: entered promiscuous mode [ 131.776873][T10845] syzkaller0: entered allmulticast mode [ 131.792768][T10845] tipc: Resetting bearer [ 131.812404][T10852] netlink: 'syz.0.1468': attribute type 10 has an invalid length. [ 131.814763][T10844] tipc: Resetting bearer [ 131.842881][T10844] tipc: Disabling bearer [ 131.985069][T10880] openvswitch: netlink: ct_state flags 0000ee01 unsupported [ 132.297286][T10911] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 132.323201][T10915] veth0: entered promiscuous mode [ 132.398759][T10919] veth1_vlan: left promiscuous mode [ 132.553509][T10934] openvswitch: netlink: Key type 29 is not supported [ 132.607362][T10947] bridge0: port 3(team0) entered disabled state [ 132.627121][T10947] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.636389][T10947] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.661247][T10947] tipc: Resetting bearer [ 132.667264][T10947] tipc: Resetting bearer [ 132.688494][ T2925] tipc: Resetting bearer [ 132.695462][ T9583] wg1 speed is unknown, defaulting to 1000 [ 132.900911][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.490551][T10971] __nla_validate_parse: 21 callbacks suppressed [ 133.490568][T10971] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1504'. [ 133.505167][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.537429][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.563197][ T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.576740][ T13] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 133.607200][T10986] netlink: 'syz.1.1510': attribute type 1 has an invalid length. [ 133.631083][T10986] 8021q: adding VLAN 0 to HW filter on device bond2 [ 133.659701][T10986] 8021q: adding VLAN 0 to HW filter on device bond2 [ 133.666718][T10986] bond2: (slave vxcan5): The slave device specified does not support setting the MAC address [ 133.684281][T10986] bond2: (slave vxcan5): Error -95 calling set_mac_address [ 133.756640][T11004] delete_channel: no stack [ 133.842401][T11010] bridge_slave_0: left allmulticast mode [ 133.848339][T11010] bridge_slave_0: left promiscuous mode [ 133.854078][T11010] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.864739][T11010] bond2: (slave veth0_to_bond): Releasing active interface [ 133.875587][T11010] bond2: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 133.897933][T11010] team0: Port device team_slave_0 removed [ 133.906351][T11010] team0: Port device team_slave_1 removed [ 133.914465][T11010] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 133.922029][T11010] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 133.930771][T11010] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 133.938205][T11010] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 133.956162][T11010] bond2: (slave veth9): Releasing active interface [ 133.966860][T11010] bond2: (slave veth11): Releasing active interface [ 133.987386][T11010] bond0: (slave bond3): Releasing backup interface [ 133.995883][T11010] bond3: left promiscuous mode [ 134.018917][T11023] veth0: entered promiscuous mode [ 134.019209][ T5857] Bluetooth: hci4: command 0x0405 tx timeout [ 134.043959][T11013] veth0: left promiscuous mode [ 134.133393][T11038] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1525'. [ 134.192954][T11044] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1527'. [ 134.235207][T11047] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1526'. [ 134.266700][T11049] nbd: socks must be embedded in a SOCK_ITEM attr [ 134.323046][T11053] syzkaller1: entered promiscuous mode [ 134.328761][T11053] syzkaller1: entered allmulticast mode [ 134.452203][T11062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.461496][T11062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.471740][T11062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.480868][T11062] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.490168][T11062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.499219][T11062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1533'. [ 134.554999][T11065] tipc: Enabled bearer , priority 0 [ 134.562688][T11065] syzkaller0: entered promiscuous mode [ 134.568195][T11065] syzkaller0: entered allmulticast mode [ 134.578596][T11065] tipc: Resetting bearer [ 134.592538][T11064] tipc: Resetting bearer [ 134.602299][T11064] tipc: Disabling bearer [ 134.732459][T11082] tipc: Enabled bearer , priority 0 [ 134.741896][T11082] syzkaller0: entered promiscuous mode [ 134.747526][T11082] syzkaller0: entered allmulticast mode [ 134.770817][T11082] tipc: Resetting bearer [ 134.786119][T11081] tipc: Resetting bearer [ 134.791148][T11090] netlink: 'syz.1.1542': attribute type 1 has an invalid length. [ 134.801303][T11081] tipc: Disabling bearer [ 134.804994][T11090] netlink: 'syz.1.1542': attribute type 2 has an invalid length. [ 134.815262][T11090] netlink: 'syz.1.1542': attribute type 1 has an invalid length. [ 134.833943][T11090] netlink: 'syz.1.1542': attribute type 2 has an invalid length. [ 134.841877][T11090] netlink: 'syz.1.1542': attribute type 1 has an invalid length. [ 134.849800][T11090] netlink: 'syz.1.1542': attribute type 2 has an invalid length. [ 134.857648][T11090] netlink: 'syz.1.1542': attribute type 1 has an invalid length. [ 134.865568][T11090] netlink: 'syz.1.1542': attribute type 2 has an invalid length. [ 134.873688][T11090] netlink: 'syz.1.1542': attribute type 1 has an invalid length. [ 134.887658][T11090] netlink: 'syz.1.1542': attribute type 2 has an invalid length. [ 135.251646][T11136] tipc: Enabling of bearer rejected, failed to enable media [ 135.548722][T11155] openvswitch: netlink: VXLAN extension message has 3 unknown bytes. [ 135.730180][T11176] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 135.944512][T11216] sock: sock_set_timeout: `syz.2.1583' (pid 11216) tries to set negative timeout [ 136.029096][T11229] IPVS: set_ctl: invalid protocol: 43 172.30.0.3:20000 [ 136.040436][T11229] ip6gre0: entered promiscuous mode [ 136.050594][T11229] ip6gre0: entered allmulticast mode [ 136.178470][ T5860] Bluetooth: hci0: command 0x0c1a tx timeout [ 136.184581][ T5857] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 136.209093][T11248] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 136.235265][T11248] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 136.616377][T11300] IPVS: Scheduler module ip_vs_sip not found [ 136.624469][T11300] openvswitch: netlink: Tunnel attr 303 out of range max 16 [ 136.637264][T11300] vlan0: entered promiscuous mode [ 136.686186][T11309] netlink: zone id is out of range [ 136.692964][T11309] netlink: get zone limit has 8 unknown bytes [ 136.701907][T11312] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 136.726464][T11312] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 136.835818][T11327] tipc: Enabled bearer , priority 0 [ 136.847026][T11327] syzkaller0: entered promiscuous mode [ 136.854332][T11327] syzkaller0: entered allmulticast mode [ 136.867062][T11327] tipc: Resetting bearer [ 136.877283][T11326] tipc: Resetting bearer [ 136.885260][T11326] tipc: Disabling bearer [ 137.062512][T11334] tipc: Enabled bearer , priority 0 [ 137.092972][T11334] syzkaller0: entered promiscuous mode [ 137.098814][T11334] syzkaller0: entered allmulticast mode [ 137.128401][T11345] Can't find ip_set type hash [ 137.136861][T11335] bond3: (slave vxcan5): The slave device specified does not support setting the MAC address [ 137.157199][T11335] bond3: (slave vxcan5): Error -95 calling set_mac_address [ 137.184621][T11354] gretap1: entered promiscuous mode [ 137.203460][T11354] bond3: (slave gretap1): making interface the new active one [ 137.216606][T11354] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 137.231955][T11335] macvlan2: entered promiscuous mode [ 137.237380][T11335] macvlan2: entered allmulticast mode [ 137.243800][T11335] bond3: entered promiscuous mode [ 137.249762][T11335] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 137.259695][T11335] bond3: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 137.271789][T11335] bond3: left promiscuous mode [ 137.281770][T11355] tipc: Resetting bearer [ 137.293636][T11358] erspan0: entered allmulticast mode [ 137.310028][T11331] tipc: Resetting bearer [ 137.317578][T11331] tipc: Disabling bearer [ 137.626876][T11393] tipc: Enabled bearer , priority 0 [ 137.691149][T11394] tipc: Disabling bearer [ 137.771781][T11407] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 138.100127][T11434] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 138.229025][T11444] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.325117][T11457] openvswitch: netlink: Key type 29 is not supported [ 138.423325][T11459] team0: Device gtp1 is of different type [ 138.538019][T11476] __nla_validate_parse: 28 callbacks suppressed [ 138.538037][T11476] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1669'. [ 138.554595][T11476] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1669'. [ 138.567832][T11476] bridge0: port 4(vlan4) entered blocking state [ 138.574278][T11476] bridge0: port 4(vlan4) entered disabled state [ 138.580863][T11476] vlan4: entered allmulticast mode [ 138.585983][T11476] bridge0: entered allmulticast mode [ 138.592718][T11477] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1668'. [ 138.614581][T11476] vlan4: left allmulticast mode [ 138.619847][T11476] bridge0: left allmulticast mode [ 138.663661][T11484] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.676691][T11484] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.769087][T11484] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.790595][T11484] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.802340][T11496] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1677'. [ 138.817809][T11493] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 138.837219][T11493] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 138.859088][T11493] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 138.888900][T11484] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 138.898582][T11505] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1679'. [ 138.911557][T11506] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1679'. [ 138.921029][T11484] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.001616][T11484] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 139.022363][T11484] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.080101][T11514] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1682'. [ 139.091482][T11514] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1682'. [ 139.129109][T11516] : entered promiscuous mode [ 139.153374][ T2925] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.165547][ T2925] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.198082][ T2973] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.210733][ T2973] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.245562][ T2973] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.258274][ T2973] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.279913][ T2973] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.288117][ T2973] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.402563][T11547] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1693'. [ 139.542388][T11562] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 139.656779][T11573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1698'. [ 139.713401][T11579] (unnamed net_device) (uninitialized): option fail_over_mac: invalid value (3) [ 139.793719][T11586] bond4: entered promiscuous mode [ 139.798959][T11586] bond4: entered allmulticast mode [ 139.804608][T11586] 8021q: adding VLAN 0 to HW filter on device bond4 [ 139.815772][T11586] bond4 (unregistering): Released all slaves [ 140.520965][T11620] validate_nla: 69 callbacks suppressed [ 140.520981][T11620] netlink: 'syz.4.1716': attribute type 3 has an invalid length. [ 140.651657][T11630] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 140.794959][T11648] pim6reg: left allmulticast mode [ 140.942702][T11666] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20000 [ 141.021650][T11666] IPVS: set_ctl: invalid protocol: 58 172.20.20.170:20004 [ 141.095763][T11681] tipc: New replicast peer: 255.255.255.255 [ 141.102587][T11681] tipc: Enabled bearer , priority 10 [ 141.141595][T11687] bridge_slave_0: entered allmulticast mode [ 141.160943][T11687] bridge_slave_0: entered promiscuous mode [ 141.257915][T11696] tipc: Enabled bearer , priority 0 [ 141.266763][T11694] tipc: Resetting bearer [ 141.299583][T11694] tipc: Disabling bearer [ 141.406463][T11709] netlink: 'syz.4.1749': attribute type 11 has an invalid length. [ 141.481930][T11722] netlink: 'syz.3.1753': attribute type 1 has an invalid length. [ 141.490031][T11722] netlink: 'syz.3.1753': attribute type 2 has an invalid length. [ 141.497840][T11722] netlink: 'syz.3.1753': attribute type 1 has an invalid length. [ 141.638667][T11736] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 141.667059][T11734] syzkaller1: entered promiscuous mode [ 141.685306][T11734] syzkaller1: entered allmulticast mode [ 142.564208][T11776] netlink: 'syz.4.1768': attribute type 3 has an invalid length. [ 142.657293][T11791] net_ratelimit: 1 callbacks suppressed [ 142.657319][T11791] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 142.725067][T11791] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 142.755520][T11804] tipc: Enabling of bearer rejected, failed to enable media [ 142.839841][T11812] 8021q: VLANs not supported on ip_vti0 [ 142.984556][T11827] netlink: 'syz.2.1782': attribute type 5 has an invalid length. [ 143.099193][T11838] netlink: 'syz.2.1786': attribute type 4 has an invalid length. [ 143.560605][T11900] __nla_validate_parse: 25 callbacks suppressed [ 143.560624][T11900] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1799'. [ 143.694237][T11909] bond4: entered promiscuous mode [ 143.701799][T11909] bond4: entered allmulticast mode [ 143.708410][T11909] 8021q: adding VLAN 0 to HW filter on device bond4 [ 143.737539][T11909] bond5: entered promiscuous mode [ 143.742752][T11909] bond5: entered allmulticast mode [ 143.748329][T11909] 8021q: adding VLAN 0 to HW filter on device bond5 [ 144.092942][T11959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1821'. [ 144.130629][T11961] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1822'. [ 144.206724][T11968] IPv6: sit2: Disabled Multicast RS [ 144.213725][T11968] sit2: entered allmulticast mode [ 144.264319][T11973] delete_channel: no stack [ 144.295601][T11978] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1829'. [ 144.423966][T11993] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1833'. [ 144.504888][T11999] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1835'. [ 144.642100][T12016] netlink: 'syz.3.1840': attribute type 10 has an invalid length. [ 144.822230][T12046] openvswitch: netlink: Tunnel attr 1 has unexpected len 7 expected 4 [ 144.835625][T12050] netlink: 'syz.1.1850': attribute type 12 has an invalid length. [ 144.844891][T12050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1850'. [ 144.857588][T12051] netlink: 277 bytes leftover after parsing attributes in process `syz.4.1849'. [ 144.870732][T12050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1850'. [ 144.908949][T12060] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.1850'. [ 145.186574][T12093] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 145.196546][T12093] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 145.214309][T12095] gretap0: entered promiscuous mode [ 145.231642][T12095] 0{X: renamed from gretap0 [ 145.250042][T12095] 0{X: left promiscuous mode [ 145.263741][T12095] 0{X: entered allmulticast mode [ 145.280805][T12095] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 145.445077][T12115] team0: Device gtp1 is of different type [ 145.474430][T12124] ip6_vti0: mtu less than device minimum [ 145.812661][T12159] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 145.937034][T12170] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.093102][T12189] sock: sock_timestamping_bind_phc: sock not bind to device [ 146.237071][T12202] gretap0: entered promiscuous mode [ 146.244594][T12202] 0{X: renamed from gretap0 [ 146.251397][T12202] 0{X: left promiscuous mode [ 146.256513][T12202] 0{X: entered allmulticast mode [ 146.263289][T12202] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 146.346567][T12219] validate_nla: 6 callbacks suppressed [ 146.346583][T12219] netlink: 'syz.2.1907': attribute type 1 has an invalid length. [ 146.361771][T12219] netlink: 'syz.2.1907': attribute type 3 has an invalid length. [ 146.378398][T12219] NCSI netlink: No device for ifindex 0 [ 146.392817][T12220] vlan4: entered promiscuous mode [ 146.403552][T12220] vlan4: entered allmulticast mode [ 146.421331][T12220] hsr_slave_1: entered allmulticast mode [ 146.709068][T12252] rdma_op ffff88803221c1f0 conn xmit_rdma 0000000000000000 [ 146.734436][T12252] dvmrp1: entered allmulticast mode [ 146.744875][T12252] rdma_op ffff88803221b1f0 conn xmit_rdma 0000000000000000 [ 146.923813][T12273] tipc: Bearer : already 2 bearers with priority 10 [ 146.933097][T12273] tipc: Bearer : trying with adjusted priority [ 146.940752][T12273] tipc: Enabling of bearer rejected, failed to enable media [ 147.036593][T12285] netlink: 'syz.4.1929': attribute type 1 has an invalid length. [ 147.074655][T12024] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 147.088979][T12024] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 147.101069][ T9576] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 147.194157][T12306] netlink: zone id is out of range [ 147.215002][T12306] netlink: del zone limit has 4 unknown bytes [ 147.398892][ T9576] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 147.458593][ T9576] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 147.663023][T12357] sch_fq: defrate 0 ignored. [ 147.790834][T12370] tipc: Enabling of bearer rejected, failed to enable media [ 147.811779][T12372] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.856814][T12372] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 147.882139][T12372] batadv_slave_1 (unregistering): left promiscuous mode [ 147.926313][T12386] netlink: 'syz.0.1961': attribute type 1 has an invalid length. [ 148.217550][T12427] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 148.300290][T12438] IPv6: addrconf: prefix option has invalid lifetime [ 148.355388][T12443] netlink: 'syz.1.1979': attribute type 6 has an invalid length. [ 149.159383][T12478] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 149.334240][T12491] __nla_validate_parse: 44 callbacks suppressed [ 149.334258][T12491] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1993'. [ 149.361083][T12484] tipc: Enabled bearer , priority 0 [ 149.375033][T12483] tipc: Resetting bearer [ 149.475060][T12483] tipc: Disabling bearer [ 149.524035][T12512] sctp: [Deprecated]: syz.2.1998 (pid 12512) Use of int in max_burst socket option. [ 149.524035][T12512] Use struct sctp_assoc_value instead [ 149.530787][T12511] syz_tun: entered allmulticast mode [ 149.540266][T12512] delete_channel: no stack [ 149.614025][T12511] syz_tun: left allmulticast mode [ 149.837227][T12550] tipc: Resetting bearer [ 150.013265][T12564] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2009'. [ 150.029033][T12561] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2009'. [ 150.479998][T12601] veth0_to_bridge: entered promiscuous mode [ 150.501673][T12602] veth0_to_bridge: left promiscuous mode [ 150.532250][T12602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2019'. [ 150.542696][T12602] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2019'. [ 150.627617][T12609] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 150.712949][T12630] netlink: 'syz.2.2025': attribute type 11 has an invalid length. [ 150.743093][T12630] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2025'. [ 150.798712][T12638] openvswitch: netlink: IP tunnel dst address not specified [ 150.817715][T12641] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2031'. [ 150.832962][T12639] veth9: entered allmulticast mode [ 150.866250][T12647] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 150.879590][T12647] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551585) [ 150.893626][T12647] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 150.907449][T12652] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2032'. [ 150.934181][T12650] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2034'. [ 151.139008][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 151.190751][T12686] netlink: 'syz.1.2042': attribute type 1 has an invalid length. [ 151.192915][T12689] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2044'. [ 151.248970][T12686] 8021q: adding VLAN 0 to HW filter on device bond4 [ 151.305063][T12694] bond4: (slave veth7): Enslaving as an active interface with a down link [ 151.343017][T12686] bond4: (slave veth0_to_bond): making interface the new active one [ 151.353334][T12686] veth0_to_bond: entered promiscuous mode [ 151.374512][T12686] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 151.402261][T12686] bond4: (slave veth9): Enslaving as an active interface with a down link [ 151.416605][T12700] openvswitch: netlink: Key type 2048 is out of range max 32 [ 151.515181][T12707] netlink: 'syz.4.2049': attribute type 8 has an invalid length. [ 151.563035][T12707] netlink: 'syz.4.2049': attribute type 83 has an invalid length. [ 151.604707][T12725] netlink: set zone limit has 8 unknown bytes [ 151.682036][T12729] netlink: 'syz.4.2057': attribute type 1 has an invalid length. [ 151.692441][T12729] netlink: 'syz.4.2057': attribute type 3 has an invalid length. [ 151.702163][T12725] 0{X: left allmulticast mode [ 151.718143][T12729] NCSI netlink: No device for ifindex 131080 [ 151.729962][T12725] bridge0: port 1(dummy0) entered disabled state [ 151.747171][T12725] dummy0: left allmulticast mode [ 151.752312][T12725] dummy0: left promiscuous mode [ 151.757575][T12725] bridge0: port 1(dummy0) entered disabled state [ 152.013144][T12725] tipc: Resetting bearer [ 152.080481][T12725] geneve2: left allmulticast mode [ 152.087195][T12725] gretap1: left allmulticast mode [ 152.098063][T12725] bond6: left allmulticast mode [ 152.103908][T12725] veth5: left allmulticast mode [ 152.109620][T12725] veth9: left allmulticast mode [ 152.135650][T12759] batadv2: entered allmulticast mode [ 152.158604][ T12] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.183753][ T12] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 19999 - 0 [ 152.219541][ T12] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.243063][ T12] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 19999 - 0 [ 152.293710][ T12] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.328285][ T12] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 19999 - 0 [ 152.342783][T12773] sock: sock_set_timeout: `syz.3.2066' (pid 12773) tries to set negative timeout [ 152.352482][ T12] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.352514][ T12] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 19999 - 0 [ 152.380275][T12788] netlink: 'syz.1.2072': attribute type 8 has an invalid length. [ 152.389909][T12772] sock: sock_set_timeout: `syz.3.2066' (pid 12772) tries to set negative timeout [ 152.437551][T12788] veth0_to_bridge: entered promiscuous mode [ 152.446453][T12788] veth0_to_bridge: left promiscuous mode [ 152.481940][T12805] netlink: 'syz.2.2076': attribute type 6 has an invalid length. [ 152.509234][T12805] netlink: 'syz.2.2076': attribute type 6 has an invalid length. [ 152.633356][T12818] geneve3: entered promiscuous mode [ 152.974394][T12853] IPv6: sit2: Disabled Multicast RS [ 152.989925][T12853] sit2: entered allmulticast mode [ 153.181911][T12864] netlink: 'syz.0.2094': attribute type 3 has an invalid length. [ 153.797596][T12943] nbd: must specify a device to reconfigure [ 153.904886][T12951] : renamed from veth0_vlan (while UP) [ 154.345895][T12994] __nla_validate_parse: 24 callbacks suppressed [ 154.345914][T12994] netlink: 212316 bytes leftover after parsing attributes in process `syz.0.2135'. [ 154.355506][T13004] ieee802154 phy0 wpan0: encryption failed: -22 [ 154.553255][T13038] netlink: 'syz.2.2145': attribute type 2 has an invalid length. [ 154.613907][T13041] netlink: 'syz.2.2145': attribute type 1 has an invalid length. [ 154.631247][T13041] bond6: entered promiscuous mode [ 154.636574][T13041] 8021q: adding VLAN 0 to HW filter on device bond6 [ 154.654259][T13041] 8021q: adding VLAN 0 to HW filter on device bond7 [ 154.663683][T13041] bond6: (slave bond7): making interface the new active one [ 154.671310][T13041] bond7: entered promiscuous mode [ 154.676968][T13041] bond6: (slave bond7): Enslaving as an active interface with an up link [ 155.251857][T13039] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2139'. [ 155.334946][T13055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2148'. [ 155.350019][T13060] sctp: [Deprecated]: syz.4.2148 (pid 13060) Use of struct sctp_assoc_value in delayed_ack socket option. [ 155.350019][T13060] Use struct sctp_sack_info instead [ 155.480446][T13074] netlink: 152064 bytes leftover after parsing attributes in process `syz.2.2154'. [ 155.498611][T13074] netlink: zone id is out of range [ 155.514346][T13074] netlink: zone id is out of range [ 155.535381][T13074] netlink: zone id is out of range [ 155.554675][T13074] netlink: zone id is out of range [ 155.580107][T13074] netlink: zone id is out of range [ 155.585546][T13074] netlink: zone id is out of range [ 155.610358][T13074] netlink: zone id is out of range [ 155.622430][T13074] netlink: zone id is out of range [ 155.644580][T13074] netlink: zone id is out of range [ 155.650467][T13074] netlink: zone id is out of range [ 155.683870][T13091] team0: Port device dummy0 added [ 155.714534][T13093] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2160'. [ 155.735813][T13095] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2162'. [ 155.764923][T13100] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2161'. [ 155.855456][T13119] netlink: 204 bytes leftover after parsing attributes in process `syz.1.2167'. [ 155.965418][T13128] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2170'. [ 156.097912][T13143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2176'. [ 156.125258][T13149] nbd: must specify at least one socket [ 156.188304][ T5860] Bluetooth: hci4: command 0x0405 tx timeout [ 156.560381][T13195] vxcan1 speed is unknown, defaulting to 1000 [ 156.746850][T13210] pimreg: entered allmulticast mode [ 156.788734][T13215] validate_nla: 6 callbacks suppressed [ 156.788754][T13215] netlink: 'syz.1.2201': attribute type 2 has an invalid length. [ 156.880232][T13225] 8021q: VLANs not supported on ip_vti0 [ 156.886204][T13225] 8021q: VLANs not supported on ip_vti0 [ 156.926979][T13225] 8021q: VLANs not supported on ip_vti0 [ 156.953914][T13195] wg1 speed is unknown, defaulting to 1000 [ 157.312839][T13262] 8021q: adding VLAN 0 to HW filter on device bond8 [ 157.322956][T13262] bond0: (slave bond8): Enslaving as an active interface with an up link [ 157.352281][T13276] netlink: 'syz.1.2221': attribute type 7 has an invalid length. [ 157.964369][T13343] netlink: 'syz.1.2237': attribute type 21 has an invalid length. [ 158.472461][ T9576] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 158.496210][ T9576] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 158.511017][T13401] 8021q: VLANs not supported on wg1 [ 159.096097][T13466] netlink: 'syz.0.2274': attribute type 11 has an invalid length. [ 159.130807][T13468] netlink: 'syz.2.2275': attribute type 12 has an invalid length. [ 159.241987][T13479] delete_channel: no stack [ 159.347532][T13486] pim6reg1: entered promiscuous mode [ 159.384484][T13486] pim6reg1: entered allmulticast mode [ 159.406274][T13501] __nla_validate_parse: 29 callbacks suppressed [ 159.406292][T13501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2285'. [ 159.429601][T13498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2284'. [ 159.443080][T13498] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2284'. [ 159.549109][T13511] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2288'. [ 159.569979][T13507] netlink: 'syz.1.2287': attribute type 11 has an invalid length. [ 159.585834][T13507] netlink: 'syz.1.2287': attribute type 11 has an invalid length. [ 159.637817][T13507] netlink: 'syz.1.2287': attribute type 11 has an invalid length. [ 159.778377][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 159.864531][T13551] netlink: 'syz.2.2301': attribute type 2 has an invalid length. [ 159.878333][T13551] netlink: 'syz.2.2301': attribute type 8 has an invalid length. [ 159.886438][T13551] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2301'. [ 159.981328][T13568] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2304'. [ 160.452540][T13579] netlink: 'syz.1.2307': attribute type 21 has an invalid length. [ 160.531012][T13600] netlink: 'syz.4.2310': attribute type 1 has an invalid length. [ 160.545201][T13579] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2307'. [ 160.775350][T13614] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2318'. [ 160.892572][T13625] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2323'. [ 160.922707][T13631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2323'. [ 161.125828][T13653] (unnamed net_device) (uninitialized): option fail_over_mac: invalid value (3) [ 161.155679][T13661] veth1_to_bond: entered allmulticast mode [ 161.234624][T13661] veth1_to_bond (unregistering): left allmulticast mode [ 161.295431][T13671] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20004 [ 161.331628][T13673] netlink: 'syz.0.2340': attribute type 9 has an invalid length. [ 161.406214][T13690] IPVS: set_ctl: invalid protocol: 172 172.20.20.28:20003 [ 161.483412][T13691] nbd: couldn't find a device at index 0 [ 161.591646][T13704] net_ratelimit: 223 callbacks suppressed [ 161.591668][T13704] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 161.607962][T13707] syzkaller0: entered promiscuous mode [ 161.614632][T13707] syzkaller0: entered allmulticast mode [ 161.636384][T13704] bridge0: port 3(team0) entered disabled state [ 161.648689][T13704] team0: left allmulticast mode [ 161.653799][T13704] team_slave_0: left allmulticast mode [ 161.659675][T13704] team_slave_1: left allmulticast mode [ 161.665231][T13704] team0: left promiscuous mode [ 161.670417][T13704] team_slave_0: left promiscuous mode [ 161.688560][T13704] team_slave_1: left promiscuous mode [ 161.709246][T13704] bridge0: port 3(team0) entered disabled state [ 161.724642][T13704] batman_adv: batadv0: Adding interface: team0 [ 161.731132][T13704] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 161.757711][T13704] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 161.770177][T13706] tipc: Enabled bearer , priority 0 [ 161.818804][T13706] tipc: Resetting bearer [ 161.837209][T13706] tipc: Disabling bearer [ 161.847928][T13725] validate_nla: 4 callbacks suppressed [ 161.847946][T13725] netlink: 'syz.3.2353': attribute type 4 has an invalid length. [ 161.920182][ T5908] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 161.979228][T13738] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 162.162973][T13759] openvswitch: netlink: ct_state flags 0000ee01 unsupported [ 162.262903][T13781] tipc: Enabled bearer , priority 0 [ 162.272649][T13781] syzkaller0: entered promiscuous mode [ 162.278436][T13781] syzkaller0: entered allmulticast mode [ 162.362570][T13781] tipc: Resetting bearer [ 162.376952][T13780] tipc: Resetting bearer [ 162.398166][T13780] tipc: Disabling bearer [ 162.429477][T13795] macsec1: entered promiscuous mode [ 162.435295][T13795] bridge0: port 1(macsec1) entered blocking state [ 162.442017][T13795] bridge0: port 1(macsec1) entered disabled state [ 162.449080][T13795] macsec1: entered allmulticast mode [ 162.454489][T13795] bridge0: entered allmulticast mode [ 162.494895][T13795] macsec1: left allmulticast mode [ 162.500246][T13795] bridge0: left allmulticast mode [ 162.632901][T12024] veth0_to_bond: left promiscuous mode [ 162.673385][T13824] netlink: 'syz.3.2387': attribute type 1 has an invalid length. [ 162.713213][T13824] 8021q: adding VLAN 0 to HW filter on device bond6 [ 162.739655][ T9583] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 162.874235][T13849] IPv6: sit2: Disabled Multicast RS [ 162.882510][T13849] sit2: entered allmulticast mode [ 162.934219][T13851] veth16: entered promiscuous mode [ 162.941400][T13851] veth16: entered allmulticast mode [ 163.123351][T13880] RDS: rds_bind could not find a transport for 400:0:1200:0:1030:0:ffff:ffff, load rds_tcp or rds_rdma? [ 163.364801][T13899] team0: Device gtp1 is of different type [ 163.419287][T13909] IPv6: NLM_F_CREATE should be specified when creating new route [ 163.544048][T13922] macsec1: entered promiscuous mode [ 163.551509][T13922] bridge0: entered promiscuous mode [ 163.557478][T13922] bridge0: port 1(macsec1) entered blocking state [ 163.565051][T13922] bridge0: port 1(macsec1) entered disabled state [ 163.571906][T13922] macsec1: entered allmulticast mode [ 163.577403][T13922] bridge0: entered allmulticast mode [ 163.584642][T13922] macsec1: left allmulticast mode [ 163.589966][T13922] bridge0: left allmulticast mode [ 163.595829][T13922] bridge0: left promiscuous mode [ 163.783645][T13948] netlink: 'syz.1.2426': attribute type 1 has an invalid length. [ 163.861416][ T1103] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 163.878872][ T1103] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 163.887899][ T1103] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 163.916174][ T1103] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 164.032706][T13969] tipc: Enabled bearer , priority 0 [ 164.042475][T13969] syzkaller0: entered promiscuous mode [ 164.047964][T13969] syzkaller0: entered allmulticast mode [ 164.205290][T13968] tipc: Resetting bearer [ 164.233757][T13968] tipc: Disabling bearer [ 164.368064][T14018] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 164.377337][T14019] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 164.489349][T14033] __nla_validate_parse: 98 callbacks suppressed [ 164.489369][T14033] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2455'. [ 164.636835][T14052] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2460'. [ 164.640713][T14054] netlink: 'syz.3.2461': attribute type 39 has an invalid length. [ 164.660611][T14043] nbd2: detected capacity change from 0 to 127 [ 164.679043][ T5857] block nbd2: Receive control failed (result -32) [ 165.164588][T14088] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2473'. [ 165.300032][T14100] gretap0: entered promiscuous mode [ 165.305518][T14100] vlan1: entered promiscuous mode [ 165.316076][T14102] tipc: Enabling of bearer rejected, failed to enable media [ 165.325676][T14102] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2477'. [ 165.335592][T14102] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2477'. [ 165.376721][T14105] netlink: 'syz.1.2479': attribute type 4 has an invalid length. [ 165.425244][T14107] syzkaller0: entered promiscuous mode [ 165.432955][T14107] syzkaller0: entered allmulticast mode [ 165.442260][T14109] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2480'. [ 165.466887][T14107] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2481'. [ 165.477420][T14109] netlink: 'syz.3.2480': attribute type 1 has an invalid length. [ 165.498731][T14107] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2481'. [ 165.596053][T14120] netlink: 'syz.1.2483': attribute type 6 has an invalid length. [ 165.606318][T14120] netlink: 284 bytes leftover after parsing attributes in process `syz.1.2483'. [ 165.663973][T14125] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2486'. [ 165.857081][T14154] netlink: 'syz.4.2492': attribute type 11 has an invalid length. [ 165.963023][T14166] IPVS: Unknown mcast interface: veth1_to_bridge [ 166.004935][T14168] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 166.211981][ T9576] IPVS: starting estimator thread 0... [ 166.224116][T14186] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 166.279430][T14196] netlink: 'syz.1.2508': attribute type 1 has an invalid length. [ 166.290154][T14195] netlink: 'syz.1.2508': attribute type 1 has an invalid length. [ 166.318758][T14192] IPVS: using max 48 ests per chain, 115200 per kthread [ 166.493460][T14209] netlink: 'syz.1.2515': attribute type 10 has an invalid length. [ 166.506000][T14209] 8021q: adding VLAN 0 to HW filter on device team0 [ 166.517440][T14209] bond0: (slave team0): Enslaving as an active interface with an up link [ 166.551229][T14209] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 166.851112][T14244] 8021q: adding VLAN 0 to HW filter on device bond5 [ 167.222853][T14279] tipc: New replicast peer: 255.255.255.255 [ 167.230121][T14279] tipc: Enabled bearer , priority 10 [ 167.236412][T14280] tipc: Enabling of bearer rejected, already enabled [ 167.293873][T14289] macvlan3: entered promiscuous mode [ 167.300597][T14289] macvlan3: entered allmulticast mode [ 167.306571][T14289] veth1_to_bond: entered promiscuous mode [ 167.313529][T14289] veth1_to_bond: entered allmulticast mode [ 167.322352][T14289] team0: Port device macvlan3 added [ 167.960519][T14351] tipc: Bearer : already 2 bearers with priority 10 [ 167.968418][T14351] tipc: Bearer : trying with adjusted priority [ 167.975463][T14351] tipc: Enabling of bearer rejected, failed to enable media [ 168.238686][ T9576] tipc: Node number set to 615125091 [ 169.111193][T14396] validate_nla: 2 callbacks suppressed [ 169.111210][T14396] netlink: 'syz.0.2560': attribute type 6 has an invalid length. [ 169.154851][T14396] netlink: 'syz.0.2560': attribute type 5 has an invalid length. [ 169.239579][T14415] netlink: 'syz.3.2567': attribute type 1 has an invalid length. [ 169.340580][T14419] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 169.564641][T14457] __nla_validate_parse: 30 callbacks suppressed [ 169.564661][T14457] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2584'. [ 169.675220][T14461] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2583'. [ 169.700088][T14461] hsr_slave_0: left promiscuous mode [ 169.706315][T14461] hsr_slave_1: left promiscuous mode [ 169.725440][T14476] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 169.775162][T14482] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2590'. [ 169.789926][T14482] netlink: 'syz.0.2590': attribute type 33 has an invalid length. [ 169.799218][T14482] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2590'. [ 169.829132][T14486] lo: entered allmulticast mode [ 169.834811][T14486] lo: left allmulticast mode [ 169.867814][T14488] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2593'. [ 169.887338][T14490] netlink: 172 bytes leftover after parsing attributes in process `syz.3.2594'. [ 169.975019][T14501] openvswitch: netlink: IPv4 tun info is not correct [ 170.063543][T14511] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2602'. [ 170.075157][T14511] netlink: 'syz.2.2602': attribute type 9 has an invalid length. [ 170.085641][T14512] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2603'. [ 170.142893][T14517] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2605'. [ 170.261415][T14531] sch_fq: defrate 0 ignored. [ 170.301831][T14536] sctp: [Deprecated]: syz.1.2612 (pid 14536) Use of struct sctp_assoc_value in delayed_ack socket option. [ 170.301831][T14536] Use struct sctp_sack_info instead [ 170.331664][T14541] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2611'. [ 170.338815][T14536] IPVS: set_ctl: invalid protocol: 58 100.1.1.0:20003 [ 170.439589][T14547] netlink: 'syz.3.2616': attribute type 9 has an invalid length. [ 170.521783][T14556] netlink: 'syz.0.2618': attribute type 9 has an invalid length. [ 170.580041][T14561] netlink: 'syz.4.2621': attribute type 1 has an invalid length. [ 170.616266][T14570] bridge6: entered promiscuous mode [ 170.648597][T14570] bridge6: entered allmulticast mode [ 170.833884][T14596] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 171.162924][T14635] openvswitch: netlink: Missing key (keys=40, expected=80) [ 171.230048][T14641] tipc: Enabling of bearer rejected, failed to enable media [ 171.257380][T14646] netlink: 'syz.3.2650': attribute type 21 has an invalid length. [ 171.366935][T14656] veth0: entered promiscuous mode [ 171.396516][T14653] veth0: left promiscuous mode [ 171.443143][T14664] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 171.759153][T14708] tipc: Enabled bearer , priority 0 [ 171.772034][T14708] syzkaller0: entered promiscuous mode [ 171.792165][T14708] syzkaller0: entered allmulticast mode [ 171.842941][T14708] tipc: Resetting bearer [ 171.857523][T14720] netlink: 'syz.4.2673': attribute type 9 has an invalid length. [ 171.871727][T14706] tipc: Resetting bearer [ 171.951060][T14706] tipc: Disabling bearer [ 172.117257][T14748] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.379537][T14773] nbd: device at index 3 is going down [ 172.480137][T14784] mac80211_hwsim hwsim5 : renamed from wlan1 [ 172.610647][T14800] sctp: [Deprecated]: syz.4.2698 (pid 14800) Use of struct sctp_assoc_value in delayed_ack socket option. [ 172.610647][T14800] Use struct sctp_sack_info instead [ 172.657241][T14808] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 172.912796][T14834] bridge_slave_0: invalid flags given to default FDB implementation [ 172.983314][T14838] ieee802154 phy0 wpan0: encryption failed: -22 [ 173.090735][T14857] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 173.125140][T14858] hsr_slave_1 (unregistering): left promiscuous mode [ 173.235363][T14876] geneve0: mtu less than device minimum [ 173.459934][ T5857] Bluetooth: hci0: command tx timeout [ 173.907574][T14942] FAULT_INJECTION: forcing a failure. [ 173.907574][T14942] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.939537][T14942] CPU: 0 UID: 0 PID: 14942 Comm: syz.3.2743 Not tainted syzkaller #0 PREEMPT(full) [ 173.939564][T14942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 173.939574][T14942] Call Trace: [ 173.939585][T14942] [ 173.939593][T14942] dump_stack_lvl+0x189/0x250 [ 173.939617][T14942] ? __pfx____ratelimit+0x10/0x10 [ 173.939640][T14942] ? __pfx_dump_stack_lvl+0x10/0x10 [ 173.939668][T14942] ? __pfx__printk+0x10/0x10 [ 173.939694][T14942] ? rcu_is_watching+0x15/0xb0 [ 173.939712][T14942] should_fail_ex+0x414/0x560 [ 173.939736][T14942] _copy_to_user+0x31/0xb0 [ 173.939756][T14942] simple_read_from_buffer+0xe1/0x170 [ 173.939781][T14942] proc_fail_nth_read+0x1b3/0x220 [ 173.939801][T14942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.939821][T14942] ? rw_verify_area+0x2a6/0x4d0 [ 173.939841][T14942] ? tun_chr_write_iter+0xe0/0x200 [ 173.939856][T14942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 173.939874][T14942] vfs_read+0x200/0xa30 [ 173.939894][T14942] ? fdget_pos+0x247/0x320 [ 173.939910][T14942] ? __pfx___mutex_lock+0x10/0x10 [ 173.939933][T14942] ? __pfx_vfs_read+0x10/0x10 [ 173.939957][T14942] ? __fget_files+0x3a0/0x420 [ 173.939980][T14942] ? __fget_files+0x2a/0x420 [ 173.940006][T14942] ksys_read+0x145/0x250 [ 173.940028][T14942] ? __pfx_ksys_read+0x10/0x10 [ 173.940045][T14942] ? rcu_is_watching+0x15/0xb0 [ 173.940064][T14942] ? rcu_is_watching+0x15/0xb0 [ 173.940081][T14942] do_syscall_64+0xfa/0x3b0 [ 173.940105][T14942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.940122][T14942] ? clear_bhb_loop+0x60/0xb0 [ 173.940140][T14942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.940155][T14942] RIP: 0033:0x7fcc92d8d5fc [ 173.940170][T14942] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 173.940186][T14942] RSP: 002b:00007fcc90ff6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 173.940205][T14942] RAX: ffffffffffffffda RBX: 00007fcc92fb5fa0 RCX: 00007fcc92d8d5fc [ 173.940218][T14942] RDX: 000000000000000f RSI: 00007fcc90ff60a0 RDI: 0000000000000004 [ 173.940230][T14942] RBP: 00007fcc90ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 173.940241][T14942] R10: 000000000000003e R11: 0000000000000246 R12: 0000000000000001 [ 173.940251][T14942] R13: 00007fcc92fb6038 R14: 00007fcc92fb5fa0 R15: 00007fffa44aada8 [ 173.940270][T14942] [ 174.292843][T14956] validate_nla: 5 callbacks suppressed [ 174.292860][T14956] netlink: 'syz.4.2751': attribute type 9 has an invalid length. [ 174.488931][T12027] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 174.515159][T12027] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 174.546540][T14977] netlink: 'syz.2.2754': attribute type 15 has an invalid length. [ 174.555559][T12027] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 174.566195][T14988] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 174.580988][T14977] __nla_validate_parse: 37 callbacks suppressed [ 174.581006][T14977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2754'. [ 174.610656][T14988] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.617934][T12027] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 174.673585][T14996] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2760'. [ 174.713639][T15000] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 34 [ 174.771654][T14999] openvswitch: netlink: Flow key attr not present in new flow. [ 174.811537][T15012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2764'. [ 174.824434][T15012] netlink: 'syz.4.2764': attribute type 9 has an invalid length. [ 174.872085][T15019] netlink: 5 bytes leftover after parsing attributes in process `syz.3.2767'. [ 174.886854][T15019] 0{X: renamed from gretap0 (while UP) [ 174.899720][T15019] 0{X: entered allmulticast mode [ 174.905893][T15019] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 175.089237][T15047] syzkaller1: entered promiscuous mode [ 175.094818][T15047] syzkaller1: entered allmulticast mode [ 175.392175][T15081] pimreg3: entered allmulticast mode [ 175.474824][T15088] pim6reg1: entered promiscuous mode [ 175.480777][T15088] pim6reg1: entered allmulticast mode [ 175.581573][T15100] nbd: must specify a device to reconfigure [ 175.607885][T15103] netlink: 'syz.1.2790': attribute type 83 has an invalid length. [ 176.072474][ T5860] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 176.080746][ T5860] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 176.088106][ T5860] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 176.099690][T15125] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 176.117656][ T5860] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 176.117966][T15134] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2800'. [ 176.139278][ T5860] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 176.212477][T15136] vxcan1 speed is unknown, defaulting to 1000 [ 176.228075][T15151] netlink: 'syz.2.2802': attribute type 1 has an invalid length. [ 176.306510][T15151] 8021q: adding VLAN 0 to HW filter on device bond12 [ 176.315430][T15151] bond11: (slave bond12): making interface the new active one [ 176.323388][T15151] bond11: (slave bond12): Enslaving as an active interface with an up link [ 176.332459][T15157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2804'. [ 176.334792][T15151] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2802'. [ 176.344226][T15136] wg1 speed is unknown, defaulting to 1000 [ 176.351757][T15151] bond11: entered promiscuous mode [ 176.361611][T15151] bond12: entered promiscuous mode [ 176.366847][T15151] bond11: entered allmulticast mode [ 176.372083][T15151] bond12: entered allmulticast mode [ 176.377840][T15151] 8021q: adding VLAN 0 to HW filter on device bond11 [ 176.418335][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 176.451742][T15162] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2806'. [ 176.462174][T15162] netlink: 'syz.2.2806': attribute type 9 has an invalid length. [ 176.541141][T15169] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2808'. [ 176.558323][T15165] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2807'. [ 176.562138][T15136] chnl_net:caif_netlink_parms(): no params data found [ 176.691906][T15136] bridge0: port 1(bridge_slave_0) entered blocking state [ 176.704900][T15136] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.714832][T15136] bridge_slave_0: entered allmulticast mode [ 176.725087][T15136] bridge_slave_0: entered promiscuous mode [ 176.738390][T15181] IPv6: sit3: Disabled Multicast RS [ 176.744503][T15181] sit3: entered allmulticast mode [ 176.757339][T15136] bridge0: port 2(bridge_slave_1) entered blocking state [ 176.765075][T15136] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.772414][T15136] bridge_slave_1: entered allmulticast mode [ 176.779447][T15136] bridge_slave_1: entered promiscuous mode [ 176.810550][T15136] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 176.824064][T15136] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 176.891712][T15136] team0: Port device team_slave_0 added [ 176.913818][T15136] team0: Port device team_slave_1 added [ 176.965770][T15191] 8021q: adding VLAN 0 to HW filter on device bond7 [ 176.973780][T15191] team0: Failed to send port change of device bond7 via netlink (err -105) [ 176.983437][T15191] team0: Failed to send options change via netlink (err -105) [ 176.990948][T15191] team0: Port device bond7 added [ 177.007902][T15136] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 177.016105][T15136] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.043868][T15136] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 177.056185][T15136] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 177.064150][T15136] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.090471][T15136] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 177.117311][T15136] hsr_slave_0: entered promiscuous mode [ 177.123470][T15136] hsr_slave_1: entered promiscuous mode [ 177.184264][T15136] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.195121][T15136] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.205603][T15136] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 177.257201][T15136] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.267615][T15136] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.278057][T15136] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 177.348452][T15136] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.358805][T15136] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.369216][T15136] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 177.440246][T15136] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 177.450912][T15136] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.461287][T15136] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 177.550739][T15136] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 177.559749][T15136] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 177.571474][T15136] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 177.580275][T15136] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 177.599382][T15136] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.606485][T15136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 177.641779][T15136] 8021q: adding VLAN 0 to HW filter on device bond0 [ 177.654440][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.667939][T15136] 8021q: adding VLAN 0 to HW filter on device team0 [ 177.678192][T12026] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.685347][T12026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 177.697083][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.704279][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 177.817858][T15136] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 177.936215][T15218] netlink: 'syz.2.2818': attribute type 9 has an invalid length. [ 178.125664][T15136] veth0_vlan: entered promiscuous mode [ 178.154048][T15246] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 178.170576][T15136] veth1_vlan: entered promiscuous mode [ 178.183057][ T5860] Bluetooth: hci1: command tx timeout [ 178.205173][T15136] veth0_macvtap: entered promiscuous mode [ 178.240688][T15136] veth1_macvtap: entered promiscuous mode [ 178.270687][T15136] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 178.291882][T15136] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 178.317404][T12026] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.329923][T12026] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.342052][T12026] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.391436][T12026] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.468553][T12026] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.484560][T12026] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.519928][T12030] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 178.539877][T12030] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.556577][T15276] wg2: entered promiscuous mode [ 178.562863][T15276] wg2: entered allmulticast mode [ 178.637926][T15278] syzkaller0: entered promiscuous mode [ 178.643602][T15278] syzkaller0: entered allmulticast mode [ 178.762219][T15293] netlink: 'syz.3.2836': attribute type 39 has an invalid length. [ 178.807521][T15303] tipc: Enabled bearer , priority 0 [ 178.826571][T15297] netlink: 'syz.4.2838': attribute type 9 has an invalid length. [ 178.891199][T15303] syzkaller0: entered promiscuous mode [ 178.896812][T15303] syzkaller0: entered allmulticast mode [ 178.929601][T15295] tipc: Resetting bearer [ 178.941149][T15295] tipc: Disabling bearer [ 179.552101][T15343] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.608079][T15347] netlink: 'syz.1.2856': attribute type 1 has an invalid length. [ 179.616674][T15347] __nla_validate_parse: 17 callbacks suppressed [ 179.616693][T15347] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2856'. [ 179.694618][T15349] netlink: 'syz.0.2858': attribute type 10 has an invalid length. [ 179.743487][T15356] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2860'. [ 179.892474][T15371] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2862'. [ 179.925680][T15371] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.955822][T15371] netlink: 'syz.0.2862': attribute type 1 has an invalid length. [ 179.975379][T15371] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2862'. [ 180.107349][T15401] tipc: Started in network mode [ 180.115948][T15401] tipc: Node identity 5ef1e04676b3, cluster identity 4711 [ 180.126084][T15401] tipc: Enabled bearer , priority 0 [ 180.137047][T15401] syzkaller0: entered promiscuous mode [ 180.142698][T15401] syzkaller0: entered allmulticast mode [ 180.258398][ T5865] Bluetooth: hci1: command tx timeout [ 180.308773][T15399] tipc: Resetting bearer [ 180.337551][T15399] tipc: Disabling bearer [ 180.367226][T15429] vlan2: entered promiscuous mode [ 180.373991][T15429] bridge0: entered promiscuous mode [ 180.414875][T15440] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2878'. [ 180.476506][T15442] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2880'. [ 180.613609][T15454] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 180.626681][T15454] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 180.629444][T15456] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2885'. [ 180.852009][T15462] netdevsim netdevsim3 : renamed from netdevsim0 (while UP) [ 180.892750][ T5855] bond0: (slave syz_tun): Releasing backup interface [ 180.946070][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 180.956306][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 180.965617][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 180.974171][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 180.983259][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 181.015898][T15468] vxcan1 speed is unknown, defaulting to 1000 [ 181.058392][ T5865] Bluetooth: hci2: command 0x0406 tx timeout [ 181.064505][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 181.094625][T15479] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2892'. [ 181.115754][T15479] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2892'. [ 181.127417][T15475] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 181.149274][T15468] wg1 speed is unknown, defaulting to 1000 [ 181.228872][T15485] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2894'. [ 181.332114][T15468] chnl_net:caif_netlink_parms(): no params data found [ 181.421675][T15493] 8021q: VLANs not supported on wg1 [ 181.499541][T15468] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.506773][T15468] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.515989][T15468] bridge_slave_0: entered allmulticast mode [ 181.529750][T15468] bridge_slave_0: entered promiscuous mode [ 181.547957][T15468] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.561778][T15468] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.569680][T15468] bridge_slave_1: entered allmulticast mode [ 181.576776][T15468] bridge_slave_1: entered promiscuous mode [ 181.625224][T15468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 181.641268][T15520] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 181.660892][T15468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 181.730202][T15468] team0: Port device team_slave_0 added [ 181.744311][T15522] vxcan1 speed is unknown, defaulting to 1000 [ 181.753060][T15468] team0: Port device team_slave_1 added [ 181.885280][T15468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 181.898345][T15468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 181.955410][T15468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 181.981987][T15468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 181.993758][T15468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 181.995913][T15528] netlink: 'syz.0.2904': attribute type 7 has an invalid length. [ 182.036586][T15528] netlink: 'syz.0.2904': attribute type 8 has an invalid length. [ 182.068330][T15468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 182.070412][T15533] netlink: 'syz.4.2905': attribute type 1 has an invalid length. [ 182.162205][T15522] wg1 speed is unknown, defaulting to 1000 [ 182.230989][T15468] hsr_slave_0: entered promiscuous mode [ 182.237273][T15468] hsr_slave_1: entered promiscuous mode [ 182.260673][T15468] debugfs: 'hsr0' already exists in 'hsr' [ 182.276738][T15468] Cannot create hsr debugfs directory [ 182.339210][ T5860] Bluetooth: hci1: command tx timeout [ 182.383897][T15531] vxcan1 speed is unknown, defaulting to 1000 [ 182.385904][T15551] syz.4.2909 uses old SIOCAX25GETINFO [ 182.495496][T15557] syzkaller1: entered promiscuous mode [ 182.502066][T15557] syzkaller1: entered allmulticast mode [ 182.596277][T15531] wg1 speed is unknown, defaulting to 1000 [ 182.619163][T15468] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 182.641969][T15468] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.751086][T15468] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 182.775859][T15468] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.813917][T15575] netlink: 'syz.4.2917': attribute type 3 has an invalid length. [ 182.852957][T15468] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 182.879196][T15468] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.024521][T15468] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 183.037783][T15468] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.067837][ T5860] Bluetooth: hci0: command tx timeout [ 183.097461][T15588] veth3: entered allmulticast mode [ 183.213449][T15468] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 183.238100][T15468] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 183.249431][T15599] tipc: Enabling of bearer rejected, failed to enable media [ 183.264001][T15468] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 183.280614][T15468] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 183.467717][T15468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.515924][T15468] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.527892][T15627] pim6reg1: entered promiscuous mode [ 183.534928][T15627] pim6reg1: entered allmulticast mode [ 183.552079][ T1103] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.559262][ T1103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.572246][ T1103] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.579444][ T1103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.773717][T15651] openvswitch: netlink: Tunnel attr 1 has unexpected len 7 expected 4 [ 183.924121][T15468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.957930][T15666] tipc: Enabling of bearer rejected, failed to enable media [ 184.014525][T15468] veth0_vlan: entered promiscuous mode [ 184.041056][T15468] veth1_vlan: entered promiscuous mode [ 184.103105][T15678] bridge: RTM_NEWNEIGH with invalid ether address [ 184.113048][T15468] veth0_macvtap: entered promiscuous mode [ 184.129548][T15468] veth1_macvtap: entered promiscuous mode [ 184.158714][T15468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 184.177306][T15468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 184.200414][T12030] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.211888][T12030] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.229644][T12030] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.241502][T12030] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.293265][ T2925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.304260][ T2925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.349891][ T1103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.361032][ T1103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.420844][ T5860] Bluetooth: hci1: command tx timeout [ 184.616104][T15723] IPVS: sync thread started: state = BACKUP, mcast_ifn = nicvf0, syncid = 2, id = 0 [ 184.645376][T15728] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 184.745532][T15733] netlink: 'syz.1.2967': attribute type 12 has an invalid length. [ 184.765043][T15733] Bluetooth: MGMT ver 1.23 [ 184.777464][T15739] __nla_validate_parse: 19 callbacks suppressed [ 184.777482][T15739] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2969'. [ 184.780293][T15722] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2963'. [ 184.787078][T15734] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2968'. [ 184.815285][T15739] geneve3: entered promiscuous mode [ 184.824669][T15734] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 184.832808][T15734] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 185.005175][ T30] audit: type=1107 audit(1756324464.870:8): pid=15754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 185.024864][T15756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2974'. [ 185.031549][T15746] vxcan1 speed is unknown, defaulting to 1000 [ 185.103579][T15762] netlink: 'syz.4.2976': attribute type 4 has an invalid length. [ 185.141980][ T5860] Bluetooth: hci0: command tx timeout [ 185.234713][T15746] wg1 speed is unknown, defaulting to 1000 [ 185.353944][T15785] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2983'. [ 185.355534][T15787] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2982'. [ 185.472570][T15796] tipc: Enabling of bearer rejected, failed to enable media [ 185.492064][T15794] netlink: 81 bytes leftover after parsing attributes in process `syz.0.2986'. [ 186.226257][T15799] netlink: 'syz.0.2987': attribute type 11 has an invalid length. [ 186.329103][T15814] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2992'. [ 186.367860][T15814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2992'. [ 186.403524][T15819] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2994'. [ 186.423199][T15814] netlink: 'syz.0.2992': attribute type 2 has an invalid length. [ 186.461310][T15819] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 186.507444][T15819] netlink: 'syz.4.2994': attribute type 2 has an invalid length. [ 186.634236][ T5857] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 186.643048][ T5857] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 186.651021][ T5857] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 186.659263][ T5857] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 186.666914][ T5857] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 186.692880][T15837] vxcan1 speed is unknown, defaulting to 1000 [ 186.764271][T15842] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 186.787108][T15837] wg1 speed is unknown, defaulting to 1000 [ 186.931460][T15837] chnl_net:caif_netlink_parms(): no params data found [ 186.988171][T15863] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.002942][T15863] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 187.017891][T15863] bond0 (unregistering): Released all slaves [ 187.036016][T15837] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.043495][T15837] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.050892][T15837] bridge_slave_0: entered allmulticast mode [ 187.059662][T15837] bridge_slave_0: entered promiscuous mode [ 187.067573][T15837] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.074889][T15837] bridge0: port 2(bridge_slave_1) entered disabled state [ 187.083138][T15837] bridge_slave_1: entered allmulticast mode [ 187.090743][T15837] bridge_slave_1: entered promiscuous mode [ 187.135988][T15837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.152185][T15837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 187.192471][T15837] team0: Port device team_slave_0 added [ 187.203092][T15837] team0: Port device team_slave_1 added [ 187.219112][ T5857] Bluetooth: hci0: command tx timeout [ 187.243533][T15837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 187.251499][T15837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 187.279594][T15837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 187.291000][T15875] sit0: entered promiscuous mode [ 187.298046][T15875] netlink: 'syz.1.3007': attribute type 1 has an invalid length. [ 187.307659][T15837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 187.314799][T15837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 187.341208][T15837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 187.394410][T15837] hsr_slave_0: entered promiscuous mode [ 187.409115][T15837] hsr_slave_1: entered promiscuous mode [ 187.417547][T15837] debugfs: 'hsr0' already exists in 'hsr' [ 187.425819][T15837] Cannot create hsr debugfs directory [ 187.630629][T15837] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.644201][T15896] delete_channel: no stack [ 187.724859][T15837] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.804713][T15837] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.914698][T15837] netdevsim netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.944852][T15928] IPVS: Error connecting to the multicast addr [ 187.974990][T15925] ip6gre1: entered allmulticast mode [ 188.065002][T15837] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 188.085666][T15837] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 188.101114][T15837] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 188.116333][T15837] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 188.212324][T15837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 188.235060][T15837] 8021q: adding VLAN 0 to HW filter on device team0 [ 188.246591][T12027] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.253742][T12027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.276170][T12027] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.283411][T12027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.432340][T15972] netlink: 'syz.4.3034': attribute type 1 has an invalid length. [ 188.672549][T15992] netlink: 'syz.0.3037': attribute type 1 has an invalid length. [ 188.707449][T15837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 188.741408][ T5857] Bluetooth: hci5: command tx timeout [ 188.804910][T15837] veth0_vlan: entered promiscuous mode [ 188.824697][T15837] veth1_vlan: entered promiscuous mode [ 188.864303][T15837] veth0_macvtap: entered promiscuous mode [ 188.884737][T15837] veth1_macvtap: entered promiscuous mode [ 189.002632][T15837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 189.030723][T15837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 189.051706][T16021] xt_socket: unknown flags 0xd0 [ 189.068572][T12030] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.094066][T12030] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.111453][T12030] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.149147][T12030] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.233961][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.253447][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 189.286948][ T1103] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 189.299152][ T5857] Bluetooth: hci0: command tx timeout [ 189.325496][ T1103] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 189.406112][T16053] netlink: 'syz.3.2993': attribute type 10 has an invalid length. [ 189.406284][T16049] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 189.507561][T16064] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input6 [ 189.936558][T16109] netlink: 'syz.4.3064': attribute type 1 has an invalid length. [ 189.976435][T16118] netlink: 'syz.2.3067': attribute type 11 has an invalid length. [ 189.985381][T16118] netlink: 'syz.2.3067': attribute type 11 has an invalid length. [ 189.994754][T16118] __nla_validate_parse: 13 callbacks suppressed [ 189.994771][T16118] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3067'. [ 190.064043][ T2925] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 190.743562][T16155] netlink: 'syz.3.3078': attribute type 1 has an invalid length. [ 190.752887][T16155] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3078'. [ 190.818638][ T5857] Bluetooth: hci5: command tx timeout [ 190.857367][T16162] netlink: 'syz.2.3081': attribute type 178 has an invalid length. [ 191.315889][T16185] netlink: 'syz.0.3087': attribute type 9 has an invalid length. [ 191.376126][T16199] netlink: 'syz.1.3093': attribute type 1 has an invalid length. [ 191.387891][T16199] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3093'. [ 191.411965][T16199] syzkaller0: entered promiscuous mode [ 191.417570][T16199] syzkaller0: entered allmulticast mode [ 191.450462][T16206] openvswitch: netlink: Tunnel attr 303 out of range max 16 [ 191.453745][T16199] tipc: Started in network mode [ 191.469278][T16208] openvswitch: netlink: IPv4 tunnel dst address is zero [ 191.493078][T16199] tipc: Node identity 2ed8769534de, cluster identity 4711 [ 191.518526][T16199] tipc: Enabled bearer , priority 0 [ 191.570463][T16199] tipc: Resetting bearer [ 191.611958][T16199] tipc: Disabling bearer [ 191.751090][T16230] syz.3.3103 (16230) used obsolete PPPIOCDETACH ioctl [ 191.814459][ T5860] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 191.823531][ T5860] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 191.832877][ T5860] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 191.840619][ T5868] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 191.852521][ T5868] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 191.860920][ T5868] CPU: 0 UID: 0 PID: 5868 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 191.870358][ T5868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 191.880480][ T5868] RIP: 0010:klist_remove+0x14a/0x340 [ 191.885978][ T5868] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 e9 4b b3 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 ca 4b b3 f6 49 8b 44 24 58 48 89 44 24 08 [ 191.905570][ T5868] RSP: 0018:ffffc9000407f5e0 EFLAGS: 00010202 [ 191.911636][ T5868] RAX: 000000000000000b RBX: ffff88802b3c5a00 RCX: 0000000000000000 [ 191.919590][ T5868] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 191.927547][ T5868] RBP: ffffc9000407f6e0 R08: ffffffff8f89ff03 R09: 1ffffffff1f13fe0 [ 191.935506][ T5868] R10: dffffc0000000000 R11: fffffbfff1f13fe1 R12: 0000000000000000 [ 191.943652][ T5868] R13: 1ffff1100ade1c8c R14: ffff888056f0e460 R15: dffffc0000000000 [ 191.951652][ T5868] FS: 0000000000000000(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 [ 191.960577][ T5868] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 191.967237][ T5868] CR2: 00007f501c28ef98 CR3: 000000005e5a4000 CR4: 00000000003526f0 [ 191.975196][ T5868] Call Trace: [ 191.978469][ T5868] [ 191.981384][ T5868] ? __pfx_klist_remove+0x10/0x10 [ 191.986398][ T5868] ? __pfx_kobject_move+0x10/0x10 [ 191.991418][ T5868] ? do_raw_spin_unlock+0x122/0x240 [ 191.996692][ T5868] ? get_device_parent+0x366/0x3a0 [ 192.001789][ T5868] device_move+0x193/0x700 [ 192.006195][ T5868] hci_conn_del_sysfs+0xb8/0x170 [ 192.011138][ T5868] hci_conn_del+0xc33/0x11b0 [ 192.015825][ T5868] hci_conn_hash_flush+0x191/0x230 [ 192.020921][ T5868] hci_dev_close_sync+0xaef/0x1330 [ 192.026025][ T5868] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 192.031583][ T5868] ? up_write+0x1c4/0x420 [ 192.035902][ T5868] hci_unregister_dev+0x21a/0x510 [ 192.040944][ T5868] vhci_release+0x80/0xd0 [ 192.045262][ T5868] ? __pfx_vhci_release+0x10/0x10 [ 192.050270][ T5868] __fput+0x44c/0xa70 [ 192.054348][ T5868] task_work_run+0x1d4/0x260 [ 192.058941][ T5868] ? __pfx_task_work_run+0x10/0x10 [ 192.064062][ T5868] ? kmem_cache_free+0x18f/0x400 [ 192.069088][ T5868] do_exit+0x6b5/0x2300 [ 192.073238][ T5868] ? do_raw_spin_lock+0x121/0x290 [ 192.078371][ T5868] ? __pfx_do_exit+0x10/0x10 [ 192.082951][ T5868] ? rcu_is_watching+0x15/0xb0 [ 192.087702][ T5868] do_group_exit+0x21c/0x2d0 [ 192.092287][ T5868] get_signal+0x1286/0x1340 [ 192.096783][ T5868] arch_do_signal_or_restart+0x9a/0x750 [ 192.102320][ T5868] ? fput_close_sync+0x119/0x200 [ 192.107240][ T5868] ? kmem_cache_free+0x309/0x400 [ 192.112164][ T5868] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 192.118318][ T5868] ? __pfx_ksys_read+0x10/0x10 [ 192.123091][ T5868] ? rcu_is_watching+0x15/0xb0 [ 192.127848][ T5868] exit_to_user_mode_loop+0x75/0x110 [ 192.133123][ T5868] do_syscall_64+0x2bd/0x3b0 [ 192.137710][ T5868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.143782][ T5868] ? clear_bhb_loop+0x60/0xb0 [ 192.148468][ T5868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.154346][ T5868] RIP: 0033:0x7f36a9f8d5fc [ 192.158743][ T5868] Code: Unable to access opcode bytes at 0x7f36a9f8d5d2. [ 192.165741][ T5868] RSP: 002b:00007ffed8582e20 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 192.174135][ T5868] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f36a9f8d5fc [ 192.182179][ T5868] RDX: 0000000000000030 RSI: 00007ffed8582ee0 RDI: 00000000000000f9 [ 192.190137][ T5868] RBP: 00007ffed8582e8c R08: 0000000000000000 R09: 00007ffed8582b97 [ 192.198181][ T5868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000258 [ 192.206140][ T5868] R13: 00000000000927c0 R14: 000000000002eb4e R15: 00007ffed8582ee0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 192.214104][ T5868] [ 192.217108][ T5868] Modules linked in: [ 192.223565][ T5868] ---[ end trace 0000000000000000 ]--- [ 192.238681][ T5860] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 192.276287][ T5868] RIP: 0010:klist_remove+0x14a/0x340 [ 192.281784][ T5868] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 e9 4b b3 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 ca 4b b3 f6 49 8b 44 24 58 48 89 44 24 08 [ 192.301619][ T5868] RSP: 0018:ffffc9000407f5e0 EFLAGS: 00010202 [ 192.307801][ T5868] RAX: 000000000000000b RBX: ffff88802b3c5a00 RCX: 0000000000000000 [ 192.316091][ T5868] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 192.324223][ T5868] RBP: ffffc9000407f6e0 R08: ffffffff8f89ff03 R09: 1ffffffff1f13fe0 [ 192.332364][ T5868] R10: dffffc0000000000 R11: fffffbfff1f13fe1 R12: 0000000000000000 [ 192.339056][T16214] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 192.358339][ T5860] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 192.398381][ T5868] R13: 1ffff1100ade1c8c R14: ffff888056f0e460 R15: dffffc0000000000 [ 192.415828][ T5868] FS: 0000000000000000(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 192.518348][ T5868] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 192.524976][ T5868] CR2: 00007f501c2aff98 CR3: 000000005e5a4000 CR4: 00000000003526f0 [ 192.561620][ T5868] Kernel panic - not syncing: Fatal exception [ 192.567985][ T5868] Kernel Offset: disabled [ 192.572297][ T5868] Rebooting in 86400 seconds..