last executing test programs: 2.161655761s ago: executing program 0 (id=4067): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$ax25(0x3, 0x3, 0xcd) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', 0x0, 0x0, 0x0) ioctl$SIOCAX25ADDFWD(r0, 0x89ea, &(0x7f0000000040)={@default, @default}) socket$nl_generic(0x10, 0x3, 0x10) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2001, 0x0) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x44094) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'vxcan0\x00'}) 1.612966286s ago: executing program 0 (id=4071): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000780)=@filter={'filter\x00', 0x4, 0x4, 0x13d8, 0xffffffff, 0x1218, 0x1218, 0x1218, 0xfeffffff, 0xffffffff, 0x1308, 0x1308, 0x1308, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0x1100, 0x1128, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x1, './cgroup.cpu/syz0\x00', 0x1fc, {0x8}}}, @common=@eui64={{0x28}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'pim6reg0\x00', {0xf18}}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', [0xff, 0x0, 0xffffffff], [0x0, 0x0, 0xff000000, 0xff], 'team0\x00', '\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, 'veth1_to_bond\x00', {0xffffffffffff3ebb}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x145b) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=ANY=[@ANYBLOB="54000000000801010000ffffe00000000a000000050003002f0000000600024000000000240004800800024000000000080001400000fcff07000140800000010800014080000001090001"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x28040000) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x20000000}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'vlan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)={0x20, r4, 0x1, 0x0, 0x0, {0x1e}, [@ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x20}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="440000004600070128bd700000000000017c000030000480", @ANYRESDEC, @ANYRESDEC=0x0], 0x44}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000780)=@filter={'filter\x00', 0x4, 0x4, 0x13d8, 0xffffffff, 0x1218, 0x1218, 0x1218, 0xfeffffff, 0xffffffff, 0x1308, 0x1308, 0x1308, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0x1100, 0x1128, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x1, './cgroup.cpu/syz0\x00', 0x1fc, {0x8}}}, @common=@eui64={{0x28}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@empty, 'pim6reg0\x00', {0xf18}}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', [0xff, 0x0, 0xffffffff], [0x0, 0x0, 0xff000000, 0xff], 'team0\x00', '\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, 'veth1_to_bond\x00', {0xffffffffffff3ebb}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x145b) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=ANY=[@ANYBLOB="54000000000801010000ffffe00000000a000000050003002f0000000600024000000000240004800800024000000000080001400000fcff07000140800000010800014080000001090001"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x28040000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x20000000}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'vlan0\x00'}) (async) sendmsg$ETHTOOL_MSG_PAUSE_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)={0x20, r4, 0x1, 0x0, 0x0, {0x1e}, [@ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x20}}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="440000004600070128bd700000000000017c000030000480", @ANYRESDEC, @ANYRESDEC=0x0], 0x44}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) 1.505714095s ago: executing program 3 (id=4073): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000300)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x48000, &(0x7f0000000040)={@_ha_fsid={[0x2, 0x9]}, {0x34, 0x1, 0xad1c, 0xd}}, 0x0, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)}, 0x2, &(0x7f00000002c0)=[{0x3, 0x3, &(0x7f0000000100)='!\x00', &(0x7f0000000140)="14e7b9932a24780b4e1b5687f884c7443ea5460fb531c980a0aea4e1867c9d2e021ce9002302b0d6868001b1355a24a64852e97ba7e526b9b95275bbd6c492e07f27ee91e24b4ac899c9d4635e522b2bddd30a3f140b57bcb63451c6667d52fbb4d3dcb261f6660bcc83f8d293dc3a09bdbed14848b40ee1e554d49e9fba56f500d908adb5fd9ae80c45c48a3416591c7ea8b3f14accb78ec4914264d22f31640350050a671ee52a", 0xa8}, {0x1, 0x2, &(0x7f0000000200)='//\xf8],)\x00', &(0x7f0000000240)="22fee7a61444b64d5a90bd2da09b362896a166dda044ce0b4d7209341583c4a158c073a7973dfc6092b891d48628a97ecb18aa1b02d0d897811a0cc9bd8f41fb643ebd21912e09fec710d061e9c7a3318b28093c385810b208f9e1b81231ca995f3a03308341ba797487fcf72b308e24", 0x70, 0x2a}]}) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, 0x1405, 0x1, 0x70bd2d, 0x25dfdbfc, "", [{{0x8}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4012) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000480)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000004c0)={@mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5, 0x9, 0x7, 0x400, 0x5e0db559, 0x40, r1}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r0) getpeername$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000600)=0x14) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000780)={&(0x7f0000000540), 0xc, &(0x7f0000000740)={&(0x7f0000000640)={0xf8, r2, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x24000814}, 0x4008080) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x28, 0x1411, 0x400, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}]}, 0x28}}, 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000008c0)='./cgroup/syz1\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x5, 0x17, &(0x7f0000000900)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_fd={0x18, 0x8, 0x1, 0x0, r0}, @initr0={0x18, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x7e56}, @generic={0x6, 0x7, 0x9, 0x7fff, 0x4ede}, @alu={0x4, 0x0, 0x0, 0x9, 0x2, 0x7, 0x4}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1ff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000009c0)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x60, '\x00', r3, @fallback=0xb, r0, 0x8, &(0x7f0000000a00)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000a40)={0x3, 0x1, 0x5, 0x3ab}, 0x10, 0xffffffffffffffff, r0, 0x1, &(0x7f0000000a80)=[r0, r0], &(0x7f0000000ac0)=[{0x0, 0x1, 0x8, 0x9}], 0x10, 0x5}, 0x94) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001ec0)={0xffffffffffffffff, 0x20, &(0x7f0000001e80)={&(0x7f0000000d80)=""/226, 0xe2, 0x0, &(0x7f0000000e80)=""/4096, 0x1000}}, 0x10) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001f00)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x4c6f, '\x00', r3, r0, 0x2, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000002000)={{r0, 0xffffffffffffffff}, &(0x7f0000001f80), &(0x7f0000001fc0)='%+9llu \x00'}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000002080)={0x1b, 0x6, &(0x7f0000000bc0)=@raw=[@cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffff8}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}], &(0x7f0000000c00)='GPL\x00', 0x10001, 0xb0, &(0x7f0000000c40)=""/176, 0x41100, 0x5a, '\x00', r3, @fallback=0x21, r0, 0x8, &(0x7f0000000d00)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000d40)={0x0, 0x7, 0x2, 0x6}, 0x10, r4, r0, 0x0, &(0x7f0000002040)=[r0, r0, r0, r0, r0, r5, r0, r0, r0, r6], 0x0, 0x10, 0x5}, 0x94) accept4$netrom(r0, &(0x7f0000002140)={{0x3, @rose}, [@netrom, @rose, @rose, @default, @rose, @null, @null, @bcast]}, &(0x7f00000021c0)=0x48, 0x81000) r8 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r8, 0x4058587a, &(0x7f00000023c0)={{0xffffffffffffffff, &(0x7f0000002200)='\x00', 0x440000, &(0x7f0000002240)={@_ha_fsid={[0x2, 0x100]}, {0x7, 0x8, 0x4, 0x80000000000}}, 0x6, &(0x7f0000002280)={@_ha_fsid}, &(0x7f00000022c0)=0x1}, {[0xfffffdb5, 0x2, 0x20, 0x1]}, 0x7ff, 0x92, &(0x7f0000002300)=""/146}) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002440), r10) sendmsg$IEEE802154_SET_MACPARAMS(r10, &(0x7f0000002540)={&(0x7f0000002480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000002500)={&(0x7f00000024c0)={0x28, r11, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$BTRFS_IOC_INO_PATHS(r7, 0xc0389423, &(0x7f00000025c0)={0x8, 0x18, [0x5, 0xfff, 0x7, 0x2], &(0x7f0000002580)=[0x0, 0x0, 0x0]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000002600)={'batadv_slave_0\x00'}) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002680), r0) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000026c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r9, &(0x7f0000002780)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002740)={&(0x7f0000002700)={0x1c, r12, 0x100, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r13}, @void}}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004040}, 0x4044840) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000002980)={&(0x7f00000027c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000002940)={&(0x7f0000002800)={0x114, r12, 0x2, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x80}}}}, [@NL80211_ATTR_TX_RATES={0xc8, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x20, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x8e4cf7019249ee4b, 0xa6, 0x4, 0xed, 0x24, 0x12, 0x60, 0x24, 0x30, 0xc, 0x1b, 0x18]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x98, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4, 0x9, 0x9, 0x0, 0xfff4, 0x7f, 0x2]}}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x3, 0xb, 0x6, 0x48, 0x36, 0x60, 0x6c, 0x16, 0x2, 0x9, 0x5, 0x36, 0x18, 0x1b, 0x5b, 0x36, 0x18, 0x12, 0x18, 0x12, 0x12]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x2, 0x1bc, 0x8, 0x9, 0x8, 0x7, 0xfff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x38, 0x7, 0x0, 0x7f, 0x1, 0x68, 0x8001, 0x4]}}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x16, 0x27, 0x24, 0x18, 0x24, 0x6c]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x18, 0x48, 0x12, 0x24, 0x60, 0x2, 0x2]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0xffff, 0x8000, 0x7, 0x7, 0xc54, 0x7, 0x7ff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}, @NL80211_ATTR_INACTIVITY_TIMEOUT={0x6, 0x96, 0x6}, @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x2}, @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x2}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_HE_BSS_COLOR={0x8, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}]}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x9}]}, 0x114}, 0x1, 0x0, 0x0, 0x40000}, 0x4004000) getpeername$tipc(0xffffffffffffffff, &(0x7f00000029c0), &(0x7f0000002a00)=0x10) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x8) recvfrom(0xffffffffffffffff, &(0x7f0000002a40)=""/183, 0xb7, 0x10004, &(0x7f0000002b00)=@x25, 0x80) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000002b80)={'wlan0\x00'}) 1.324453311s ago: executing program 0 (id=4075): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0xffffff1f, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0xffffff81}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_TTL={0x5, 0x8, 0xd}]}}}]}, 0x3c}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001000)={&(0x7f0000000ec0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@enum={0x1}]}, {0x0, [0x5f, 0x2e, 0xe32b8cec5ab8c040]}}, 0x0, 0x29}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xbf}, [@ldst={0x7}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0xe, 0x40, 0x3, 0x41}, 0x50) r2 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000001880)={r2}) r4 = socket$nl_generic(0x10, 0x3, 0x10) close(0x4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r5, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0x1}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000200)='k', 0x1}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc", 0x1}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c6", 0x1}], 0x5}}], 0x2, 0x4000000) setsockopt$sock_int(r5, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) sendmsg$sock(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000600)="bb", 0x1}], 0x1}, 0x800) r6 = socket(0x26, 0x4, 0xffffff9d) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'macvtap0\x00'}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r7}, &(0x7f0000000600), &(0x7f0000000640)=r1}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000c80)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff7fff}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r7}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.251543928s ago: executing program 1 (id=4078): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) (async) write(r2, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) syz_genetlink_get_family_id$nl80211(&(0x7f0000000ec0), r2) bpf$MAP_CREATE(0x300000000000011, &(0x7f0000000100)=@base={0x18, 0x4, 0x41, 0x0, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4002, 0x5}, 0x48) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4002, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000000000000000000000000000000090935ec6b19d05e62d0d278a0fae193c8fa5209bc0620b53bd2ac3d0a1a36e75cfd5d21a981e896bcee0c7b8263d5220f6aa363ade1bbc5f9425e886763cb028f02415d64b8f28a554451408fbccfd41a4aacc1a819bd6f082133c12a3fb92a421fa2ebcba0791aa5a36294508000000f556e91838640d5ba89bcac2ec7d9d592787596a9fe646d489007cd618582b88a77e22e6c2c01f"], &(0x7f0000000100)='GPL\x00', 0x4, 0xd2, &(0x7f00000002c0)=""/210}, 0x90) (async) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000080)="7800000018002507b9409b14ffff00000200be040205fe056402040c5c0009003f0020030a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000402160008000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x40, 0x0, 0xfffffffffffffcc1) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061044c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfde9, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) 1.188682178s ago: executing program 3 (id=4079): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0xa, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x8001}, 0x4) syz_emit_ethernet(0x2e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200000ee45b1e000000080045e0b0"], 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet(0x2, 0x3, 0x33) socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r3, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001e0001000002000000010000070021790000000000000900"/37], 0x2c}, 0x1, 0x0, 0x0, 0x2}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in=@initdev, @in6=@private1}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000000100)=0xe8) recvmmsg(r2, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r2, 0x0) ioctl$OCFS2_IOC_MOVE_EXT(r4, 0x40406f06, &(0x7f00000000c0)={0x1, 0x0, 0x101, 0xbe25, 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x20}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.132943889s ago: executing program 0 (id=4080): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4004080) 1.098281576s ago: executing program 4 (id=4081): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000540)={r0, &(0x7f0000000440)='\x00', 0x101000, &(0x7f0000000480)={@_ha_fsid={[0x7fffffff, 0x2]}, {0xdef0, 0x8000, 0x2fb, 0x2}}, 0x1, &(0x7f00000004c0), &(0x7f0000000500)=0x8}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000a40)={&(0x7f00000009c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@const={0x4, 0x0, 0x0, 0xa, 0x2}]}, {0x0, [0x30]}}, &(0x7f0000000a00)=""/29, 0x27, 0x1d, 0x1, 0x4, 0x10000}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000c80)={0xffffffffffffffff, 0x20, &(0x7f0000000c40)={&(0x7f0000000ac0)=""/189, 0xbd, 0x0, &(0x7f0000000b80)=""/190, 0xbe}}, 0x10) r7 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000d00)=@generic={&(0x7f0000000cc0)='./file0\x00', 0x0, 0x18}, 0x18) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000d40)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000e40)={0xe, 0x2b, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7}, {}, {}, [@jmp={0x5, 0x0, 0x0, 0x5, 0x9, 0x8, 0x10}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x3, 0x6, 0x3, 0xf, 0x4}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @call={0x85, 0x0, 0x0, 0xd0}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000880)='syzkaller\x00', 0x8b, 0xd3, &(0x7f00000008c0)=""/211, 0x41100, 0x0, '\x00', 0x0, @sk_skb=0x5, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a80)={0x5, 0x0, 0x115f, 0x4}, 0x10, r6, r7, 0x2, &(0x7f0000000dc0)=[r8], &(0x7f0000000e00)=[{0x3, 0x1, 0x0, 0x5}, {0x5, 0x1, 0xe, 0x5}], 0x10, 0xfffffffc}, 0x94) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000f00)=ANY=[@ANYBLOB="1800080000000000000000000000eaff950000000000000090340d98a784ab9aec23ad4a401f44619030033884430f15e09ab5bfafd269451b08d1c48f5865eb91ffffffffed447a70d32d"], &(0x7f0000000300)='syzkaller\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r9, 0x0, 0x0}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8}, @NFTA_NG_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "c9"}]}], {0x14}}, 0x8c}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c0002800c00210009ffffffffffff"], 0x4c}}, 0x0) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002a80)=ANY=[@ANYBLOB="140100002300010000000000fcdbdf250101f2800f0018007d3a2e9c5bc85c23277d000014000200fc02000000000000000000000000000050bb2d6f67d29d6fabadb107d0def49c88000000000000f0fdb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcba3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc3580400e900000000"], 0x114}], 0x1, 0x0, 0x0, 0x48000}, 0x4015) pselect6(0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x5}, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9eaafdc0a00e9bfde908990817b364e51afe9c81a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba75411890700000000000000d8e5b1dc91c5499bea0977"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) write$tun(0xffffffffffffffff, &(0x7f0000000f80)={@void, @void, @eth={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}, @random="451e3f30f9f4", @val, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xe0, 0x0, 0x6000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102}, {0x20, 0x86dd, 0xcc, 0x0, @opaque="d712a55b67c402065c51bea93a6685c28e928cea14c144d0f8e4f6c7ce045c104d7d94a9fd6801988dee1fc281c250d48ba3d117bda3f6dbad4d1c27b5921a15a091c8708457a38102f676ee66b932ca4ef02158401e2578413dab270fe9e03fa4ccf47603dd18fb776e1bde5b63c12433bfa9131639147452abeb9e600800a53bed754188e9710134b134c35b841fce450b6de3ec7136fd6740e0984b4174d190e5ec1772b5b0d42bf46e1d6c5153eb68b1682a0d16be0c0e8e4778a8121fe827bffe14"}}}}}}, 0xf6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r12, 0x0, 0xd00, 0x0, &(0x7f0000000380)="263abd030e98ff4dc870bd6688a8640888a8", 0x0, 0x1200}, 0x28) ioctl$sock_bt_hci(r11, 0x400448e4, 0x0) bind$bt_hci(r11, &(0x7f0000000040), 0x6) r13 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r13, 0x10e, 0x1, &(0x7f0000000040)=0x1, 0x4) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r13, 0x10e, 0x2, &(0x7f0000000100), 0x4) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000000)=@newtaction={0x84, 0x30, 0x12f, 0x0, 0x0, {0x0, 0x0, 0x1be}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10, 0x20000000, 0xc7, 0x4e, 0xbf, {0x50, 0x0, 0xc, 0x9, 0x907, 0x6}, {0x8, 0x1, 0x3, 0x6, 0x6}, 0x1017, 0x5, 0x5}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000008112a2000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) 952.775387ms ago: executing program 1 (id=4082): mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x2, 0x82011, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fa3000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0xffffc000) socket$igmp(0x2, 0x3, 0x2) socket$inet_mptcp(0x2, 0x1, 0x106) 934.62045ms ago: executing program 3 (id=4083): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000004080)=@base={0x2, 0x4, 0x4, 0xbf22, 0x400}, 0x48) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x2, 0x82011, r0, 0x0) (async) mmap(&(0x7f0000fa3000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x63, 0x11, 0x33}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) 817.533101ms ago: executing program 1 (id=4085): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$unix(0x1, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764", 0x594}], 0x1, 0x0, 0x6b}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x9383, 0x4}, 0x4}}, @TCA_MPLS_TC={0x5}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x7}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x7fffffff}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x5ea, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events.local\x00', 0x275a, 0x0) write$cgroup_devices(r9, 0x0, 0x0) sendmsg$nl_route(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_CARRIER={0x5, 0x21, 0x4}]}, 0x28}}, 0x4008000) 740.948469ms ago: executing program 4 (id=4086): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x14, 0x15, 0x301, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) read(r0, &(0x7f0000000080)=""/186, 0xba) 739.90814ms ago: executing program 3 (id=4087): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001800010051217fd3d606000000000000000000000000e700000000000000"], 0x1c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@newtaction={0x60, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x5, 0x3003, 0x3, 0x9, 0x8}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x60}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f00000001c0)={0x4, 0x9e, 0x9, 0x3, 0x101, 0x8, 0xe}) accept(0xffffffffffffffff, &(0x7f0000000000)=@x25, &(0x7f0000000080)=0x80) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) writev(r5, &(0x7f0000000740)=[{&(0x7f0000000280)="581a17919cc77431510e7fc4ed9fb860505f1495ff92f16a44f8a13d58751d926def1f80b315bdc726cdd8b5d1a91f485854af8fc854b0da7a02522fe7b2c21db7a46c48473099d4a4654cfd97a67c9e79afc0d444e6c78b0216d2201b128df9d4ed5b4dbe676fe56a6354f819d997a6acb8595633cff6f77473b2b3abcc65b51cb3d3a30bf9b0b2ce59d568d3a89b49331904da2a37c89ea236f5d5640c32c3ac74e4bde1a60c560cb63836552f881c8a8305d2a13d838a5160a6c06c63decc86", 0xc1}], 0x1) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r5, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xc1}], 0x1) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0xfffffe98, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c006200000000000000c6536ca04f00005004234701148f9400971e7a72ee53378a4d95afb015083d7598c9d97079a87c4546c161829bd2a88be552c21cac9220d0847720e9e98670b571d56cda8c28f5731b1c43eed5bdff8a706881"], 0x1c}, 0x1, 0x0, 0x0, 0x20044804}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) close(r6) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r8}, &(0x7f00000006c0), &(0x7f0000000700)=r7}, 0x20) 739.472392ms ago: executing program 2 (id=4088): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="600100001000130926bd70000000000064010102000000000000000000000000ac1414aa0000000000000000000000004e2200004e230002020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb000004d3ff000000fe805a000000000000000000000000aa0000000000000000000000000000000008000000000000000a00000000000000060000000000000000000000000000000000000000000000010000000000000000000000000a000000000000000000000200000000080000f8ffffffffffffff06000000000000000200000029bd70000000000002000100280000000000000068001200726663343534de2867636d286165732929000000000000000000000000000000000000000000000000000000681212d66a385a08701cdda9309f5c00000000000000000000000000000000e000000080000000316f74eeac053deb73fc018488cc121927a9bca20755cc462bc8d62171d2b9d8dc82057f51"], 0x160}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) 634.74788ms ago: executing program 2 (id=4089): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x18, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x164, r3, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6332}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x168}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK={0xf0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1d540000}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x10}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x24040800}, 0x8005) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}]}]}, 0x2c}}, 0x0) (async) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}]}]}, 0x2c}}, 0x0) 607.654799ms ago: executing program 3 (id=4090): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000000), 0x4) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200fffe4c0004802800018007000100637400001c000280080001400000000208000240000000070500030001000000200001800700010063740000140002800800024000000011080004400000000c0900010073797a30000000000900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @broadcast, 0x0, 0x7ffffffe, 'lblcr\x00', 0x1e, 0x400eeb4, 0x14}, 0x2c) 555.012647ms ago: executing program 4 (id=4091): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) ioctl$TUNSETNOCSUM(r3, 0xff04, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x40}}, 0x0) close(r0) 510.125628ms ago: executing program 2 (id=4092): r0 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r0, 0x0, 0xd0, 0x0, &(0x7f0000000080)) (async) r1 = socket(0x10, 0x3, 0xc) write(r1, &(0x7f0000000040)="effd00001000ff00fd4344c007110000", 0x10) 482.204006ms ago: executing program 3 (id=4093): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001e004b05000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r1], 0x28}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r7 = socket$igmp(0x2, 0x3, 0x2) bind$inet(r7, &(0x7f00000000c0)={0x2, 0x4e24, @multicast2}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r6}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 480.908377ms ago: executing program 4 (id=4094): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1e, 0x4, 0x5, 0xff, 0x0, 0xffffffffffffffff, 0xc, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffd}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x90) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa}]}, 0x40}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) bind$tipc(r0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/211, 0xd3}], 0x1}}], 0x1, 0x40000100, 0x0) 368.877046ms ago: executing program 1 (id=4095): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b000000000000000000000000800000000008"], 0x48) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xe, &(0x7f0000000000)=0x1662cd33, 0x4) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) getsockopt(r2, 0x1, 0x29, 0x0, &(0x7f0000000080)) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x15, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000002e00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) r4 = socket$unix(0x1, 0x1, 0x0) (async) unshare(0x20400) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) connect$bt_l2cap(r5, &(0x7f0000000180)={0x1f, 0x0, @fixed}, 0x18) (async) sendmmsg$inet(r4, &(0x7f0000006540)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000280)="b3", 0x1}], 0x1}}], 0x1, 0x0) 368.458647ms ago: executing program 2 (id=4096): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) (async, rerun: 32) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000001300)='ns/net\x00') (async, rerun: 32) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) (async) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)=ANY=[@ANYBLOB="5400000012000100000000000000000002"], 0x54}}, 0x20004010) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) close(r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRESHEX=r4, @ANYRES16=r6], 0x3c}}, 0x0) getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000180)=0x14) (async, rerun: 64) write(r4, &(0x7f0000000000)="0a000000010001", 0x7) (rerun: 64) 303.40346ms ago: executing program 1 (id=4097): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast1, @in6=@mcast2, 0x4, 0xb6e, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x32}, @in=@rand_addr=0x64010101, {0x0, 0x0, 0x1, 0x8000000000000001, 0xfffffffeffffffff, 0x10, 0x8001, 0x543}, {0x4, 0x7fffffffffffffff, 0xb, 0xfffffffffffffffd}, {0x0, 0xe}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x50}}, 0xf0}, 0x1, 0x0, 0x0, 0x880}, 0x2094) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x1c, r1, 0x1}, 0x1c}}, 0x0) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="74000000010701030000000000000000030000040900010073797a3100000000540007800800024000000002080002400000b55a0800014000000001080001400000000108000240000000070800014000000006080001400000000808000240ffffdfda0800014000e000000806"], 0x74}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000004900010000000000000000000a000000000000eb00000000141001"], 0x3c}, 0x1, 0x0, 0x0, 0x800400d}, 0x8001) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050841) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r3 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r3, &(0x7f0000000b80)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0x68, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xe}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @loopback}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) 211.580016ms ago: executing program 4 (id=4098): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000a00)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x7fffffff, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) socket(0x1e, 0x2, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004a80)=@newtaction={0x1008, 0x30, 0x0, 0x70bd29, 0x25dfdbfb, {}, [{0xff4, 0x1, [@m_ipt={0x60, 0x17, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xadc0}, @TCA_IPT_HOOK={0x8}]}, {0x25, 0x6, "e0bc7743d52057483c234da7396aee1c1620232e9758fc402870746166594df527"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ipt={0xf90, 0x7, 0x0, 0x0, {{0x8}, {0x4}, {0xf65, 0x6, "281e4e3e0c40476018fa8215aad6f3df9be9c368b076e7baf5af4a77ee2c2ccd7aee6d3d9832b2801db265cfd88a70ba0f361e01e281de022d2b67713fe137cb18a705201b53ddfb154f367ede44dae6362fa72e12a2c5f3cb668a6425fee53f7ee61dc3589d938b49a42a1b65891ccb1a4667d34e987bf0e6bf5b082190ec628aa72300c988c081acd1cc00431eb428a483529c0b73bb33bbb339414aa56b87df850ef444e3cd12cbe746c3832a67ce2ae18644a56c441c33ed457a071c96b33f50324fa41739f8dfa58532a7119feafb6e759ebdf90c681a6b2ed0425f241e1f333b9d6e2f2a5a460eb8864fd73e594f0c437bcdfef9bd1dc29bd32de46643c9ba9905729f72559fc7f87877b0dfae17344fe151e7756f05bb0de3bcfbbd4a6caf224c497e76bbd002482b0142ea591efaaaab7496eabe6b7e3ae1c4a2848170545918727b6f4f9a89fb6c3d6207a6cc011825e0a6c7282c896a4a1ea4abefe140a4d1dad93d1247bcf1a35eec881b5ece5e66774b1b305daa9b0719805774354d957afbf12531ebc2d1c74645f788d32abbd24667ef0c66969ce6df41d29555632bbf3740a91ee98e70eb3b4ce02e864dffcf5ad3c5a729f912dad9235fde2ffa922f4654276e4d413aa76365a2a4fe47517859135130b2d9f242a0abd0efcc1c51bd4b8fe88d36d965ef4956a48c40ce1d8f558e02544667056705e4da6b8a9a82f554334d244a24395e99b45e961566b1d1b3b14e2270f627bdc41ad726d74b2c6f74a0b79d77a417f649cf9219492d511cecd152bafac8184970b7a34d0ae0d4a3f1d11df8567de55bdef44339c30092da87bbb990e49b92c90a5ae530c51a4025662707df22af9e1421118447d9a4a85448c19332c19134dfcf8bb90209cc0cf79929cb39e3c3797391893b66ab544e78fcd9f3535d533411a87d11102fd94ad7252362055b9d147a2bb92808c4fd923d61fc33748473f295ea208c5f15a311576ded5f0e4c54147864f5ef7a2596cde1c7c1450d2ea8495c3850c72c4c21481a011a95fd017eda366155d475731eb95c3006c3a3406f1baf94b5de84114ec2627222a1cd3c8d2b88916cb2054c11df2761994f8112909f417a30689de748b556e8ecaa2dc7f628cecf6405d2954deaea698108d208a67559556eedb14d85cabf4c172c98c9b24f6821af10f2594e5ca2a2eb8e3abaf251133f44370df45d05047afa115957dd130a7ae909fd6514fc910ddb960d9a30925b10de5bf0f7fbf1f2d3be7d633509bc3521bae4d7fdb477808e83e837b71ea43d16150babbb046cc1f36c298edc58c07173b024dd1248fe2b7eec4b8f8ec6e7331fd7a8094968cf6c179f0e7a3175165182723beb2e730a88a2881ebcb9e75b2ef9bb6a25c7ba11c8d2edf331d000708fa12fd89b5607f48e81f026fc949d65b97833ea2ad89edef09cd924ac32b15b56fc75e364d2101d1c3638cacac64e6704abf14be2ffdf40257b89079cc24c3702a61cd466e538c00f693a1c5c07ba39c97a9f53d1efe60a357a520f3fac6e95bfb0fafa2d806b14204e4f6b7300ce19544dfc1b9b8ddb43b0d5ef0fd85ff350ebc79edb4d74a62eb8b6c91c814f7e9ad8255110e04892847131c4780db2b227db2aa3f8a41e4818dec42579772c4d532decc507efb8d2586951ab7b3fb59d7982315a4fcfab4ddff37cacfc0e296f22cacb59e1e9f7526e645285cc6e3e2cdb0944a31e82aef1bd182eaad2cf0c6555e6dc3c7545b73a6ba4b26ec1027f335aecb83422157916320da2c54051840411180db2400874a1de19b2e4f68299a9189073a03bae276bdc3feccf4ea9202447457789d4f808e4688b0a9547161fdbc6ccfa9b6b7078cdc007e7c19736450ca86f536e4921882d53c229ff381edae1f19a1e4e14c6f0a8423b3b3ef650afc71e29758e7f0c7b43cd8743ef1ca7002b56abc1000168ac6c03a54a24712168ff34cb1b303bc29529fc17a560f7e478784d6a3c2a23a52e327dedf33a9681b3280b7d4a1754462ae90864f5f1be42297bb674dcfcb7613d1474fa54e0e6363106b0b9c76967432cb15259ed8d0653eb3c799cb4d55646fdf4e37b40e893669ed087ece89f94157da0e490d6ab0e07d9c89a77a1c01473fa2fbbf9279ba5792024717001c3e0dd19e5d72679cb531daa447585c93290525173cc5c05fd73844881dc37671baa8417f7d8f4defb4a801f3776c9b8b374026c136d0b13295101fd7a09bf8865c0322a8a9692f5daf26736b59c4a9f2c099f287cbcd4b350fbccbc3f9a69ce0879ed65ce98de1560eb28010a1d1b9e58f3511d995f04c00dbae3f66830029d0ce20147ec927f2f51c1346ea001dbe8f09721fb56396651c1bcfe9fb141c80990fc128b3867f740027942f048e7bc774444d5b13e0956b36165bf1143d00371f897443d81c549ea64b9462982f27857a3b6dbe95b6a08220a0f55d286159eeec4b69fd981651540b8f54518c5acb18fe144b25e967ea9b550233b552cf6873ca9b0cc4552980ca5a3db5a179aa6a3cb51928c2bf8d953d376d97d8ccc0f41dfaa1b87a4bfd71ee2d16cb1b1248a20db859e5876d40f079fb0cb56e5741d52062ef82c3dd7b71f7ad52bd1345867c1f4aa7a39485d973858352b776c48ceaafcdf347e4107966eb8a9d29576d4d00d0a09b7a059420e85ae630a0b4d485095a47350fb3586246a990824d9bfbd352b9e087c5bce08f47940c6880741160f55493112204e4e1863658ae097df914c5f171d57edbace73a3363652280a0e725c4af751c0187fc64c45d00965ea68ef9203726043b140270f6e5b8622455e4d0ea993654b05e6720f6919ef87cd20f052c9116ae4d1566f584fd73aa96d2442f6c8e4276e9b66fa749a74934cb70ba1d383f30aede0b94ceced8cd90d61c8546e0c3394be3d7e52c7e1d9c9c5ba0569c31736f1197b883b170775380a82381073c06f9b1bf95b64e6b3adb7a41f80ebbf131aa1f35bf8d1dfbb204f4cf5a5c96985d488941f1f841104ab52d6bbe2ce97dc8c3286f10e639c6c2c2e1a16520c3729b48ece983136ec80f9e32942c31208481976bd0fa3913893eb092154c97dbd905e3ba7e5659ae954332ebfbddd60af8152d13a9d0b23cbb360569cd67afb1a68900bbcbc53ad8803215e5333282910b53e486e5a7883875affb4ffce1b6b8c9fe574a83043bf5661308ff4c2473935ff40b461a13f4cc4d125188f390fe8f9e2c624f61c394daf5ac81a2af155e1ba3b0db9d9ada4bcaed50033a490880e12cb1b38486ea5033650a6d2038f5340ac11c20e7e1aa78674d2f12f9c4bcfa45788cdd5ca9be19d7bd0fdbb51d02feaa0540521f9b277051a36d6e90cd015072868c3e6e745f3057783967a67e79b4894ba1760b48df8735887de29dfa2ca23ae42f814d746c82d466ed8dddf3fa173e7bdc70d05a3a838d59c4b50c99d601518374145b394c6c30c0ebfbc3d7abb8b71680b9884057c9ef21f80aa9b088c875d8eb6d112413379dc7585f6cc70a68805231f3164ffcad85cec0d2dab9c83bdcd8405397ef47fe21c8f7ed973bc044709951c4043b024bd001de938d00ad29c8267116103afbaa2b14eb1bcf821856f001739b3dfc590dc84e5adf1243964b22cb28dced25874f1027fde651e0d7f1a11852b5ee98995b57292d6c81761dd61ea3f770e14658cb7ef8ec179fdbc3b216e69f2b1a7200b39ec520ba628761326b3847b74bd5faceca08fca23a01871e88a1c73b0c6a092e0f2035ca3dc2f3b0a54c74fd69e32dfbf553251a4e3e50c8d3ae43311905f81e034bca6e360174f15345659e30761088eeb8354f06f49891f2932d834a0ac66a57e2c5e0cb2e343241046f19fb7a38a8ea39e7256657dd62364eac13cc220a5d0e608a3a00d1f7cdeb2bab2eec99535b75955d037706faf8c05e7fac2482186b7760898a02d3c39c1d868d0c426a84a0e12334ca9f5ae6b811dd5384bfe0ed2865512a54d93731c9fd79022f670327219e0a54400244c6275676afbfb284adbfb4b0233dd343a780bbaf7f9d38e2d49eb16a321cb8a5e9b13602af4d8b053b1518815a651b20ca53504348ee9cee16eba94b56c35987d57ce62c03e5421621c5bc1a0c26fb3282684b4a554bc1f6ca4c93198d560332f70e81b17d6cdf046b954914761edefb289641508bafdad71fdfdb03177f8b48f02f069397852957e6622c5c26c61c18550b288ed19bf7a94b1dd2815a7c5f34e2bd8df27a6a62cb017e21581c751f930a185655cfe98838a4eec3ebee682dfaf93649c7ac8b89271ce0b53a5a599d5d085c8c3462cae570fe493c635c5d61ae9c7ab2ae40154caa2463d2d92dde7b18136c910d3a64b8d3288aefbdb0972be3afb22c3f7c186f53a0bce05eed3f09da70930f96da479f0a72df88ac9dba69a388182a0d6383c83b3ea490900dbf2d65cfa1d7a718cf8886af663a039d29f72377ba64c3de86eae5ebef2a041a6916ffc308380ef8f11ad96531eda9f06e17c33433809df043e45b422175c0861ecc110905a279326eb337dfda9e353c05eaa2bd4f7ce08b9621db8abe950bbd89f6ec8b6b574e5ad36b2426b06b28fe50c79336edacefb9ee0600d74a3e185b883f42f5880a02efd45d80c6f6c156726ab3606bedc6a996e8ff8046b82a8e5a2469a2fc4c7bbf55ecf199a00ba8fa89515e35ff0aefb9c7bcd5abeb563bf244177b95e0dd8f11c83b9f85531e9dc9fe9436587a59ab3d110686c33026eb79e7b16923b18aedd75e68b1c2bf26424d626435f4d330f17f430ec9b775fa300236a09e3d4fa5aeb719b5ee5cec2fc7d55a9d0a041dd18f3b3bd8a075bf04c76468765128fd753366f3458a120779f98e542cbddd17197ee7bebb75b88919f210d7d3a1bf53ffd3002b3936b8ea038ba7ed3eb4b5c24f1851c6cd63fe4ce85be89a5726a5060d82c5df288438b73409fbdf1711dc6971876b33acf98ce9e2ca674fe99359fb7228023b7bd4d05d6a53cb6e6ecb36417749877fced8b926001b37655155dc06ad4e424961b00f5021bb41fdd56d69c1f2d003447f34e7fbdc57cfb09569b3311789c145bf5610b9bde7866e935c5e437edff98c2b0690f37476ba4f1e374060d0bf6b26a93f3ba1f412d9d215bc5259fb428a52d78fdeb374509c96ffb13e515f75544a288fc800a26d8c5f984f2ab7f253eedc565012b0bef8f5a3d5a52d70aeeec9afe4bbd9009eb277fb8459f0db19a4af8f62993acef7d8e6bd5e072e7026b0592f5dc5f88801c69fcb418739d78e0d4683f374656d8aa399570a948457a9f621114f44035486fbf902917aae6f6ad1614cba0e6027d1382464e606d4d4a180705c4e765eced78ccad567bcc78d8c0028461fd726f1c33ae9da3a7fc44be3f07be622f6a883b435474d4ff4031b839dd9d87b4d3acdf52d78cbf4c1f8c529413ae6afa36b9866f556108828a090edf743af4bc02d6af7c6431eade641d65d71bfdde9bbcd97c4dae914f27e933e277a4654162985e3cc726d0e4bb8a8aed5baa86754713fe"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x1008}, 0x1, 0x0, 0x0, 0x4}, 0x24040001) recvmmsg$unix(r2, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000002a00)=""/4100, 0x1004}], 0x1}}], 0x1, 0x10000, 0x0) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000a00)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x7fffffff, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async) socket(0x1e, 0x2, 0x0) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmsg$nl_route_sched_retired(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004a80)=@newtaction={0x1008, 0x30, 0x0, 0x70bd29, 0x25dfdbfb, {}, [{0xff4, 0x1, [@m_ipt={0x60, 0x17, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0xadc0}, @TCA_IPT_HOOK={0x8}]}, {0x25, 0x6, "e0bc7743d52057483c234da7396aee1c1620232e9758fc402870746166594df527"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ipt={0xf90, 0x7, 0x0, 0x0, {{0x8}, {0x4}, {0xf65, 0x6, "281e4e3e0c40476018fa8215aad6f3df9be9c368b076e7baf5af4a77ee2c2ccd7aee6d3d9832b2801db265cfd88a70ba0f361e01e281de022d2b67713fe137cb18a705201b53ddfb154f367ede44dae6362fa72e12a2c5f3cb668a6425fee53f7ee61dc3589d938b49a42a1b65891ccb1a4667d34e987bf0e6bf5b082190ec628aa72300c988c081acd1cc00431eb428a483529c0b73bb33bbb339414aa56b87df850ef444e3cd12cbe746c3832a67ce2ae18644a56c441c33ed457a071c96b33f50324fa41739f8dfa58532a7119feafb6e759ebdf90c681a6b2ed0425f241e1f333b9d6e2f2a5a460eb8864fd73e594f0c437bcdfef9bd1dc29bd32de46643c9ba9905729f72559fc7f87877b0dfae17344fe151e7756f05bb0de3bcfbbd4a6caf224c497e76bbd002482b0142ea591efaaaab7496eabe6b7e3ae1c4a2848170545918727b6f4f9a89fb6c3d6207a6cc011825e0a6c7282c896a4a1ea4abefe140a4d1dad93d1247bcf1a35eec881b5ece5e66774b1b305daa9b0719805774354d957afbf12531ebc2d1c74645f788d32abbd24667ef0c66969ce6df41d29555632bbf3740a91ee98e70eb3b4ce02e864dffcf5ad3c5a729f912dad9235fde2ffa922f4654276e4d413aa76365a2a4fe47517859135130b2d9f242a0abd0efcc1c51bd4b8fe88d36d965ef4956a48c40ce1d8f558e02544667056705e4da6b8a9a82f554334d244a24395e99b45e961566b1d1b3b14e2270f627bdc41ad726d74b2c6f74a0b79d77a417f649cf9219492d511cecd152bafac8184970b7a34d0ae0d4a3f1d11df8567de55bdef44339c30092da87bbb990e49b92c90a5ae530c51a4025662707df22af9e1421118447d9a4a85448c19332c19134dfcf8bb90209cc0cf79929cb39e3c3797391893b66ab544e78fcd9f3535d533411a87d11102fd94ad7252362055b9d147a2bb92808c4fd923d61fc33748473f295ea208c5f15a311576ded5f0e4c54147864f5ef7a2596cde1c7c1450d2ea8495c3850c72c4c21481a011a95fd017eda366155d475731eb95c3006c3a3406f1baf94b5de84114ec2627222a1cd3c8d2b88916cb2054c11df2761994f8112909f417a30689de748b556e8ecaa2dc7f628cecf6405d2954deaea698108d208a67559556eedb14d85cabf4c172c98c9b24f6821af10f2594e5ca2a2eb8e3abaf251133f44370df45d05047afa115957dd130a7ae909fd6514fc910ddb960d9a30925b10de5bf0f7fbf1f2d3be7d633509bc3521bae4d7fdb477808e83e837b71ea43d16150babbb046cc1f36c298edc58c07173b024dd1248fe2b7eec4b8f8ec6e7331fd7a8094968cf6c179f0e7a3175165182723beb2e730a88a2881ebcb9e75b2ef9bb6a25c7ba11c8d2edf331d000708fa12fd89b5607f48e81f026fc949d65b97833ea2ad89edef09cd924ac32b15b56fc75e364d2101d1c3638cacac64e6704abf14be2ffdf40257b89079cc24c3702a61cd466e538c00f693a1c5c07ba39c97a9f53d1efe60a357a520f3fac6e95bfb0fafa2d806b14204e4f6b7300ce19544dfc1b9b8ddb43b0d5ef0fd85ff350ebc79edb4d74a62eb8b6c91c814f7e9ad8255110e04892847131c4780db2b227db2aa3f8a41e4818dec42579772c4d532decc507efb8d2586951ab7b3fb59d7982315a4fcfab4ddff37cacfc0e296f22cacb59e1e9f7526e645285cc6e3e2cdb0944a31e82aef1bd182eaad2cf0c6555e6dc3c7545b73a6ba4b26ec1027f335aecb83422157916320da2c54051840411180db2400874a1de19b2e4f68299a9189073a03bae276bdc3feccf4ea9202447457789d4f808e4688b0a9547161fdbc6ccfa9b6b7078cdc007e7c19736450ca86f536e4921882d53c229ff381edae1f19a1e4e14c6f0a8423b3b3ef650afc71e29758e7f0c7b43cd8743ef1ca7002b56abc1000168ac6c03a54a24712168ff34cb1b303bc29529fc17a560f7e478784d6a3c2a23a52e327dedf33a9681b3280b7d4a1754462ae90864f5f1be42297bb674dcfcb7613d1474fa54e0e6363106b0b9c76967432cb15259ed8d0653eb3c799cb4d55646fdf4e37b40e893669ed087ece89f94157da0e490d6ab0e07d9c89a77a1c01473fa2fbbf9279ba5792024717001c3e0dd19e5d72679cb531daa447585c93290525173cc5c05fd73844881dc37671baa8417f7d8f4defb4a801f3776c9b8b374026c136d0b13295101fd7a09bf8865c0322a8a9692f5daf26736b59c4a9f2c099f287cbcd4b350fbccbc3f9a69ce0879ed65ce98de1560eb28010a1d1b9e58f3511d995f04c00dbae3f66830029d0ce20147ec927f2f51c1346ea001dbe8f09721fb56396651c1bcfe9fb141c80990fc128b3867f740027942f048e7bc774444d5b13e0956b36165bf1143d00371f897443d81c549ea64b9462982f27857a3b6dbe95b6a08220a0f55d286159eeec4b69fd981651540b8f54518c5acb18fe144b25e967ea9b550233b552cf6873ca9b0cc4552980ca5a3db5a179aa6a3cb51928c2bf8d953d376d97d8ccc0f41dfaa1b87a4bfd71ee2d16cb1b1248a20db859e5876d40f079fb0cb56e5741d52062ef82c3dd7b71f7ad52bd1345867c1f4aa7a39485d973858352b776c48ceaafcdf347e4107966eb8a9d29576d4d00d0a09b7a059420e85ae630a0b4d485095a47350fb3586246a990824d9bfbd352b9e087c5bce08f47940c6880741160f55493112204e4e1863658ae097df914c5f171d57edbace73a3363652280a0e725c4af751c0187fc64c45d00965ea68ef9203726043b140270f6e5b8622455e4d0ea993654b05e6720f6919ef87cd20f052c9116ae4d1566f584fd73aa96d2442f6c8e4276e9b66fa749a74934cb70ba1d383f30aede0b94ceced8cd90d61c8546e0c3394be3d7e52c7e1d9c9c5ba0569c31736f1197b883b170775380a82381073c06f9b1bf95b64e6b3adb7a41f80ebbf131aa1f35bf8d1dfbb204f4cf5a5c96985d488941f1f841104ab52d6bbe2ce97dc8c3286f10e639c6c2c2e1a16520c3729b48ece983136ec80f9e32942c31208481976bd0fa3913893eb092154c97dbd905e3ba7e5659ae954332ebfbddd60af8152d13a9d0b23cbb360569cd67afb1a68900bbcbc53ad8803215e5333282910b53e486e5a7883875affb4ffce1b6b8c9fe574a83043bf5661308ff4c2473935ff40b461a13f4cc4d125188f390fe8f9e2c624f61c394daf5ac81a2af155e1ba3b0db9d9ada4bcaed50033a490880e12cb1b38486ea5033650a6d2038f5340ac11c20e7e1aa78674d2f12f9c4bcfa45788cdd5ca9be19d7bd0fdbb51d02feaa0540521f9b277051a36d6e90cd015072868c3e6e745f3057783967a67e79b4894ba1760b48df8735887de29dfa2ca23ae42f814d746c82d466ed8dddf3fa173e7bdc70d05a3a838d59c4b50c99d601518374145b394c6c30c0ebfbc3d7abb8b71680b9884057c9ef21f80aa9b088c875d8eb6d112413379dc7585f6cc70a68805231f3164ffcad85cec0d2dab9c83bdcd8405397ef47fe21c8f7ed973bc044709951c4043b024bd001de938d00ad29c8267116103afbaa2b14eb1bcf821856f001739b3dfc590dc84e5adf1243964b22cb28dced25874f1027fde651e0d7f1a11852b5ee98995b57292d6c81761dd61ea3f770e14658cb7ef8ec179fdbc3b216e69f2b1a7200b39ec520ba628761326b3847b74bd5faceca08fca23a01871e88a1c73b0c6a092e0f2035ca3dc2f3b0a54c74fd69e32dfbf553251a4e3e50c8d3ae43311905f81e034bca6e360174f15345659e30761088eeb8354f06f49891f2932d834a0ac66a57e2c5e0cb2e343241046f19fb7a38a8ea39e7256657dd62364eac13cc220a5d0e608a3a00d1f7cdeb2bab2eec99535b75955d037706faf8c05e7fac2482186b7760898a02d3c39c1d868d0c426a84a0e12334ca9f5ae6b811dd5384bfe0ed2865512a54d93731c9fd79022f670327219e0a54400244c6275676afbfb284adbfb4b0233dd343a780bbaf7f9d38e2d49eb16a321cb8a5e9b13602af4d8b053b1518815a651b20ca53504348ee9cee16eba94b56c35987d57ce62c03e5421621c5bc1a0c26fb3282684b4a554bc1f6ca4c93198d560332f70e81b17d6cdf046b954914761edefb289641508bafdad71fdfdb03177f8b48f02f069397852957e6622c5c26c61c18550b288ed19bf7a94b1dd2815a7c5f34e2bd8df27a6a62cb017e21581c751f930a185655cfe98838a4eec3ebee682dfaf93649c7ac8b89271ce0b53a5a599d5d085c8c3462cae570fe493c635c5d61ae9c7ab2ae40154caa2463d2d92dde7b18136c910d3a64b8d3288aefbdb0972be3afb22c3f7c186f53a0bce05eed3f09da70930f96da479f0a72df88ac9dba69a388182a0d6383c83b3ea490900dbf2d65cfa1d7a718cf8886af663a039d29f72377ba64c3de86eae5ebef2a041a6916ffc308380ef8f11ad96531eda9f06e17c33433809df043e45b422175c0861ecc110905a279326eb337dfda9e353c05eaa2bd4f7ce08b9621db8abe950bbd89f6ec8b6b574e5ad36b2426b06b28fe50c79336edacefb9ee0600d74a3e185b883f42f5880a02efd45d80c6f6c156726ab3606bedc6a996e8ff8046b82a8e5a2469a2fc4c7bbf55ecf199a00ba8fa89515e35ff0aefb9c7bcd5abeb563bf244177b95e0dd8f11c83b9f85531e9dc9fe9436587a59ab3d110686c33026eb79e7b16923b18aedd75e68b1c2bf26424d626435f4d330f17f430ec9b775fa300236a09e3d4fa5aeb719b5ee5cec2fc7d55a9d0a041dd18f3b3bd8a075bf04c76468765128fd753366f3458a120779f98e542cbddd17197ee7bebb75b88919f210d7d3a1bf53ffd3002b3936b8ea038ba7ed3eb4b5c24f1851c6cd63fe4ce85be89a5726a5060d82c5df288438b73409fbdf1711dc6971876b33acf98ce9e2ca674fe99359fb7228023b7bd4d05d6a53cb6e6ecb36417749877fced8b926001b37655155dc06ad4e424961b00f5021bb41fdd56d69c1f2d003447f34e7fbdc57cfb09569b3311789c145bf5610b9bde7866e935c5e437edff98c2b0690f37476ba4f1e374060d0bf6b26a93f3ba1f412d9d215bc5259fb428a52d78fdeb374509c96ffb13e515f75544a288fc800a26d8c5f984f2ab7f253eedc565012b0bef8f5a3d5a52d70aeeec9afe4bbd9009eb277fb8459f0db19a4af8f62993acef7d8e6bd5e072e7026b0592f5dc5f88801c69fcb418739d78e0d4683f374656d8aa399570a948457a9f621114f44035486fbf902917aae6f6ad1614cba0e6027d1382464e606d4d4a180705c4e765eced78ccad567bcc78d8c0028461fd726f1c33ae9da3a7fc44be3f07be622f6a883b435474d4ff4031b839dd9d87b4d3acdf52d78cbf4c1f8c529413ae6afa36b9866f556108828a090edf743af4bc02d6af7c6431eade641d65d71bfdde9bbcd97c4dae914f27e933e277a4654162985e3cc726d0e4bb8a8aed5baa86754713fe"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x1008}, 0x1, 0x0, 0x0, 0x4}, 0x24040001) (async) recvmmsg$unix(r2, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000002a00)=""/4100, 0x1004}], 0x1}}], 0x1, 0x10000, 0x0) (async) 160.980712ms ago: executing program 0 (id=4099): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000000000f00e3ff00330000000000000b925d6b2c2e67345161a21d689eed9dcafee28653512871d43af074e1447f4a011a8f3a7d6fcfb581ff12f0929eaeb98d01cac0d213c9c31fff8956e49df81e1f8694281cfb55414d95f61cdcd3175931a4bb2b8c4b73f84f"], 0x0, 0x1b}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000000000f00e3ff00330000000000000b925d6b2c2e67345161a21d689eed9dcafee28653512871d43af074e1447f4a011a8f3a7d6fcfb581ff12f0929eaeb98d01cac0d213c9c31fff8956e49df81e1f8694281cfb55414d95f61cdcd3175931a4bb2b8c4b73f84f"], 0x0, 0x1b}, 0x28) close(r2) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x5c, 0x5, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40010) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000540)=0xc) (async) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000011c0)={r2, 0x18000000000002a0, 0xeff, 0x0, &(0x7f0000001240)="b9ff03076804268c989e14f088a8657986dd", 0x0, 0x2100, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r1) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)={0xe8, r4, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_PEER_AID={0x6, 0xb5, 0xb7}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x23, 0x13, [{0x4}, {0x30}, {0x0, 0x1}, {0x1b}, {}, {0x36, 0x1}, {0x18}, {0x1, 0x1}, {0x36}, {0x4}, {0x5, 0x1}, {0xc, 0x1}, {0x5, 0x1}, {0x1e}, {0x5, 0x1}, {0xb, 0x1}, {0x5, 0x1}, {0x48}, {0x24}, {0x67, 0x1}, {0x1, 0x1}, {0x12}, {0x2d}, {0x4b6fc8b8d2e83862}, {0x60}, {0x3, 0x1}, {}, {0xc, 0x1}, {0x4, 0x1}, {0x60, 0x1}, {0x48}]}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x67, 0xac, "0906eda894be1a0976c983e7abe298b75188ff0605a0e833103d585b363371c968fbfa5c0307988a2dcb0cc80fe60dc6a7619c3f1101da52203cae493535a40be6b672c0b492d98315ddd6036900a8cb02da20d1fccdd524690df14bab0292f4bf6181"}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x90}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x1e, 0x13, [{0x48}, {0x36}, {0x60}, {0x24, 0x1}, {0x12}, {0x48, 0x1}, {0x30, 0x1}, {0x36, 0x1}, {0x5, 0x1}, {0x2}, {0x24, 0x1}, {0xb, 0x1}, {0xc, 0x1}, {0xb}, {}, {0x3, 0x1}, {0x1, 0x1}, {0x36, 0x1}, {0xc}, {0x809216f49b508c21, 0x1}, {0x30}, {0x28}, {0x78}, {0x18, 0x1}, {0x18}, {0x3, 0x1}]}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x77d}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) accept4$unix(r5, &(0x7f0000000180)=@abs, &(0x7f0000000080)=0x6e, 0x100000) (async) accept4$unix(r5, &(0x7f0000000180)=@abs, &(0x7f0000000080)=0x6e, 0x100000) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x106) (async) sendmsg$kcm(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0x106) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) 159.360595ms ago: executing program 2 (id=4100): syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), 0xffffffffffffffff) (async) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000004ec0)={0x0, 0x0, &(0x7f0000004e80)={&(0x7f0000004e40)={0x14, r0, 0x1, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 99.227134ms ago: executing program 4 (id=4101): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="2c000000400007012bbd700000dcdf25037c00000400c280100001800c00108008000b00", @ANYRES32=r2], 0x2c}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) 82.08483ms ago: executing program 0 (id=4102): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt(r0, 0x6, 0x9, &(0x7f0000000500)=""/90, &(0x7f0000000480)=0x5a) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x79, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0x2}, {0x0, 0xb}}, [@qdisc_kind_options=@q_atm]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) close(0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r7 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r7, 0x0, 0x4) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r8, &(0x7f0000000100)={{0x3, @null, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) sendmsg$ETHTOOL_MSG_RINGS_SET(r4, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0xffffffe}, 0xc, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES32=r1, @ANYRESDEC], 0x64}, 0x1, 0x0, 0x0, 0x81}, 0x48000) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000380)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_xfrm(r6, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB="f8000000100000012bbd0000000000000000bb000000000000000000000000000000004e2100894e2000030a00a020ff000000", @ANYRES32, @ANYRES32=r9, @ANYBLOB="7f000001000000000000000000000000000004d42b00000000000000000000000000000000000000ffffffffffffff7fab0200000000000007000000000000000080000000000000230c00000000000000000000000000000600000000000000000000000100000002000000000000000b000000000000000100000000000000020000000000000002000000070000000900000027bd7000013500000a000202400000000000000008001f0004000000"], 0xf8}, 0x1, 0x0, 0x0, 0x54}, 0x64040810) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x9, 0x32fe3cf8, 0x0, 0x11}, 0x14) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000780)=@newtaction={0x12c, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4}, {0x114, 0x1, [@m_ct={0x110, 0x1b, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_CT_LABELS_MASK={0x14, 0x8, "e3a49d6b6f09000000ae378be5332d74"}, @TCA_CT_MARK={0x8, 0x5, 0x7}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e21}, @TCA_CT_NAT_PORT_MIN={0x6, 0xd, 0x4e21}]}, {0xbb, 0x6, "ac9820f86e5a0bffddd64ff75bcc2ef396cdd52a27261c033db636f6b5201354d42365d0aef6a3cbf4f97605079c4d180b4b61d289fcc5220489a76614b7294d908ba93c095b259af60f91e167ca7263f4fb023ccf90f034d2f8fe39564a44113ff118a1b4173f04da41d384c9055fb08bdc080a4aa2503c90567e349d69c588e75de4bf599ba67fcd921a6c50f9fd978b325c259d53d1bd9c20eb9ee5b9934c42ace67fed3401afe651e71f5bde394ea4499187c50958"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4080}, 0x0) 567.107µs ago: executing program 1 (id=4103): r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'veth0_to_team\x00', @link_local}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x3b6, &(0x7f00000009c0)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "008004", 0x380, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x0, 0xa, "a741e54006598080a8030000004023493b87aafaff0500ffffffe723732472eefa45ad96579269748e254c1e4a948b580a9bc430d3be27df3e34060000ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000100000000001995319cff"}, {0x3, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5c6186c0d3baa75af390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5acaa556b9f30dcab2b90aa235a670670ffc5dc49dfb58d89310000000000"}, {0x3, 0xb, "d47ae6e8805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1aac51a948b5b303f4f003"}, {0x21, 0x7, "fcf98a102ec1876d4e6fa3b20519bbaa8a029cee00b8d3485e3b63ed09bdb581c9fe68a356f542b043059ff05932e740e077e1d16212fb"}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa76ffff9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4828288e62afbf03269f1f98aea6a58cf45d7c5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c258a6f"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02c226a6bce65f81ed"}]}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000f80)="f6fd4b4371b9cee432fc34e3b0cde3c10d835add05a2a055159b2312cff09dcbea4964835e21d0bdce7cec7a3ccf45ade70cdfa3244c6283342b161cf9be8a3390867042297df641f139ed0e0f6ee57129d551ca34c4b59067be7d74b1f483aee866db92965e73ce2299d080ea0d6b2233b2b8f43150ec0758c7f59f9f4fd5b7c4", 0x4000}], 0x1) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100002000010000000000fbdbdf25020117800c00160006ac0e00000000001400010000000000000000000000ffff0000000050bb2d6f67d2996fabadb107d0de1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c290400eb000000000000000000006688bac225451069b952b877537ce9905c00d232dfa67079bca3351130ffdf1fc1d139d9a8091b9dc537dc71e2eeb7308624937c6ff931c9a319900cf9836b62994107005445581c3164bf78ea473ceb124f147eef01ef124f22279f24a54289331231677c87f161dba206b8ec65c1b71778c746d9448428dcb96141853df2f529e5957f8dc181d009b8aa0c4f4824ed014b089b7d7a4a472868f266a5a0d3204776ae89a6c64d7dc09cc2f41d41f7f72e2a8fd2d4b3b48207f72d6457b9c6a3d7b940d279d7bc61ec6c333aa3be79f791e3d173b44932bcbe9b03c3ed9a1a2c1673f57055380bfb008a956c258862"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 0s ago: executing program 2 (id=4104): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000800000000100000080"], 0x48) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f00000003c0)='V', 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r1, 0x1) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000000)={0x0, 0xae46, 0x20}, &(0x7f0000000040)=0xc) (async, rerun: 32) socket$kcm(0x29, 0x5, 0x0) (async, rerun: 32) r2 = socket$inet(0x2, 0x1, 0x100) (async, rerun: 64) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (rerun: 64) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="180100002c00010000000000fcdbdf250601f2800c0018000bac0f00000000001400010000000000000000000000ffff7f00000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b104000000e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061de35817c8a66c2908004500ac1414bb0000"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r2, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) (async, rerun: 32) bind$inet(r4, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) (async, rerun: 32) listen(r4, 0x7) (async) listen(r2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r0}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) (async) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000200)=0x1, 0x4) (async, rerun: 64) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) (rerun: 64) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00'}) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f0000000400)={'wg2\x00', 0x0}) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0xa, r8}, 0x10) kernel console output (not intermixed with test programs): 340.976405][ T9890] buffer_io_error: 138 callbacks suppressed [ 340.976420][ T9890] Buffer I/O error on dev nbd1, logical block 0, async page read [ 340.994161][ T9890] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.004110][ T9890] Buffer I/O error on dev nbd1, logical block 1, async page read [ 341.021640][ T9890] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.041931][ T9890] Buffer I/O error on dev nbd1, logical block 2, async page read [ 341.057088][ T9890] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.083833][ T9890] Buffer I/O error on dev nbd1, logical block 3, async page read [ 341.099726][ T9890] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.116062][T15679] syzkaller0: entered promiscuous mode [ 341.122199][T15679] syzkaller0: entered allmulticast mode [ 341.129059][ T9890] Buffer I/O error on dev nbd1, logical block 0, async page read [ 341.151826][ T9890] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.222012][ T9890] Buffer I/O error on dev nbd1, logical block 1, async page read [ 341.229879][ T9890] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.263706][ T9890] Buffer I/O error on dev nbd1, logical block 2, async page read [ 341.274276][ T9890] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.299019][T15692] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2761'. [ 341.319028][ T9890] Buffer I/O error on dev nbd1, logical block 3, async page read [ 341.331640][ T9890] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.363580][ T9890] Buffer I/O error on dev nbd1, logical block 0, async page read [ 341.371431][ T9890] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 341.403060][ T9890] Buffer I/O error on dev nbd1, logical block 1, async page read [ 341.418577][ T9890] ldm_validate_partition_table(): Disk read failed. [ 341.433662][ T9890] Dev nbd1: unable to read RDB block 0 [ 341.439753][ T9890] nbd1: unable to read partition table [ 341.450548][ T9890] ldm_validate_partition_table(): Disk read failed. [ 341.459359][ T9890] Dev nbd1: unable to read RDB block 0 [ 341.479427][ T9890] nbd1: unable to read partition table [ 341.501964][T15698] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2763'. [ 341.752954][T15702] syzkaller0: entered promiscuous mode [ 341.758490][T15702] syzkaller0: entered allmulticast mode [ 341.799346][T15712] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2767'. [ 342.096016][T15727] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2772'. [ 342.171751][T15727] netlink: 'syz.4.2772': attribute type 10 has an invalid length. [ 342.179947][T15727] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.187329][T15727] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.237080][T15727] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.244372][T15727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 342.251943][T15727] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.259095][T15727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 342.278753][T15727] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 342.307758][T15730] can: request_module (can-proto-0) failed. [ 342.346481][T15727] macvlan3: entered promiscuous mode [ 342.364887][T15727] macvlan3: entered allmulticast mode [ 342.374281][T15727] bond6: (slave macvlan3): Opening slave failed [ 342.454684][T15740] syzkaller0: entered promiscuous mode [ 342.474482][T15740] syzkaller0: entered allmulticast mode [ 342.530783][T15747] macvtap1: entered promiscuous mode [ 342.545275][T15747] macvtap1: entered allmulticast mode [ 342.552078][T15747] veth1_vlan: entered allmulticast mode [ 343.172281][T15792] netlink: 'syz.0.2791': attribute type 9 has an invalid length. [ 343.749048][T15834] syz.3.2804: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 343.780878][T15834] CPU: 1 UID: 0 PID: 15834 Comm: syz.3.2804 Not tainted syzkaller #0 PREEMPT(full) [ 343.780907][T15834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 343.780924][T15834] Call Trace: [ 343.780932][T15834] [ 343.780940][T15834] dump_stack_lvl+0xe8/0x150 [ 343.780991][T15834] warn_alloc+0x249/0x340 [ 343.781019][T15834] ? stack_trace_save+0xa9/0x100 [ 343.781046][T15834] ? __pfx_warn_alloc+0x10/0x10 [ 343.781078][T15834] ? kasan_save_track+0x4f/0x80 [ 343.781100][T15834] ? kasan_save_track+0x3e/0x80 [ 343.781121][T15834] ? __kasan_kmalloc+0x93/0xb0 [ 343.781143][T15834] ? __kmalloc_cache_noprof+0x31c/0x660 [ 343.781167][T15834] ? xskq_create+0x56/0x170 [ 343.781196][T15834] ? xsk_setsockopt+0x54c/0x990 [ 343.781223][T15834] ? do_sock_setsockopt+0x17c/0x1b0 [ 343.781255][T15834] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 343.781294][T15834] ? do_syscall_64+0x14d/0xf80 [ 343.781319][T15834] __vmalloc_node_range_noprof+0x132/0x1730 [ 343.781379][T15834] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 343.781411][T15834] ? __kasan_kmalloc+0x93/0xb0 [ 343.781443][T15834] vmalloc_user_noprof+0xad/0xe0 [ 343.781467][T15834] ? xskq_create+0xbf/0x170 [ 343.781498][T15834] xskq_create+0xbf/0x170 [ 343.781536][T15834] xsk_init_queue+0x8a/0xe0 [ 343.781568][T15834] xsk_setsockopt+0x54c/0x990 [ 343.781600][T15834] ? __pfx_xsk_setsockopt+0x10/0x10 [ 343.781628][T15834] ? __pfx_aa_sk_perm+0x10/0x10 [ 343.781659][T15834] ? aa_sock_opt_perm+0xff/0x1a0 [ 343.781692][T15834] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 343.781716][T15834] ? __pfx_xsk_setsockopt+0x10/0x10 [ 343.781746][T15834] do_sock_setsockopt+0x17c/0x1b0 [ 343.781786][T15834] __x64_sys_setsockopt+0x13d/0x1b0 [ 343.781825][T15834] do_syscall_64+0x14d/0xf80 [ 343.781844][T15834] ? trace_irq_disable+0x3b/0x150 [ 343.781875][T15834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.781898][T15834] ? clear_bhb_loop+0x40/0x90 [ 343.781925][T15834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.781947][T15834] RIP: 0033:0x7fc5db59c799 [ 343.781967][T15834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.781985][T15834] RSP: 002b:00007fc5dc4f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 343.782007][T15834] RAX: ffffffffffffffda RBX: 00007fc5db816180 RCX: 00007fc5db59c799 [ 343.782023][T15834] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000045 [ 343.782037][T15834] RBP: 00007fc5db632c99 R08: 0000000000000004 R09: 0000000000000000 [ 343.782050][T15834] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 343.782063][T15834] R13: 00007fc5db816218 R14: 00007fc5db816180 R15: 00007ffe51647ff8 [ 343.782098][T15834] [ 344.066580][T15834] Mem-Info: [ 344.069782][T15834] active_anon:6175 inactive_anon:20 isolated_anon:0 [ 344.069782][T15834] active_file:2315 inactive_file:40563 isolated_file:0 [ 344.069782][T15834] unevictable:768 dirty:137 writeback:0 [ 344.069782][T15834] slab_reclaimable:12298 slab_unreclaimable:111037 [ 344.069782][T15834] mapped:29401 shmem:1364 pagetables:3618 [ 344.069782][T15834] sec_pagetables:0 bounce:0 [ 344.069782][T15834] kernel_misc_reclaimable:0 [ 344.069782][T15834] free:1296714 free_pcp:24889 free_cma:0 [ 344.170291][T15834] Node 0 active_anon:24400kB inactive_anon:80kB active_file:9260kB inactive_file:162052kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117404kB dirty:548kB writeback:0kB shmem:3920kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14332kB pagetables:14332kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 344.276436][T15834] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 344.310035][T15834] Node 0 DMA free:15332kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:28kB local_pcp:12kB free_cma:0kB [ 344.341450][T15834] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 344.347372][T15834] Node 0 DMA32 free:1293136kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24500kB inactive_anon:80kB active_file:9260kB inactive_file:162052kB unevictable:1536kB writepending:548kB zspages:0kB present:3129332kB managed:2552764kB mlocked:0kB bounce:0kB free_pcp:43336kB local_pcp:20168kB free_cma:0kB [ 344.382162][T15834] lowmem_reserve[]: 0 0 0 0 0 [ 344.386947][T15834] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:8kB free_cma:0kB [ 344.421028][T15834] lowmem_reserve[]: 0 0 0 0 0 [ 344.426580][T15834] Node 1 Normal free:3878580kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:55576kB local_pcp:24864kB free_cma:0kB [ 344.459554][T15834] lowmem_reserve[]: 0 0 0 0 0 [ 344.464809][T15834] Node 0 DMA: 1*4kB (U) 0*8kB 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 1*4096kB (U) = 15332kB [ 344.542593][T15834] Node 0 DMA32: 4933*4kB (UME) 3930*8kB (UME) 1798*16kB (UME) 842*32kB (UM) 914*64kB (UME) 835*128kB (UME) 614*256kB (UM) 301*512kB (UM) 349*1024kB (UM) 170*2048kB (UM) 1*4096kB (U) = 1293188kB [ 344.597490][T15834] Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 344.610592][T15834] Node 1 Normal: 3*4kB (UM) 3*8kB (UM) 11*16kB (UM) 11*32kB (UM) 10*64kB (UM) 4*128kB (UM) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 4*2048kB (U) 943*4096kB (UM) = 3878580kB [ 344.628669][T15834] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 344.639455][T15834] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 344.649421][T15834] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 344.651913][T15853] netlink: 'syz.4.2812': attribute type 1 has an invalid length. [ 344.661047][T15834] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 344.677248][T15834] 44238 total pagecache pages [ 344.682312][T15834] 0 pages in swap cache [ 344.686516][T15834] Free swap = 124996kB [ 344.690890][T15834] Total swap = 124996kB [ 344.695873][T15834] 2097051 pages RAM [ 344.699709][T15834] 0 pages HighMem/MovableOnly [ 344.710083][T15834] 427024 pages reserved [ 344.714862][T15834] 0 pages cma reserved [ 344.916241][T15869] syzkaller1: entered promiscuous mode [ 344.938190][T15869] syzkaller1: entered allmulticast mode [ 345.034883][T15875] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 345.393658][T15899] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 345.563091][T15911] __nla_validate_parse: 11 callbacks suppressed [ 345.563111][T15911] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2832'. [ 345.588795][T15908] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2830'. [ 345.599298][T15908] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2830'. [ 346.057189][T15934] netlink: 'syz.1.2840': attribute type 3 has an invalid length. [ 346.180194][ T5832] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 346.190679][ T5832] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 346.199458][ T5832] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 346.208855][ T5832] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 346.217524][ T5832] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 346.299473][T15904] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 346.313050][T15904] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 346.421267][T15946] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2844'. [ 346.625147][T15953] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 346.691024][T15957] tipc: Enabling of bearer rejected, failed to enable media [ 346.728906][T15938] C speed is unknown, defaulting to 1000 [ 346.739093][T15957] netlink: 'syz.3.2847': attribute type 1 has an invalid length. [ 346.951117][T15972] netlink: 'syz.4.2851': attribute type 10 has an invalid length. [ 346.987652][T15972] team0 (unregistering): Port device team_slave_0 removed [ 347.000481][T15972] team0 (unregistering): Port device team_slave_1 removed [ 347.087720][T15938] chnl_net:caif_netlink_parms(): no params data found [ 347.215960][T15938] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.224741][T15938] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.236283][T15938] bridge_slave_0: entered allmulticast mode [ 347.244879][T15938] bridge_slave_0: entered promiscuous mode [ 347.257794][T15938] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.266832][T15938] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.276641][T15938] bridge_slave_1: entered allmulticast mode [ 347.285745][T15938] bridge_slave_1: entered promiscuous mode [ 347.306131][T15987] netlink: 'syz.4.2853': attribute type 4 has an invalid length. [ 347.341328][T15938] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.354191][T15938] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 347.393823][T15938] team0: Port device team_slave_0 added [ 347.405218][T15938] team0: Port device team_slave_1 added [ 347.445932][T15938] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 347.453536][T15938] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.480200][T15938] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.493976][T15938] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.500949][T15938] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.527878][T15938] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 347.593591][T15938] hsr_slave_0: entered promiscuous mode [ 347.600331][T15938] hsr_slave_1: entered promiscuous mode [ 347.607435][T15938] debugfs: 'hsr0' already exists in 'hsr' [ 347.614011][T15938] Cannot create hsr debugfs directory [ 347.724335][T15995] netlink: 'syz.1.2857': attribute type 28 has an invalid length. [ 347.733555][T15995] netlink: 'syz.1.2857': attribute type 3 has an invalid length. [ 347.741415][T15995] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2857'. [ 347.894956][T15938] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 347.906706][T16003] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.2858'. [ 347.923375][T16003] net_ratelimit: 9383 callbacks suppressed [ 347.923391][T16003] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 347.943881][T15938] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.971665][T15938] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.055239][T15938] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 348.074535][T15938] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.089077][T15938] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.139084][T16008] veth1_macvtap: left promiscuous mode [ 348.145786][T16008] macsec0: entered promiscuous mode [ 348.151058][T16008] macsec0: entered allmulticast mode [ 348.166035][T16010] veth1_macvtap: entered promiscuous mode [ 348.172222][T16010] veth1_macvtap: entered allmulticast mode [ 348.182071][T16010] macsec0: left promiscuous mode [ 348.187536][T16010] macsec0: left allmulticast mode [ 348.193737][T16010] veth1_macvtap: left allmulticast mode [ 348.224718][T15938] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 348.235921][T15938] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.248183][T15938] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 348.302411][ T51] Bluetooth: hci5: command tx timeout [ 348.346840][T15938] bond0: (slave netdevsim0): Releasing backup interface [ 348.413971][T16022] pim6reg1: entered promiscuous mode [ 348.419338][T16022] pim6reg1: entered allmulticast mode [ 348.558260][T16032] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2869'. [ 348.604226][T16032] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2869'. [ 348.686842][T15938] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 348.713574][T15938] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 348.745428][T15938] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 348.771238][T15938] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 349.010401][T15938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 349.043624][T15938] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.059282][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 349.066487][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 349.101049][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.108288][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 349.499199][T16085] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2880'. [ 349.728047][T15938] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 349.821393][T15938] veth0_vlan: entered promiscuous mode [ 349.857523][T15938] veth1_vlan: entered promiscuous mode [ 349.974311][T16104] netlink: 'syz.4.2884': attribute type 7 has an invalid length. [ 350.005096][T15938] veth0_macvtap: entered promiscuous mode [ 350.023726][T15938] veth1_macvtap: entered promiscuous mode [ 350.070486][T15938] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 350.109871][T15938] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 350.154192][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.183295][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.213107][T16121] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2887'. [ 350.231126][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.250873][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.314765][T16121] xt_hashlimit: size too large, truncated to 1048576 [ 350.381799][ T5832] Bluetooth: hci5: command tx timeout [ 350.408025][T16123] xt_hashlimit: size too large, truncated to 1048576 [ 350.444095][T16124] nbd: couldn't find a device at index 0 [ 350.468008][T15576] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.483698][T15576] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.541267][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.568827][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.655968][ T51] block nbd5: Receive control failed (result -32) [ 351.051255][T16147] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2896'. [ 351.079585][T16151] sch_fq: defrate 0 ignored. [ 351.154206][ T5832] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 351.163974][ T5832] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 351.172958][ T5832] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 351.193651][ T5832] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 351.202750][ T5832] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 351.476687][T16163] bond15: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 351.576342][T16163] bond15: (slave lo): Enslaving as an active interface with an up link [ 351.633402][T16163] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 351.841367][T16154] C speed is unknown, defaulting to 1000 [ 351.858752][T16179] syzkaller1: entered promiscuous mode [ 351.870596][T16179] syzkaller1: entered allmulticast mode [ 352.034395][T16188] netlink: 'syz.3.2905': attribute type 7 has an invalid length. [ 352.046223][T16188] netlink: 'syz.3.2905': attribute type 7 has an invalid length. [ 352.173617][T16197] openvswitch: netlink: Message has 1 unknown bytes. [ 352.180546][T16197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 352.197666][T16154] chnl_net:caif_netlink_parms(): no params data found [ 352.378648][T16154] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.387358][T16154] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.394880][T16154] bridge_slave_0: entered allmulticast mode [ 352.402859][T16154] bridge_slave_0: entered promiscuous mode [ 352.413224][T16154] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.420438][T16154] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.438670][T16154] bridge_slave_1: entered allmulticast mode [ 352.447688][T16154] bridge_slave_1: entered promiscuous mode [ 352.463406][ T51] Bluetooth: hci5: command tx timeout [ 352.518372][T16218] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2912'. [ 352.527679][T16220] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2913'. [ 352.589616][T16154] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.604702][T16154] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 352.683537][T16228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2914'. [ 352.694953][T16154] team0: Port device team_slave_0 added [ 352.726589][T16154] team0: Port device team_slave_1 added [ 352.840967][T16154] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 352.863950][T16154] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.891468][T16154] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 352.909230][T16154] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 352.917520][T16154] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 352.947623][T16154] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.020974][T16236] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2919'. [ 353.040401][T16236] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2919'. [ 353.053952][T16239] netlink: 'syz.2.2920': attribute type 1 has an invalid length. [ 353.069868][T16154] hsr_slave_0: entered promiscuous mode [ 353.081000][T16154] hsr_slave_1: entered promiscuous mode [ 353.087803][T16154] debugfs: 'hsr0' already exists in 'hsr' [ 353.094108][T16154] Cannot create hsr debugfs directory [ 353.263092][ T51] Bluetooth: hci2: command tx timeout [ 353.290609][T16242] syzkaller0: entered promiscuous mode [ 353.297714][T16242] syzkaller0: entered allmulticast mode [ 353.533297][T16254] IPVS: set_ctl: invalid protocol: 103 172.20.20.187:20001 [ 353.616610][T16258] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2926'. [ 353.632048][T16257] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 354.552211][ T51] Bluetooth: hci5: command tx timeout [ 354.712335][T16154] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.732006][T16154] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 49687 - 0 [ 354.760164][T16267] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2931'. [ 354.771763][T16154] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 354.781452][T16154] netdevsim netdevsim1 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 354.794287][T16154] netdevsim netdevsim1 eth3 (unregistering): unset [1, 3] type 2 family 0 port 20004 - 0 [ 354.858215][T16273] netlink: 'syz.3.2933': attribute type 1 has an invalid length. [ 354.895770][T16154] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.912026][T16154] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 49687 - 0 [ 354.926935][T16154] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 354.930921][T16278] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2935'. [ 354.938343][T16154] netdevsim netdevsim1 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 354.961352][T16154] netdevsim netdevsim1 eth2 (unregistering): unset [1, 3] type 2 family 0 port 20004 - 0 [ 355.004607][T16273] 8021q: adding VLAN 0 to HW filter on device bond16 [ 355.013627][T16280] bond10: (slave veth0_to_bond): Releasing active interface [ 355.030055][T16280] bond16: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 355.056733][T16154] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 355.090879][T16154] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 49687 - 0 [ 355.109520][T16154] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 355.120506][T16154] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 355.130760][T16154] netdevsim netdevsim1 eth1 (unregistering): unset [1, 3] type 2 family 0 port 20004 - 0 [ 355.136261][T16287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2937'. [ 355.201184][T16154] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 355.220545][T16154] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 49687 - 0 [ 355.232539][T16154] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 355.243993][T16154] netdevsim netdevsim1 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 355.261480][T16154] netdevsim netdevsim1 eth0 (unregistering): unset [1, 3] type 2 family 0 port 20004 - 0 [ 355.342479][ T51] Bluetooth: hci2: command tx timeout [ 355.438339][T16154] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 355.455629][T16154] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 355.466921][T16154] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 355.479161][T16154] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 355.638705][T16154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 355.678775][T16313] netlink: 'syz.2.2942': attribute type 7 has an invalid length. [ 355.696790][T16154] 8021q: adding VLAN 0 to HW filter on device team0 [ 355.725477][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 355.732685][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 355.778208][T15582] bridge0: port 2(bridge_slave_1) entered blocking state [ 355.785432][T15582] bridge0: port 2(bridge_slave_1) entered forwarding state [ 355.889038][T16320] syzkaller1: entered promiscuous mode [ 355.895221][T16320] syzkaller1: entered allmulticast mode [ 356.015552][T16326] syzkaller0: entered promiscuous mode [ 356.023084][T16326] syzkaller0: entered allmulticast mode [ 356.165187][T16335] __nla_validate_parse: 1 callbacks suppressed [ 356.165207][T16335] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2948'. [ 356.245323][T16335] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2948'. [ 356.294113][T16342] netlink: 'syz.3.2950': attribute type 1 has an invalid length. [ 356.326465][T16345] netlink: 'syz.0.2952': attribute type 1 has an invalid length. [ 356.358545][T16342] 8021q: adding VLAN 0 to HW filter on device bond17 [ 356.383246][T16342] bond17: (slave geneve3): making interface the new active one [ 356.392504][T16342] bond17: (slave geneve3): Enslaving as an active interface with an up link [ 356.448016][T16345] 8021q: adding VLAN 0 to HW filter on device bond10 [ 356.456900][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.476394][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.525194][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.536257][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.559232][T16154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 356.646369][T16363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2956'. [ 356.666069][T16362] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2957'. [ 356.707434][T16154] veth0_vlan: entered promiscuous mode [ 356.735977][T16154] veth1_vlan: entered promiscuous mode [ 356.819258][T16154] veth0_macvtap: entered promiscuous mode [ 356.849326][T16154] veth1_macvtap: entered promiscuous mode [ 356.915174][T16154] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 356.936957][T16154] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 356.965599][ T1343] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.992209][ T1343] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.033117][ T1343] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.061931][ T1343] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.280011][ T370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.301944][ T370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.337430][ T1333] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.346245][ T1333] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.422208][ T51] Bluetooth: hci2: command tx timeout [ 357.528253][T16396] netlink: 'syz.4.2965': attribute type 83 has an invalid length. [ 357.552048][T16398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2892'. [ 357.773628][T16404] xt_hashlimit: size too large, truncated to 1048576 [ 357.811385][T16404] xt_hashlimit: size too large, truncated to 1048576 [ 357.821244][T16409] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2969'. [ 357.836102][T16401] IPv6: NLM_F_CREATE should be specified when creating new route [ 357.858659][T16404] xt_hashlimit: size too large, truncated to 1048576 [ 357.865950][T16409] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2969'. [ 357.878752][T16404] xt_hashlimit: size too large, truncated to 1048576 [ 357.888538][ T5832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 357.899153][ T5832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 357.910269][ T5832] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 357.928745][ T5832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 357.937461][ T5832] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 358.310407][T16428] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2972'. [ 358.356338][T16428] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2972'. [ 358.549072][T16430] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2973'. [ 358.562366][T16410] C speed is unknown, defaulting to 1000 [ 358.656305][T16431] tipc: Enabling of bearer rejected, failed to enable media [ 358.865976][ T1333] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.993496][ T1333] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.143728][ T1333] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.186429][T16458] syzkaller1: entered promiscuous mode [ 359.195823][T16458] syzkaller1: entered allmulticast mode [ 359.230202][T16469] atomic_op ffff88806ea68998 conn xmit_atomic 0000000000000000 [ 359.321224][ T1333] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.504087][ T51] Bluetooth: hci2: command tx timeout [ 359.551032][T16410] chnl_net:caif_netlink_parms(): no params data found [ 359.808208][T16410] bridge0: port 1(bridge_slave_0) entered blocking state [ 359.817059][T16410] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.825157][T16410] bridge_slave_0: entered allmulticast mode [ 359.834620][T16410] bridge_slave_0: entered promiscuous mode [ 359.874554][T16410] bridge0: port 2(bridge_slave_1) entered blocking state [ 359.925264][T16410] bridge0: port 2(bridge_slave_1) entered disabled state [ 359.940742][T16410] bridge_slave_1: entered allmulticast mode [ 359.981766][ T51] Bluetooth: hci3: command tx timeout [ 360.020816][T16410] bridge_slave_1: entered promiscuous mode [ 360.138854][ T1333] bond5 (unregistering): (slave ip6erspan0): Releasing active interface [ 360.184143][ T1333] bond7 (unregistering): (slave ip6gre1): Releasing backup interface [ 360.440834][ T1333] dvmrp6 (unregistering): left allmulticast mode [ 360.470844][ T1333] bond17 (unregistering): (slave geneve3): Releasing active interface [ 360.498756][T16525] IPVS: set_ctl: invalid protocol: 50 10.1.1.1:20004 [ 360.741282][ T1333] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 360.752323][ T1333] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 360.762813][ T1333] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 360.774698][ T1333] bond0 (unregistering): Released all slaves [ 360.786431][ T1333] bond1 (unregistering): Released all slaves [ 360.802514][ T1333] bond2 (unregistering): Released all slaves [ 360.817153][ T1333] bond3 (unregistering): Released all slaves [ 360.832113][ T1333] bond4 (unregistering): Released all slaves [ 360.849314][ T1333] bond5 (unregistering): Released all slaves [ 360.878534][ T1333] team0: Port device macvlan2 removed [ 360.889541][ T1333] bond6 (unregistering): Released all slaves [ 360.907452][ T1333] bond7 (unregistering): Released all slaves [ 360.923496][ T1333] bond8 (unregistering): (slave vlan0): Releasing backup interface [ 360.944963][ T1333] bond8 (unregistering): Released all slaves [ 360.960703][ T1333] bond9 (unregistering): Released all slaves [ 360.976623][ T1333] bond10 (unregistering): (slave veth5): Releasing active interface [ 360.985934][ T1333] bond10 (unregistering): Released all slaves [ 361.011395][ T1333] bond11 (unregistering): (slave vxcan1): Releasing backup interface [ 361.020042][ T1333] bond11 (unregistering): Released all slaves [ 361.038157][ T1333] bond12 (unregistering): Released all slaves [ 361.059031][ T1333] bond13 (unregistering): (slave veth7): Releasing active interface [ 361.067953][ T1333] bond13 (unregistering): Released all slaves [ 361.084701][ T1333] bond14 (unregistering): Released all slaves [ 361.099696][ T1333] bond15 (unregistering): (slave lo): Releasing backup interface [ 361.110687][ T1333] bond15 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 361.134594][ T1333] bond15 (unregistering): Released all slaves [ 361.150229][ T1333] bond16 (unregistering): (slave veth0_to_bond): Releasing active interface [ 361.163291][ T1333] bond16 (unregistering): Released all slaves [ 361.178395][ T1333] bond17 (unregistering): Released all slaves [ 361.228112][T16515] veth0_to_bridge: mtu greater than device maximum [ 361.289750][T16410] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.319443][T16410] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 361.489244][ T1333] 9: left promiscuous mode [ 361.574989][T16410] team0: Port device team_slave_0 added [ 361.591596][ T51] Bluetooth: hci2: command tx timeout [ 361.619851][T16410] team0: Port device team_slave_1 added [ 361.629133][T16539] sctp: [Deprecated]: syz.1.3002 (pid 16539) Use of int in maxseg socket option. [ 361.629133][T16539] Use struct sctp_assoc_value instead [ 361.677304][ T1333] tipc: Disabling bearer [ 361.688250][ T1333] tipc: Left network mode [ 361.723902][T16546] __nla_validate_parse: 4 callbacks suppressed [ 361.723923][T16546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3003'. [ 361.770870][T16410] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 361.793501][T16546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3003'. [ 361.813134][T16410] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.816433][ T1333] IPVS: stopping backup sync thread 10840 ... [ 361.854227][T16546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3003'. [ 361.862308][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 120 seconds [ 361.874611][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 120 seconds [ 361.885702][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 120 seconds [ 361.896780][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 120 seconds [ 361.914850][T16546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3003'. [ 361.928529][T16410] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 361.941454][T16410] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 361.948509][T16410] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.996172][T16410] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.009035][T16553] netlink: 'syz.4.3005': attribute type 29 has an invalid length. [ 362.062365][ T51] Bluetooth: hci3: command tx timeout [ 362.095711][T16554] netlink: 'syz.4.3005': attribute type 29 has an invalid length. [ 362.278656][T16552] netlink: 'syz.4.3005': attribute type 29 has an invalid length. [ 362.290751][T16552] netlink: 'syz.4.3005': attribute type 29 has an invalid length. [ 362.299293][T16552] netlink: 'syz.4.3005': attribute type 29 has an invalid length. [ 362.546850][T16410] hsr_slave_0: entered promiscuous mode [ 362.567499][T16410] hsr_slave_1: entered promiscuous mode [ 362.579061][T16410] debugfs: 'hsr0' already exists in 'hsr' [ 362.586761][T16410] Cannot create hsr debugfs directory [ 362.701317][T16583] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3012'. [ 363.486645][T16640] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3026'. [ 363.689159][T16648] xt_hashlimit: max too large, truncated to 1048576 [ 363.993275][T16662] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3029'. [ 364.141862][ T51] Bluetooth: hci3: command tx timeout [ 364.418033][T16668] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3031'. [ 364.690935][ T1333] hsr_slave_1: left promiscuous mode [ 364.713185][ T1333] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 364.752780][ T1333] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 364.780889][ T1333] veth1_vlan: left allmulticast mode [ 365.147170][ T1333] team0 (unregistering): Port device team_slave_1 removed [ 365.488383][T16410] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 365.555076][T16410] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 365.597496][T16410] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 365.644798][T16410] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 365.917580][T16722] dvmrp0: entered allmulticast mode [ 366.073985][T16410] 8021q: adding VLAN 0 to HW filter on device bond0 [ 366.165233][T16410] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.199009][T16739] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3046'. [ 366.220766][ T1333] IPVS: stop unused estimator thread 0... [ 366.229725][ T51] Bluetooth: hci3: command tx timeout [ 366.238468][T16739] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 366.306692][T15580] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.313901][T15580] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.359639][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.366858][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 366.524470][T16744] sctp: [Deprecated]: syz.4.3047 (pid 16744) Use of struct sctp_assoc_value in delayed_ack socket option. [ 366.524470][T16744] Use struct sctp_sack_info instead [ 366.543572][T16410] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 366.609784][T16744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3047'. [ 367.074929][T16775] __nla_validate_parse: 1 callbacks suppressed [ 367.074951][T16775] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3053'. [ 367.137100][T16410] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 367.254896][T16410] veth0_vlan: entered promiscuous mode [ 367.290830][T16410] veth1_vlan: entered promiscuous mode [ 367.389815][T16410] veth0_macvtap: entered promiscuous mode [ 367.419228][T16410] veth1_macvtap: entered promiscuous mode [ 367.429135][T16793] netlink: zone id is out of range [ 367.435856][T16793] netlink: zone id is out of range [ 367.441130][T16793] netlink: zone id is out of range [ 367.451427][T16793] netlink: zone id is out of range [ 367.458686][T16793] netlink: zone id is out of range [ 367.472602][T16793] netlink: zone id is out of range [ 367.483977][T16410] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 367.493611][T16793] netlink: zone id is out of range [ 367.504626][T16793] netlink: zone id is out of range [ 367.509942][T16793] netlink: zone id is out of range [ 367.522253][T16410] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 367.570111][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.591740][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.614551][T16796] netlink: 'syz.0.3060': attribute type 10 has an invalid length. [ 367.634294][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.664895][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.699304][T16796] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 367.742766][ T9595] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 367.805895][T16801] nbd: couldn't find a device at index 0 [ 367.840806][ T51] block nbd6: Receive control failed (result -32) [ 367.992033][T16812] netlink: 212 bytes leftover after parsing attributes in process `syz.1.3064'. [ 368.015767][T16812] netlink: 'syz.1.3064': attribute type 1 has an invalid length. [ 368.023949][ T9595] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 368.087760][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.131896][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.260548][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.269610][T16823] netlink: 'syz.0.3065': attribute type 2 has an invalid length. [ 368.289029][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.319262][T16823] netlink: 'syz.0.3065': attribute type 2 has an invalid length. [ 368.367552][T16823] netlink: 'syz.0.3065': attribute type 1 has an invalid length. [ 368.670036][T16845] netlink: 'syz.4.3071': attribute type 10 has an invalid length. [ 368.798632][T16845] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.815037][T16845] bridge_slave_1: left allmulticast mode [ 368.820748][T16845] bridge_slave_1: left promiscuous mode [ 368.852522][T16845] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.875233][T16859] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3075'. [ 368.898562][T16845] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 368.912857][T16859] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3075'. [ 369.975491][T16905] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.983234][T16905] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.042561][T16916] netlink: 'syz.4.3088': attribute type 1 has an invalid length. [ 370.090871][T16905] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 370.104108][T16905] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 370.396171][T16916] bond7: entered promiscuous mode [ 370.407736][T16916] 8021q: adding VLAN 0 to HW filter on device bond7 [ 370.434970][T16918] bond7: (slave bridge10): making interface the new active one [ 370.461066][T16918] bridge10: entered promiscuous mode [ 370.530121][T16918] bond7: (slave bridge10): Enslaving as an active interface with an up link [ 370.596264][T16942] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3093'. [ 370.619070][T16918] bond7: (slave bridge11): Enslaving as a backup interface with an up link [ 370.632305][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.653756][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.699408][T16917] bond7: (slave bridge12): Enslaving as a backup interface with an up link [ 370.748820][T16917] bond7: (slave bridge13): Enslaving as a backup interface with an up link [ 370.851429][T16918] bond7: (slave bridge14): Enslaving as a backup interface with an up link [ 370.870690][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.883387][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.909390][T16917] bond7: (slave bridge15): Enslaving as a backup interface with an up link [ 370.990783][T16959] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3099'. [ 371.043743][T16960] syzkaller0: entered promiscuous mode [ 371.049295][T16960] syzkaller0: entered allmulticast mode [ 371.242377][T16978] xt_hashlimit: max too large, truncated to 1048576 [ 371.285401][T16977] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3102'. [ 371.525700][T16996] netlink: 'syz.1.3108': attribute type 11 has an invalid length. [ 371.756811][T17011] netlink: 'syz.3.3110': attribute type 5 has an invalid length. [ 372.003717][T17026] nbd: couldn't find a device at index 0 [ 372.010419][T17026] netlink: 'syz.4.3114': attribute type 1 has an invalid length. [ 372.027545][T17026] net_ratelimit: 5 callbacks suppressed [ 372.027565][T17026] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 372.200983][T17028] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3115'. [ 372.216977][T17028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3115'. [ 372.234968][T17028] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3115'. [ 372.245552][T17028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3115'. [ 372.256040][T17028] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3115'. [ 372.463801][T17045] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3118'. [ 372.489890][T17045] netlink: 14601 bytes leftover after parsing attributes in process `syz.4.3118'. [ 372.604196][T17049] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3123'. [ 372.664032][T17053] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3122'. [ 372.792424][T17059] syzkaller1: entered promiscuous mode [ 372.797969][T17059] syzkaller1: entered allmulticast mode [ 373.030044][T17067] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3129'. [ 373.154317][ T5832] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 373.163854][ T5832] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 373.172332][ T5832] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 373.180522][ T5832] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 373.206891][ T5832] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 373.421890][T17082] Cannot find set identified by id 0 to match [ 373.862808][T17102] validate_nla: 1 callbacks suppressed [ 373.862831][T17102] netlink: 'syz.3.3141': attribute type 1 has an invalid length. [ 373.892775][T17102] hsr0: entered promiscuous mode [ 373.897908][T17102] hsr0: entered allmulticast mode [ 373.905162][T17102] hsr_slave_0: entered allmulticast mode [ 373.912435][T17102] hsr_slave_1: entered allmulticast mode [ 373.921049][T17071] C speed is unknown, defaulting to 1000 [ 374.607952][ T30] audit: type=1800 audit(1773466802.454:4): pid=17127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3144" name="memory.events" dev="tmpfs" ino=94 res=0 errno=0 [ 374.790392][T17071] chnl_net:caif_netlink_parms(): no params data found [ 374.893622][T17135] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 375.046091][T17071] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.054235][T17071] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.061635][T17071] bridge_slave_0: entered allmulticast mode [ 375.069582][T17071] bridge_slave_0: entered promiscuous mode [ 375.079634][T17071] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.086919][T17071] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.094651][T17071] bridge_slave_1: entered allmulticast mode [ 375.103739][T17071] bridge_slave_1: entered promiscuous mode [ 375.145600][T17071] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 375.185772][T17071] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 375.262577][ T51] Bluetooth: hci4: command tx timeout [ 375.322258][T17071] team0: Port device team_slave_0 added [ 375.345770][T17071] team0: Port device team_slave_1 added [ 375.388679][T17147] xt_socket: unknown flags 0x50 [ 375.389098][T17071] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 375.412077][T17071] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.458070][T17071] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 375.488402][T17071] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 375.496077][T17071] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 375.541623][T17071] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 375.676500][T17071] hsr_slave_0: entered promiscuous mode [ 375.705208][T17071] hsr_slave_1: entered promiscuous mode [ 375.721859][T17071] debugfs: 'hsr0' already exists in 'hsr' [ 375.727821][T17071] Cannot create hsr debugfs directory [ 376.123207][T17172] openvswitch: netlink: IP tunnel dst address not specified [ 376.163204][T17071] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.176576][T17175] sctp: [Deprecated]: syz.2.3159 (pid 17175) Use of struct sctp_assoc_value in delayed_ack socket option. [ 376.176576][T17175] Use struct sctp_sack_info instead [ 376.414094][T17071] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.649971][T17071] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.692039][T17196] bond11: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 376.710590][T17196] bond11: (slave lo): Enslaving as an active interface with an up link [ 376.729005][T17196] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 376.774029][T17071] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 377.077446][T17212] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 377.086364][T17214] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 377.107585][T17071] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 377.175231][T17071] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 377.221973][T17071] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 377.235168][T17223] xt_l2tp: v2 doesn't support IP mode [ 377.248223][T17071] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 377.318282][T17223] bond1: option lacp_rate: mode dependency failed, not supported in mode balance-tlb(5) [ 377.337600][T17223] bond1 (unregistering): Released all slaves [ 377.345384][ T51] Bluetooth: hci4: command tx timeout [ 377.446249][T17238] sock: sock_set_timeout: `syz.1.3178' (pid 17238) tries to set negative timeout [ 377.487455][T17238] netlink: 'syz.1.3178': attribute type 9 has an invalid length. [ 377.511938][T17238] netlink: 'syz.1.3178': attribute type 11 has an invalid length. [ 377.519814][T17238] netlink: 'syz.1.3178': attribute type 12 has an invalid length. [ 377.537024][T17238] __nla_validate_parse: 18 callbacks suppressed [ 377.537046][T17238] netlink: 210020 bytes leftover after parsing attributes in process `syz.1.3178'. [ 377.570878][T17238] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3178'. [ 377.615866][T17248] tun0: tun_chr_ioctl cmd 1074025675 [ 377.633627][T17248] tun0: persist disabled [ 377.661328][T17250] IPVS: set_ctl: invalid protocol: 60 10.1.1.0:20001 [ 377.740987][T17248] bond1: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 377.758821][T17248] bond1 (unregistering): Released all slaves [ 377.848030][T17071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 377.893540][T17071] 8021q: adding VLAN 0 to HW filter on device team0 [ 377.906602][ T1328] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.913835][ T1328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 377.932143][T17259] netlink: 'syz.3.3184': attribute type 1 has an invalid length. [ 377.968652][ T1328] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.975962][ T1328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.134199][T17275] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3186'. [ 378.186779][T17274] syzkaller1: entered promiscuous mode [ 378.224650][T17274] syzkaller1: entered allmulticast mode [ 378.465961][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.534865][T17071] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 378.626557][T17303] netlink: 'syz.3.3195': attribute type 5 has an invalid length. [ 378.640207][T17304] IPVS: set_ctl: invalid protocol: 94 172.20.20.64:20001 [ 378.651336][T17303] IPVS: set_ctl: invalid protocol: 94 172.20.20.64:20001 [ 378.707995][T17310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3196'. [ 378.733849][T17310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3196'. [ 378.753805][T17310] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3196'. [ 378.776452][T17310] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.784824][T17310] bridge0: port 1(bridge_slave_0) entered disabled state [ 378.829754][T17314] Bluetooth: MGMT ver 1.23 [ 378.842274][T17314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3197'. [ 379.059171][T17071] veth0_vlan: entered promiscuous mode [ 379.090318][T17071] veth1_vlan: entered promiscuous mode [ 379.100017][T17328] xt_TPROXY: Can be used only with -p tcp or -p udp [ 379.111395][T17325] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.3200'. [ 379.185065][T17071] veth0_macvtap: entered promiscuous mode [ 379.204587][T17071] veth1_macvtap: entered promiscuous mode [ 379.228271][T17071] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 379.250880][T17071] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 379.269576][T17333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 379.286698][ T1328] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.305790][ T1328] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.353660][ T1328] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.379729][ T1328] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.422949][ T51] Bluetooth: hci4: command tx timeout [ 379.461091][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.484165][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.531037][ T9] hid-generic 0005:04F3:5508.0001: item fetching failed at offset 0/3 [ 379.549819][ T1328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.571858][ T9] hid-generic 0005:04F3:5508.0001: probe with driver hid-generic failed with error -22 [ 379.593049][ T1328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.722836][T17351] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3208'. [ 379.780427][T17355] x_tables: duplicate underflow at hook 2 [ 379.801109][T17355] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3210'. [ 379.980011][T17360] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 380.156976][T17371] netlink: 'syz.4.3214': attribute type 1 has an invalid length. [ 380.353226][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 380.363513][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 380.374435][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 380.390696][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 380.401119][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 380.781013][T17401] syzkaller0: entered promiscuous mode [ 380.794716][T17401] syzkaller0: entered allmulticast mode [ 381.212475][T17414] nbd: nbd1 already in use [ 381.222641][T17414] block nbd1: NBD_DISCONNECT [ 381.237602][T17414] block nbd1: Send disconnect failed -32 [ 381.263696][T17384] C speed is unknown, defaulting to 1000 [ 381.396210][T17419] bond1 (unregistering): Released all slaves [ 381.446293][T17416] syzkaller0: entered promiscuous mode [ 381.456752][T17416] syzkaller0: entered allmulticast mode [ 381.502256][ T5832] Bluetooth: hci4: command tx timeout [ 381.679537][T17430] bridge2: entered promiscuous mode [ 381.705619][T17430] bridge2: entered allmulticast mode [ 381.735930][T17384] chnl_net:caif_netlink_parms(): no params data found [ 381.851840][T17384] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.859100][T17384] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.866883][T17384] bridge_slave_0: entered allmulticast mode [ 381.875072][T17384] bridge_slave_0: entered promiscuous mode [ 381.884662][T17384] bridge0: port 2(bridge_slave_1) entered blocking state [ 381.892142][T17384] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.900789][T17384] bridge_slave_1: entered allmulticast mode [ 381.909555][T17384] bridge_slave_1: entered promiscuous mode [ 381.954341][T17384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.968347][T17384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 382.012481][T17384] team0: Port device team_slave_0 added [ 382.022225][T17384] team0: Port device team_slave_1 added [ 382.065872][T17384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 382.072967][T17384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.099591][T17384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 382.132426][T17384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.139438][T17384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.197638][T17384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 382.257283][T17454] netlink: 'syz.4.3238': attribute type 21 has an invalid length. [ 382.278037][T17384] hsr_slave_0: entered promiscuous mode [ 382.285319][T17384] hsr_slave_1: entered promiscuous mode [ 382.293110][T17384] debugfs: 'hsr0' already exists in 'hsr' [ 382.298867][T17384] Cannot create hsr debugfs directory [ 382.313345][T17454] ip6gre1: entered allmulticast mode [ 382.465872][ T5832] Bluetooth: hci0: command tx timeout [ 382.562050][T17384] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.584110][T17384] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 382.647156][T17465] FAULT_INJECTION: forcing a failure. [ 382.647156][T17465] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.660602][T17465] CPU: 0 UID: 0 PID: 17465 Comm: syz.2.3241 Not tainted syzkaller #0 PREEMPT(full) [ 382.660632][T17465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 382.660649][T17465] Call Trace: [ 382.660658][T17465] [ 382.660667][T17465] dump_stack_lvl+0xe8/0x150 [ 382.660702][T17465] should_fail_ex+0x412/0x560 [ 382.660737][T17465] _copy_from_user+0x2d/0xb0 [ 382.660772][T17465] ___sys_sendmsg+0x1c6/0x360 [ 382.660801][T17465] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.660861][T17465] ? __fget_files+0x2a/0x420 [ 382.660892][T17465] ? __fget_files+0x3a0/0x420 [ 382.660934][T17465] __x64_sys_sendmsg+0x1bd/0x2a0 [ 382.660970][T17465] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 382.661002][T17465] ? __pfx_ksys_write+0x10/0x10 [ 382.661046][T17465] do_syscall_64+0x14d/0xf80 [ 382.661064][T17465] ? trace_irq_disable+0x3b/0x150 [ 382.661092][T17465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.661111][T17465] ? clear_bhb_loop+0x40/0x90 [ 382.661136][T17465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.661160][T17465] RIP: 0033:0x7fa02fb9c799 [ 382.661178][T17465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.661196][T17465] RSP: 002b:00007fa030aae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 382.661217][T17465] RAX: ffffffffffffffda RBX: 00007fa02fe15fa0 RCX: 00007fa02fb9c799 [ 382.661231][T17465] RDX: 0000000000000000 RSI: 0000200000000b40 RDI: 0000000000000004 [ 382.661243][T17465] RBP: 00007fa030aae090 R08: 0000000000000000 R09: 0000000000000000 [ 382.661255][T17465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.661266][T17465] R13: 00007fa02fe16038 R14: 00007fa02fe15fa0 R15: 00007ffd499dc2b8 [ 382.661296][T17465] [ 382.923342][T17467] __nla_validate_parse: 9 callbacks suppressed [ 382.923364][T17467] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3243'. [ 382.969193][T17384] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.988409][T17384] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 383.093426][T17384] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.113126][T17384] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 383.175375][T17484] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3246'. [ 383.213305][T17486] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3248'. [ 383.260009][T17384] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.273823][T17384] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 383.359173][T17489] ieee802154 phy0 wpan0: encryption failed: -22 [ 383.389998][T17492] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3251'. [ 383.428481][T17492] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3251'. [ 383.442425][T17497] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3249'. [ 383.549600][T17492] bond2: option xmit_hash_policy: invalid value (64) [ 383.558861][T17492] bond2 (unregistering): Released all slaves [ 383.750753][T17508] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3254'. [ 383.831360][T17384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 383.852984][T17384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 383.897444][T17384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 383.923647][T17519] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3257'. [ 383.924297][T17384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 384.025727][T17530] Bluetooth: MGMT ver 1.23 [ 384.036401][T17530] netlink: 'syz.2.3258': attribute type 14 has an invalid length. [ 384.067003][T17530] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3258'. [ 384.114825][T17530] netlink: 'syz.2.3258': attribute type 14 has an invalid length. [ 384.146183][ T49] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.171622][ T49] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.187743][T17530] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3258'. [ 384.205296][ T49] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.258993][T17540] FAULT_INJECTION: forcing a failure. [ 384.258993][T17540] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.274935][ T49] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.290746][T17540] CPU: 0 UID: 0 PID: 17540 Comm: syz.4.3262 Not tainted syzkaller #0 PREEMPT(full) [ 384.290774][T17540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 384.290787][T17540] Call Trace: [ 384.290796][T17540] [ 384.290805][T17540] dump_stack_lvl+0xe8/0x150 [ 384.290840][T17540] should_fail_ex+0x412/0x560 [ 384.290873][T17540] _copy_from_iter+0x1d3/0x1670 [ 384.290914][T17540] ? rcu_is_watching+0x15/0xb0 [ 384.290949][T17540] ? __pfx__copy_from_iter+0x10/0x10 [ 384.290986][T17540] ? netlink_sendmsg+0x650/0xb40 [ 384.291013][T17540] ? skb_put+0x11b/0x210 [ 384.291048][T17540] netlink_sendmsg+0x6c0/0xb40 [ 384.291085][T17540] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.291117][T17540] ? aa_sock_msg_perm+0xf1/0x1b0 [ 384.291147][T17540] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 384.291174][T17540] ____sys_sendmsg+0x972/0x9f0 [ 384.291203][T17540] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.291233][T17540] ? import_iovec+0x73/0xa0 [ 384.291268][T17540] ___sys_sendmsg+0x2a5/0x360 [ 384.291305][T17540] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.291357][T17540] ? __fget_files+0x2a/0x420 [ 384.291385][T17540] ? __fget_files+0x3a0/0x420 [ 384.291423][T17540] __x64_sys_sendmsg+0x1bd/0x2a0 [ 384.291446][T17540] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.291485][T17540] ? __pfx_ksys_write+0x10/0x10 [ 384.291517][T17540] do_syscall_64+0x14d/0xf80 [ 384.291535][T17540] ? trace_irq_disable+0x3b/0x150 [ 384.291561][T17540] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.291580][T17540] ? clear_bhb_loop+0x40/0x90 [ 384.291602][T17540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.291619][T17540] RIP: 0033:0x7f4b6839c799 [ 384.291635][T17540] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.291651][T17540] RSP: 002b:00007f4b692ce028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.291670][T17540] RAX: ffffffffffffffda RBX: 00007f4b68615fa0 RCX: 00007f4b6839c799 [ 384.291683][T17540] RDX: 0000000000000000 RSI: 0000200000000b40 RDI: 0000000000000004 [ 384.291694][T17540] RBP: 00007f4b692ce090 R08: 0000000000000000 R09: 0000000000000000 [ 384.291721][T17540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.291733][T17540] R13: 00007f4b68616038 R14: 00007f4b68615fa0 R15: 00007ffdf2593ce8 [ 384.291764][T17540] [ 384.542472][ T5832] Bluetooth: hci0: command tx timeout [ 384.569740][T17384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.591145][T17384] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.603572][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.610728][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.647562][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.654792][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 384.810146][T17553] netlink: 'syz.3.3264': attribute type 32 has an invalid length. [ 385.036106][T17522] C speed is unknown, defaulting to 1000 [ 385.242145][T17384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.353828][T17384] veth0_vlan: entered promiscuous mode [ 385.389133][T17384] veth1_vlan: entered promiscuous mode [ 385.467965][T17384] veth0_macvtap: entered promiscuous mode [ 385.496877][T17384] veth1_macvtap: entered promiscuous mode [ 385.625323][T17384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 385.651025][T17384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 385.692459][ T1333] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.723534][ T1333] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.749592][ T1333] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.789784][ T1333] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.937093][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 385.966971][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.043607][ T1328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 386.062465][ T1328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 386.621747][ T5832] Bluetooth: hci0: command tx timeout [ 388.704178][ T51] Bluetooth: hci0: command tx timeout [ 389.478078][ T5196] udevd[5196]: worker [9941] /devices/virtual/block/nbd4 is taking a long time [ 391.902849][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 150 seconds [ 391.913737][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 150 seconds [ 391.924990][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 150 seconds [ 391.937502][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 150 seconds [ 421.981796][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 180 seconds [ 421.992706][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 180 seconds [ 422.003901][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 180 seconds [ 422.015198][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 180 seconds [ 423.672695][ T5196] udevd[5196]: worker [9941] /devices/virtual/block/nbd4 timeout; kill it [ 423.683178][ T5196] udevd[5196]: seq 15480 '/devices/virtual/block/nbd4' killed [ 439.902392][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 439.915358][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.926170][ T49] bridge_slave_0: left allmulticast mode [ 439.933910][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.944566][ T49] erspan0: left allmulticast mode [ 439.949611][ T49] erspan0: left promiscuous mode [ 439.955900][ T49] bridge1: port 1(erspan0) entered disabled state [ 440.014753][ T49] bond5 (unregistering): (slave ip6gre3): Releasing backup interface [ 440.127455][ T49] dvmrp6 (unregistering): left allmulticast mode [ 440.145031][ T49] bond8 (unregistering): (slave geneve3): Releasing active interface [ 440.180139][ T49] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 440.407128][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 440.417237][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 440.427474][ T49] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 440.439461][ T49] bond0 (unregistering): Released all slaves [ 440.454282][ T49] bond1 (unregistering): Released all slaves [ 440.467338][ T49] bond2 (unregistering): Released all slaves [ 440.482318][ T49] bond3 (unregistering): Released all slaves [ 440.499742][ T49] bond4 (unregistering): (slave veth5): Releasing active interface [ 440.512825][ T49] bond4 (unregistering): Released all slaves [ 440.528195][ T49] bond5 (unregistering): Released all slaves [ 440.541352][ T49] bond6 (unregistering): Released all slaves [ 440.556501][ T49] bond7 (unregistering): Released all slaves [ 440.574518][ T49] bond8 (unregistering): Released all slaves [ 440.592225][ T49] bond9 (unregistering): Released all slaves [ 440.609655][ T49] bond10 (unregistering): Released all slaves [ 440.629484][ T49] bond11 (unregistering): (slave lo): Releasing backup interface [ 440.638039][ T49] bond11 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 440.651914][ T49] bond11 (unregistering): Released all slaves [ 440.797417][ T49] : left promiscuous mode [ 440.835551][ T49] tipc: Left network mode [ 441.329754][ T49] hsr_slave_0: left promiscuous mode [ 441.336010][ T49] hsr_slave_1: left promiscuous mode [ 441.342036][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 441.353709][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 441.371682][ T49] veth0_macvtap: left allmulticast mode [ 441.430364][ T49] pim6reg (unregistering): left allmulticast mode [ 441.651267][T17636] __nla_validate_parse: 3 callbacks suppressed [ 441.651287][T17636] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3286'. [ 441.735363][T17639] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3288'. [ 441.944256][T17648] macsec1: entered promiscuous mode [ 442.044397][T17652] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 442.183145][T17657] syzkaller0: entered promiscuous mode [ 442.191965][T17657] syzkaller0: entered allmulticast mode [ 442.299207][T17662] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3295'. [ 442.345836][T17666] bond0: entered promiscuous mode [ 442.350949][T17666] bond_slave_0: entered promiscuous mode [ 442.366469][T17666] bond_slave_1: entered promiscuous mode [ 442.374535][T17666] batadv0: entered promiscuous mode [ 442.381136][T17666] hsr1: entered promiscuous mode [ 442.387010][T17666] hsr1: entered allmulticast mode [ 442.392439][T17666] bond0: entered allmulticast mode [ 442.397769][T17666] bond_slave_0: entered allmulticast mode [ 442.404457][T17666] bond_slave_1: entered allmulticast mode [ 442.410401][T17666] batadv0: entered allmulticast mode [ 442.418342][T17666] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 442.429235][T17666] bond0: left promiscuous mode [ 442.434532][T17666] bond_slave_0: left promiscuous mode [ 442.440383][T17666] bond_slave_1: left promiscuous mode [ 442.480637][T17666] batadv0: left promiscuous mode [ 442.799442][T17644] C speed is unknown, defaulting to 1000 [ 442.836100][T17690] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3301'. [ 442.850383][T17690] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3301'. [ 442.952054][T17698] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3306'. [ 443.091219][T17703] netlink: 'syz.4.3308': attribute type 3 has an invalid length. [ 443.157047][T17708] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3309'. [ 443.177264][T17707] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3307'. [ 443.392609][T17723] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3314'. [ 443.536282][T17730] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 443.565323][T17728] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3313'. [ 443.612821][T17730] bond2: (slave lo): Enslaving as an active interface with an up link [ 443.625842][T17730] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 443.815882][T17746] syzkaller0: entered promiscuous mode [ 443.840692][T17746] syzkaller0: entered allmulticast mode [ 443.858703][T17753] xt_hashlimit: size too large, truncated to 1048576 [ 444.415138][T17790] netlink: 'syz.0.3327': attribute type 18 has an invalid length. [ 444.478100][T15576] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.509039][T15576] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.536797][T15576] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.566902][ T1333] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 444.859962][T17806] netlink: 'syz.4.3330': attribute type 1 has an invalid length. [ 445.350388][T17835] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 445.400163][T17835] bond1 (unregistering): Released all slaves [ 445.788185][T17872] x_tables: duplicate underflow at hook 1 [ 446.152599][T17894] syz_tun: tun_net_xmit 62 [ 446.483514][T17914] syz_tun: tun_net_xmit 71 [ 446.707196][T17933] syzkaller1: entered promiscuous mode [ 446.712965][T17933] syzkaller1: entered allmulticast mode [ 446.785054][T17937] vlan1: entered allmulticast mode [ 446.790235][T17937] veth0_vlan: entered allmulticast mode [ 447.014057][T17949] syzkaller0: entered promiscuous mode [ 447.025214][T17949] syzkaller0: entered allmulticast mode [ 447.051798][T17957] nft_compat: unsupported protocol 5 [ 447.060603][T17958] nft_compat: unsupported protocol 5 [ 447.077361][T17962] netlink: 'syz.1.3378': attribute type 1 has an invalid length. [ 447.176428][T17967] bond3: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 447.189491][T17967] bond3: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 447.201419][T17967] bond3: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 447.235210][T17962] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 447.281437][T17962] bond3: (slave vcan1): making interface the new active one [ 447.302818][T17962] bond3: (slave vcan1): Enslaving as an active interface with an up link [ 447.321959][T17970] syzkaller0: entered promiscuous mode [ 447.338146][T17970] syzkaller0: entered allmulticast mode [ 447.439498][T17977] __nla_validate_parse: 7 callbacks suppressed [ 447.439517][T17977] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3382'. [ 447.490402][T17988] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3382'. [ 447.689898][T17997] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3386'. [ 447.799927][T18004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3386'. [ 447.857969][T17997] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3386'. [ 448.193987][T18034] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 448.363716][T18044] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 448.375261][T18044] bond1 (unregistering): Released all slaves [ 448.418821][T18047] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 448.431747][T18047] bond1 (unregistering): Released all slaves [ 448.720105][T18060] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3402'. [ 448.829130][T18066] bridge3: entered promiscuous mode [ 448.841955][T18066] bridge3: entered allmulticast mode [ 449.141771][T18077] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3405'. [ 449.283465][T18068] bridge1: port 1(veth3) entered blocking state [ 449.290059][T18068] bridge1: port 1(veth3) entered disabled state [ 449.297426][T18068] veth3: entered allmulticast mode [ 449.304906][T18068] veth3: entered promiscuous mode [ 449.313426][T18060] C speed is unknown, defaulting to 1000 [ 449.344635][T18075] bridge1: port 2(veth0_to_bond) entered blocking state [ 449.375945][T18075] bridge1: port 2(veth0_to_bond) entered disabled state [ 449.399203][T18075] veth0_to_bond: entered allmulticast mode [ 449.433241][T18075] veth0_to_bond: entered promiscuous mode [ 449.480772][T18096] 8021q: VLANs not supported on ipvlan1 [ 450.214932][T18130] netlink: 16038 bytes leftover after parsing attributes in process `syz.1.3423'. [ 450.327073][T18132] netlink: 'syz.3.3424': attribute type 9 has an invalid length. [ 450.479526][T18137] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3426'. [ 450.792269][T18153] sctp: [Deprecated]: syz.2.3430 (pid 18153) Use of struct sctp_assoc_value in delayed_ack socket option. [ 450.792269][T18153] Use struct sctp_sack_info instead [ 451.147777][T18170] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 451.159376][T18171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3437'. [ 451.229137][T18174] netlink: zone id is out of range [ 451.235676][T18174] netlink: zone id is out of range [ 451.240983][T18174] netlink: zone id is out of range [ 451.246729][T18174] netlink: zone id is out of range [ 451.252504][T18174] netlink: zone id is out of range [ 451.257883][T18174] netlink: zone id is out of range [ 451.264841][T18174] netlink: zone id is out of range [ 451.270188][T18174] netlink: set zone limit has 4 unknown bytes [ 451.644810][T18192] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 451.795100][T18194] syzkaller0: entered promiscuous mode [ 451.800728][T18194] syzkaller0: entered allmulticast mode [ 451.993410][T18209] netlink: 'syz.3.3449': attribute type 4 has an invalid length. [ 452.091947][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 210 seconds [ 452.104687][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 210 seconds [ 452.116346][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 210 seconds [ 452.128057][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 210 seconds [ 452.590603][T18224] syzkaller0: entered allmulticast mode [ 452.628019][T18224] pim6reg: entered allmulticast mode [ 452.945954][T18243] geneve2: entered promiscuous mode [ 453.327830][T18271] xt_hashlimit: size too large, truncated to 1048576 [ 453.733831][T18277] C speed is unknown, defaulting to 1000 [ 453.977785][T18300] syz_tun: tun_net_xmit 62 [ 454.456107][T18323] IPVS: length: 24 != 6168 [ 454.465269][T18324] __nla_validate_parse: 11 callbacks suppressed [ 454.465288][T18324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3481'. [ 454.890216][T18346] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3486'. [ 455.133054][T18358] ipt_ECN: cannot use operation on non-tcp rule [ 455.265406][ T9890] udevd[9890]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 455.420196][T18376] netlink: 'syz.1.3492': attribute type 4 has an invalid length. [ 455.446424][T18376] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3492'. [ 455.630693][T18388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3496'. [ 455.648430][T18395] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3498'. [ 455.824082][T18404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3502'. [ 455.834606][T18404] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3502'. [ 455.915320][T18404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3502'. [ 456.232983][T18438] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3511'. [ 456.359004][T18449] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3515'. [ 456.462548][ T5888] syz_tun: tun_net_xmit 110 [ 456.592704][T18460] bond1: entered promiscuous mode [ 456.597873][T18460] bond1: entered allmulticast mode [ 456.604137][T18460] 8021q: adding VLAN 0 to HW filter on device bond1 [ 456.625280][ T5888] syz_tun: tun_net_xmit 110 [ 456.859037][T18476] xt_l2tp: v2 doesn't support IP mode [ 456.889627][T18476] vcan0: entered allmulticast mode [ 457.059036][T18486] xt_l2tp: v2 tid > 0xffff: 1114244 [ 457.356980][T18507] netlink: 'syz.1.3537': attribute type 4 has an invalid length. [ 457.368795][T18507] netlink: 'syz.1.3537': attribute type 4 has an invalid length. [ 457.404849][T18506] netlink: 'syz.4.3536': attribute type 1 has an invalid length. [ 457.490358][T18506] bond2: entered promiscuous mode [ 457.497884][T18506] 8021q: adding VLAN 0 to HW filter on device bond2 [ 457.565771][T18506] bond2: (slave bridge2): making interface the new active one [ 457.575403][T18506] bridge2: entered promiscuous mode [ 457.590380][T18506] bridge2: left promiscuous mode [ 457.663985][T18522] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.671555][T18522] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.897471][T18533] netlink: 'syz.2.3544': attribute type 1 has an invalid length. [ 457.910569][T18531] netlink: 'syz.3.3545': attribute type 2 has an invalid length. [ 457.999750][T18538] netlink: 'syz.3.3547': attribute type 30 has an invalid length. [ 458.018570][ T1328] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.027411][T18538] netlink: 'syz.3.3547': attribute type 30 has an invalid length. [ 458.039472][ T1328] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.064151][ T1328] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.079560][ T1328] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 458.109820][T18538] veth0: entered promiscuous mode [ 458.125861][T18537] veth0: left promiscuous mode [ 458.224745][T18548] vlan2: entered allmulticast mode [ 458.315003][T18548] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 458.328420][T18548] bond_slave_0: left allmulticast mode [ 458.343826][T18548] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 458.354433][T18548] bond_slave_1: left allmulticast mode [ 458.360447][T18548] bond0 (unregistering): Released all slaves [ 458.484634][T18565] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 458.495690][T18566] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 458.699511][T18578] ip6t_srh: unknown srh invflags 4000 [ 458.818069][T18586] netlink: 'syz.2.3560': attribute type 1 has an invalid length. [ 458.986247][T18602] netlink: 'syz.2.3565': attribute type 24 has an invalid length. [ 459.094761][T18607] sctp: [Deprecated]: syz.4.3567 (pid 18607) Use of struct sctp_assoc_value in delayed_ack socket option. [ 459.094761][T18607] Use struct sctp_sack_info instead [ 459.170758][T18612] bond2: entered allmulticast mode [ 459.190044][T18612] bridge2: entered promiscuous mode [ 459.195818][T18612] bridge2: entered allmulticast mode [ 459.392318][T18627] Bluetooth: MGMT ver 1.23 [ 459.420090][T18628] hsr_slave_0 (unregistering): left promiscuous mode [ 459.611685][T18633] syz_tun: tun_net_xmit 42 [ 459.750354][T18641] sctp: [Deprecated]: syz.4.3578 (pid 18641) Use of struct sctp_assoc_value in delayed_ack socket option. [ 459.750354][T18641] Use struct sctp_sack_info instead [ 459.804694][T18644] __nla_validate_parse: 19 callbacks suppressed [ 459.804707][T18644] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3579'. [ 461.789775][T18583] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 461.932371][T18647] validate_nla: 1 callbacks suppressed [ 461.932388][T18647] netlink: 'syz.3.3580': attribute type 4 has an invalid length. [ 462.001910][T18653] netlink: 'syz.1.3581': attribute type 1 has an invalid length. [ 462.042329][T18659] netlink: 'syz.3.3580': attribute type 10 has an invalid length. [ 462.112982][T18659] team0: Device ipvlan1 failed to register rx_handler [ 462.160268][T18654] bond4: (slave gretap2): making interface the new active one [ 462.169813][T18654] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 462.305402][T18672] netlink: 'syz.2.3587': attribute type 1 has an invalid length. [ 462.352691][T18672] 8021q: adding VLAN 0 to HW filter on device bond3 [ 462.451916][T18673] bond3: (slave veth3): Enslaving as an active interface with a down link [ 462.594778][T18686] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3591'. [ 462.606249][T18686] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3591'. [ 462.870160][T18710] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3598'. [ 462.915751][T18714] IPVS: set_ctl: invalid protocol: 255 255.255.255.255:20003 [ 462.945709][T18713] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3599'. [ 462.986607][T18722] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3602'. [ 462.998571][T18720] syz_tun: entered allmulticast mode [ 463.025773][T18718] syz_tun: left allmulticast mode [ 463.051743][ C0] syz_tun: tun_net_xmit 54 [ 463.081697][ C0] syz_tun: tun_net_xmit 54 [ 463.195233][T18732] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1500) ! [ 463.214186][T18736] syzkaller0: entered promiscuous mode [ 463.219873][T18736] syzkaller0: entered allmulticast mode [ 463.228450][T18732] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1500) ! [ 463.259930][T18734] syzkaller0: entered promiscuous mode [ 463.267551][T18734] syzkaller0: entered allmulticast mode [ 463.729116][T18749] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3608'. [ 464.302502][T17617] Bluetooth: hci0: command 0x0c1a tx timeout [ 464.309030][ T5832] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 464.590445][T18748] macvtap0: entered promiscuous mode [ 464.596528][T18748] macvtap0: left promiscuous mode [ 464.609399][T18756] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3609'. [ 464.795524][T18764] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3613'. [ 464.836751][T18764] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3613'. [ 464.994789][T18784] bridge0: port 3(gretap0) entered blocking state [ 465.017227][T18784] bridge0: port 3(gretap0) entered disabled state [ 465.031271][T18784] gretap0: entered allmulticast mode [ 465.073762][T18784] gretap0: entered promiscuous mode [ 465.082306][T18784] bridge0: port 3(gretap0) entered blocking state [ 465.088950][T18784] bridge0: port 3(gretap0) entered forwarding state [ 465.142178][T18790] tipc: Started in network mode [ 465.147603][T18790] tipc: Node identity 06b6c80f4058, cluster identity 4711 [ 465.155032][T18790] tipc: Enabled bearer , priority 0 [ 465.233956][T18790] syzkaller0: entered promiscuous mode [ 465.239565][T18790] syzkaller0: entered allmulticast mode [ 465.245995][T18790] tipc: Resetting bearer [ 465.317198][T18788] tipc: Resetting bearer [ 466.393062][ T5832] Bluetooth: hci0: command 0x0c1a tx timeout [ 466.912119][T18788] tipc: Disabling bearer [ 466.941008][T18815] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 466.951295][T18815] syzkaller1: Refused to change device type [ 466.990905][T18817] bridge0: mtu less than device minimum [ 467.004036][T18821] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 467.010075][T18821] syzkaller1: linktype set to 823 [ 467.066289][ T9599] tipc: Node number set to 1190053903 [ 467.548941][T18871] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.730975][T18885] netlink: 'syz.4.3641': attribute type 83 has an invalid length. [ 467.745244][T18886] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 467.814068][T18890] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3644'. [ 467.906125][T18890] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3644'. [ 468.008567][T18898] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3646'. [ 468.244366][T18915] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3650'. [ 468.394178][T18922] syzkaller0: entered promiscuous mode [ 468.400477][T18922] syzkaller0: entered allmulticast mode [ 468.454502][T18922] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3652'. [ 468.467600][T18926] netlink: 'syz.1.3654': attribute type 1 has an invalid length. [ 468.482514][T18926] netlink: 212 bytes leftover after parsing attributes in process `syz.1.3654'. [ 468.652310][T18937] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3659'. [ 468.915094][T18956] netlink: 'syz.3.3664': attribute type 1 has an invalid length. [ 468.950672][T18960] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3662'. [ 469.016777][T18965] syzkaller0: entered promiscuous mode [ 469.022658][T18965] syzkaller0: entered allmulticast mode [ 469.178066][T18971] pim6reg527: entered allmulticast mode [ 469.448471][T18991] netlink: 284 bytes leftover after parsing attributes in process `syz.3.3677'. [ 469.956896][T19020] netlink: 'syz.2.3687': attribute type 16 has an invalid length. [ 469.967256][T19020] netlink: 'syz.2.3687': attribute type 3 has an invalid length. [ 469.977746][T19015] xt_hashlimit: size too large, truncated to 1048576 [ 469.991834][T19020] __nla_validate_parse: 1 callbacks suppressed [ 469.991848][T19020] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3687'. [ 470.088982][T19031] wireguard0: entered promiscuous mode [ 470.118343][T19031] wireguard0: entered allmulticast mode [ 470.174179][T19031] team0: Device wireguard0 is of different type [ 470.294116][ T1333] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 470.307784][ T1333] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 470.517200][T19048] openvswitch: netlink: Multiple metadata blocks provided [ 470.972835][T19058] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3695'. [ 470.996073][T19058] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3695'. [ 471.037404][T19058] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3695'. [ 471.103850][T19063] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 471.122593][T19063] syzkaller0: entered promiscuous mode [ 471.128184][T19063] syzkaller0: entered allmulticast mode [ 471.139229][T19063] tipc: Started in network mode [ 471.155411][T19063] tipc: Node identity d282cf68c2bf, cluster identity 4711 [ 471.173856][T19063] tipc: Enabled bearer , priority 0 [ 471.216916][T19062] tipc: Resetting bearer [ 471.265050][T19062] tipc: Disabling bearer [ 471.297688][T19050] C speed is unknown, defaulting to 1000 [ 471.313983][T19072] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3700'. [ 471.344087][T19072] openvswitch: netlink: Flow actions attr not present in new flow. [ 471.488736][T19075] bond5: ARP target 1.0.0.0 is already present [ 471.496742][T19075] bond5: option arp_ip_target: invalid value (1) [ 471.510212][T19075] bond5 (unregistering): Released all slaves [ 471.605971][T19086] netlink: 'syz.4.3704': attribute type 1 has an invalid length. [ 471.622012][T19086] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3704'. [ 471.638703][T19086] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3704'. [ 471.653578][T19086] netlink: 'syz.4.3704': attribute type 1 has an invalid length. [ 471.666530][T19086] netlink: 'syz.4.3704': attribute type 8 has an invalid length. [ 471.674941][T19086] netlink: 606 bytes leftover after parsing attributes in process `syz.4.3704'. [ 471.737812][T19090] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3705'. [ 472.080089][T19108] xt_l2tp: wrong L2TP version: 0 [ 472.086470][T19108] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 472.507870][T19097] syz.4.3708 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 472.531165][T19097] CPU: 1 UID: 0 PID: 19097 Comm: syz.4.3708 Not tainted syzkaller #0 PREEMPT(full) [ 472.531190][T19097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 472.531201][T19097] Call Trace: [ 472.531208][T19097] [ 472.531217][T19097] dump_stack_lvl+0xe8/0x150 [ 472.531335][T19097] dump_header+0xd3/0x4c0 [ 472.531363][T19097] oom_kill_process+0x3ab/0x970 [ 472.531407][T19097] out_of_memory+0x106c/0x1410 [ 472.531425][T19097] ? percpu_ref_put+0x19/0x180 [ 472.531472][T19097] ? __pfx___mutex_lock+0x10/0x10 [ 472.531610][T19097] ? __pfx_out_of_memory+0x10/0x10 [ 472.531625][T19097] ? do_raw_spin_unlock+0xf5/0x210 [ 472.531666][T19097] try_charge_memcg+0xc53/0x1560 [ 472.531688][T19097] ? __lock_acquire+0x6b5/0x2cf0 [ 472.531722][T19097] ? __pfx_try_charge_memcg+0x10/0x10 [ 472.531740][T19097] ? xa_load+0x60/0x210 [ 472.531787][T19097] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 472.531812][T19097] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 472.531836][T19097] mem_cgroup_swapin_charge_folio+0x2e3/0x4d0 [ 472.531858][T19097] __swap_cache_prepare_and_add+0x52a/0x700 [ 472.531910][T19097] swap_cache_alloc_folio+0xf1/0x240 [ 472.531945][T19097] swap_cluster_readahead+0x369/0x690 [ 472.531976][T19097] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 472.532014][T19097] ? get_vma_policy+0x27b/0x3c0 [ 472.532038][T19097] swapin_readahead+0x196/0xc50 [ 472.532075][T19097] ? __pfx_swapin_readahead+0x10/0x10 [ 472.532101][T19097] ? swap_table_get+0x1e/0x260 [ 472.532125][T19097] ? swap_table_get+0x1e/0x260 [ 472.532147][T19097] ? swap_table_get+0x1e/0x260 [ 472.532171][T19097] ? swap_table_get+0x216/0x260 [ 472.532196][T19097] ? swap_cache_get_folio+0x513/0x520 [ 472.532225][T19097] do_swap_page+0x56f/0x5a20 [ 472.532277][T19097] ? do_swap_page+0x127/0x5a20 [ 472.532300][T19097] ? __pfx_do_swap_page+0x10/0x10 [ 472.532321][T19097] ? __pte_offset_map+0x1ae/0x240 [ 472.532350][T19097] ? pte_offset_map_rw_nolock+0xea/0x160 [ 472.532379][T19097] handle_mm_fault+0x12d2/0x3310 [ 472.532417][T19097] ? handle_mm_fault+0xee/0x3310 [ 472.532449][T19097] ? __pfx_handle_mm_fault+0x10/0x10 [ 472.532473][T19097] ? lock_vma_under_rcu+0x45a/0x500 [ 472.532514][T19097] do_user_addr_fault+0xa73/0x1340 [ 472.532556][T19097] ? rcu_is_watching+0x15/0xb0 [ 472.532586][T19097] ? trace_page_fault_user+0x84/0x210 [ 472.532610][T19097] exc_page_fault+0x6a/0xc0 [ 472.532660][T19097] asm_exc_page_fault+0x26/0x30 [ 472.532695][T19097] RIP: 0033:0x7f4b6835cfa0 [ 472.532713][T19097] Code: 6f 46 50 0f 29 44 24 50 f3 0f 6f 46 60 0f 29 44 24 60 f3 0f 6f 46 70 0f 29 44 24 70 e9 5d ff ff ff e8 04 1d 04 00 0f 1f 40 00 <8b> 07 f6 07 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 [ 472.532729][T19097] RSP: 002b:00007ffdf2593dc8 EFLAGS: 00010246 [ 472.532745][T19097] RAX: 0000000000000000 RBX: 000055558912e500 RCX: 0000000000000000 [ 472.532756][T19097] RDX: 0000000000000000 RSI: 00000000000000e6 RDI: 000055558912e808 [ 472.532766][T19097] RBP: 00007f4b68617da0 R08: 00007ffdf2593e20 R09: 0000000000000000 [ 472.532777][T19097] R10: 0000000000000000 R11: 000055558912e808 R12: 000000000007365a [ 472.532787][T19097] R13: 00007f4b6861609c R14: 00000000000733a1 R15: 00007f4b68616090 [ 472.532814][T19097] [ 472.844749][T17617] Bluetooth: hci5: command 0x0406 tx timeout [ 472.912141][T19097] memory: usage 307200kB, limit 307200kB, failcnt 613 [ 472.918959][T19097] memory+swap: usage 307380kB, limit 9007199254740988kB, failcnt 0 [ 472.927466][T19097] kmem: usage 307184kB, limit 9007199254740988kB, failcnt 0 [ 472.935820][T19097] Memory cgroup stats for /syz4: [ 472.936113][T19097] cache 0 [ 472.944436][T19097] rss 0 [ 472.947391][T19097] rss_huge 0 [ 472.950600][T19097] shmem 0 [ 472.955758][T19097] mapped_file 0 [ 472.959406][T19097] dirty 0 [ 472.965350][T19097] writeback 0 [ 472.968670][T19097] workingset_refault_anon 18 [ 472.973776][T19097] workingset_refault_file 0 [ 472.978314][T19097] swap 184320 [ 472.982532][T19097] swapcached 200704 [ 472.986526][T19097] pgpgin 55441 [ 472.989907][T19097] pgpgout 55437 [ 472.993687][T19097] pgfault 117693 [ 472.997436][T19097] pgmajfault 13 [ 473.000927][T19097] inactive_anon 16384 [ 473.005265][T19097] active_anon 0 [ 473.008902][T19097] inactive_file 0 [ 473.013123][T19097] active_file 0 [ 473.016608][T19097] unevictable 0 [ 473.020280][T19097] hierarchical_memory_limit 314572800 [ 473.027112][T19097] hierarchical_memsw_limit 9223372036854771712 [ 473.034066][T19097] total_cache 0 [ 473.037555][T19097] total_rss 0 [ 473.040857][T19097] total_rss_huge 0 [ 473.045320][T19097] total_shmem 0 [ 473.048808][T19097] total_mapped_file 0 [ 473.053085][T19097] total_dirty 0 [ 473.056752][T19097] total_writeback 0 [ 473.060603][T19097] total_workingset_refault_anon 18 [ 473.066173][T19097] total_workingset_refault_file 0 [ 473.071453][T19097] total_swap 184320 [ 473.076033][T19097] total_swapcached 200704 [ 473.080372][T19097] total_pgpgin 55441 [ 473.084665][T19097] total_pgpgout 55437 [ 473.088666][T19097] total_pgfault 117693 [ 473.093039][T19097] total_pgmajfault 13 [ 473.097217][T19097] total_inactive_anon 16384 [ 473.102626][T19097] total_active_anon 0 [ 473.106639][T19097] total_inactive_file 0 [ 473.110969][T19097] total_active_file 0 [ 473.115288][T19097] total_unevictable 0 [ 473.119293][T19097] anon_cost 0 [ 473.122993][T19097] file_cost 0 [ 473.126347][T19097] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3708,pid=19097,uid=0 [ 473.143945][T19097] Memory cgroup out of memory: Killed process 19097 (syz.4.3708) total-vm:102288kB, anon-rss:1240kB, file-rss:22852kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 474.514770][T19081] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 474.756261][T19152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3719'. [ 475.118562][T19175] tipc: Started in network mode [ 475.123692][T19175] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 475.133326][T19175] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 475.146961][T19175] tipc: Enabled bearer , priority 10 [ 475.161771][T19176] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 475.170180][T19175] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 475.231945][T19158] C speed is unknown, defaulting to 1000 [ 475.322778][T19183] tipc: Started in network mode [ 475.327975][T19183] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 475.337666][T19183] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 475.348378][T19183] tipc: Enabled bearer , priority 10 [ 475.396694][T19187] tipc: Enabling of bearer rejected, already enabled [ 475.906664][T19218] nbd: illegal input index 2958377 [ 475.944472][T19229] pim6reg: entered allmulticast mode [ 475.960619][T19229] __nla_validate_parse: 3 callbacks suppressed [ 475.960636][T19229] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3738'. [ 476.176490][T19235] x_tables: duplicate underflow at hook 1 [ 476.421597][T19237] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 476.430707][ T5888] tipc: Node number set to 1 [ 476.532381][T19247] bond_slave_0: entered promiscuous mode [ 476.571550][ T797] tipc: Node number set to 1 [ 477.074211][T19267] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3750'. [ 477.113513][T19242] C speed is unknown, defaulting to 1000 [ 477.197071][T19270] netlink: 'syz.1.3751': attribute type 39 has an invalid length. [ 477.249765][T19271] netlink: 'syz.1.3751': attribute type 39 has an invalid length. [ 477.835629][T19283] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3754'. [ 477.905331][T19287] ip6t_srh: unknown srh match flags 4000 [ 477.912914][T19291] netlink: 212344 bytes leftover after parsing attributes in process `syz.0.3757'. [ 478.641755][T19320] sch_tbf: burst 0 is lower than device lo mtu (11337746) ! [ 478.785851][T19327] netlink: 'syz.4.3766': attribute type 10 has an invalid length. [ 478.822175][T19327] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.869590][T19327] bridge_slave_1: left allmulticast mode [ 478.882084][T19327] bridge_slave_1: left promiscuous mode [ 478.887928][T19327] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.965965][T19327] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 479.487773][T19356] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3775'. [ 479.653389][T19330] C speed is unknown, defaulting to 1000 [ 479.909716][T19376] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3779'. [ 479.919019][T19376] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3779'. [ 480.033771][T19376] geneve2: entered promiscuous mode [ 480.043513][T19376] geneve2: entered allmulticast mode [ 480.058147][ T1333] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.083874][ T1333] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.093244][ T1333] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.129626][ T1333] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.294545][T19385] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 481.152382][T19401] netlink: 'syz.1.3783': attribute type 1 has an invalid length. [ 482.141987][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 240 seconds [ 482.153894][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 240 seconds [ 482.165062][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 240 seconds [ 482.176348][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 240 seconds [ 482.592025][T19359] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 482.605057][T19378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3777'. [ 482.631821][T19395] netlink: 512 bytes leftover after parsing attributes in process `syz.3.3782'. [ 482.798715][T19410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3785'. [ 482.942295][T19398] Bluetooth: hci3: command 0x0406 tx timeout [ 482.948517][T19398] Bluetooth: hci2: command 0x0406 tx timeout [ 483.340833][T19449] sctp: [Deprecated]: syz.2.3794 (pid 19449) Use of int in max_burst socket option deprecated. [ 483.340833][T19449] Use struct sctp_assoc_value instead [ 483.528394][T19453] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3797'. [ 483.559383][T19433] C speed is unknown, defaulting to 1000 [ 483.570853][T19453] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3797'. [ 483.799032][ T5945] IPVS: starting estimator thread 0... [ 483.886831][T19478] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3804'. [ 483.912517][T19475] IPVS: using max 30 ests per chain, 72000 per kthread [ 484.046761][T19496] netlink: 'syz.4.3807': attribute type 2 has an invalid length. [ 484.095759][T19495] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3807'. [ 484.233357][T19501] xt_bpf: check failed: parse error [ 484.351625][T19476] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3803'. [ 484.479282][T19476] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3803'. [ 484.619963][T19535] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 484.757579][T19539] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3818'. [ 484.802740][T19541] syzkaller0: entered promiscuous mode [ 484.809623][T19541] syzkaller0: entered allmulticast mode [ 484.980391][T19527] C speed is unknown, defaulting to 1000 [ 487.417341][T19514] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 487.599571][T19563] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 487.606910][T19563] IPv6: NLM_F_CREATE should be set when creating new route [ 487.646814][T19562] __nla_validate_parse: 2 callbacks suppressed [ 487.646833][T19562] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3825'. [ 487.733350][T19575] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 487.996185][T19600] xt_recent: Unsupported userspace flags (000000b1) [ 488.207432][T19590] C speed is unknown, defaulting to 1000 [ 488.559818][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 488.637283][T19641] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3846'. [ 488.729350][T19639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3845'. [ 488.770736][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 488.851682][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 488.880853][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.007848][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.059667][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.085987][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.109321][T19669] netlink: 'syz.4.3851': attribute type 83 has an invalid length. [ 489.131685][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.163086][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.172644][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.230658][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.269669][T19673] netlink: 'syz.2.3853': attribute type 10 has an invalid length. [ 489.276763][T19635] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 489.307928][T19675] netlink: 'syz.0.3854': attribute type 33 has an invalid length. [ 489.329002][T19675] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3854'. [ 489.372634][T19683] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3854'. [ 489.758171][T19684] C speed is unknown, defaulting to 1000 [ 490.009725][T19715] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3865'. [ 490.257757][T19727] IPv6: NLM_F_CREATE should be specified when creating new route [ 490.295912][T19727] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 490.303275][T19727] IPv6: NLM_F_CREATE should be set when creating new route [ 490.310578][T19727] IPv6: NLM_F_CREATE should be set when creating new route [ 490.317894][T19727] IPv6: NLM_F_CREATE should be set when creating new route [ 490.348347][T19727] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3870'. [ 490.429390][T19727] team0: No ports can be present during mode change [ 490.467370][T19725] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3866'. [ 490.614786][T19735] bond4: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 490.655427][T19735] bond4 (unregistering): Released all slaves [ 490.736809][T19722] xt_CT: You must specify a L4 protocol and not use inversions on it [ 491.202855][T19758] nbd0: detected capacity change from 0 to 63 [ 491.259302][T19763] block nbd0: NBD_DISCONNECT [ 491.299825][T19763] block nbd0: Disconnected due to user request. [ 491.312453][T19763] block nbd0: shutting down sockets [ 491.324695][ C1] blk_print_req_error: 138 callbacks suppressed [ 491.324713][ C1] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.340563][ C1] buffer_io_error: 138 callbacks suppressed [ 491.340579][ C1] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.354345][ C1] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.363866][ C1] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.371695][ C1] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.381187][ C1] Buffer I/O error on dev nbd0, logical block 2, async page read [ 491.389021][ C1] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.398538][ C1] Buffer I/O error on dev nbd0, logical block 3, async page read [ 491.407826][ T9890] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.423802][ T9890] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.438992][ T9890] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.448927][ T9890] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.457017][ T9890] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.475745][ T9890] Buffer I/O error on dev nbd0, logical block 2, async page read [ 491.504478][ T9890] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.534666][ T9890] Buffer I/O error on dev nbd0, logical block 3, async page read [ 491.561680][ T9890] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.590701][ T9890] Buffer I/O error on dev nbd0, logical block 0, async page read [ 491.617869][ T9890] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 491.656107][ T9890] Buffer I/O error on dev nbd0, logical block 1, async page read [ 491.702427][ T9890] ldm_validate_partition_table(): Disk read failed. [ 491.716132][ T9890] Dev nbd0: unable to read RDB block 0 [ 491.728879][ T9890] nbd0: unable to read partition table [ 491.759680][ T9890] ldm_validate_partition_table(): Disk read failed. [ 491.790429][ T9890] Dev nbd0: unable to read RDB block 0 [ 491.806373][ T9890] nbd0: unable to read partition table [ 491.909627][T19795] syzkaller0: entered promiscuous mode [ 491.934763][T19795] syzkaller0: entered allmulticast mode [ 491.950768][T19762] C speed is unknown, defaulting to 1000 [ 492.098207][T19805] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3890'. [ 492.694034][ T5832] block nbd0: Receive control failed (result -32) [ 493.310937][T19803] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 493.349320][T19810] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3892'. [ 493.485361][T19810] hsr_slave_0 (unregistering): left promiscuous mode [ 493.559497][T19830] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3893'. [ 493.612943][T19830] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3893'. [ 493.690008][T19836] bond4: (slave gre0): Device is not bonding slave [ 493.701612][T19836] bond4: option active_slave: invalid value (gre0) [ 493.730342][T19836] bond4 (unregistering): Released all slaves [ 493.854035][T19840] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 494.198198][T19866] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 494.230468][T19866] netlink: 170384 bytes leftover after parsing attributes in process `syz.0.3903'. [ 494.697981][T15582] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.714292][T15582] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.751648][T15582] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.760612][T15582] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.766007][T19908] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3911'. [ 495.065180][T19937] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 495.225968][T19926] C speed is unknown, defaulting to 1000 [ 495.570185][T19959] siw: device registration error -23 [ 495.794452][T19967] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3925'. [ 495.867158][T19931] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 495.879039][T19944] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3918'. [ 496.115919][T19980] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.3930'. [ 496.160976][T19980] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 496.202074][T19986] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3933'. [ 496.263245][ T5900] syz_tun: tun_net_xmit 110 [ 496.297302][T19986] hsr_slave_0 (unregistering): left promiscuous mode [ 496.512617][T20000] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3937'. [ 496.558130][T20007] validate_nla: 23 callbacks suppressed [ 496.558149][T20007] netlink: 'syz.3.3938': attribute type 1 has an invalid length. [ 496.605629][T20009] netlink: 'syz.2.3939': attribute type 11 has an invalid length. [ 496.730981][T20012] netlink: 'syz.4.3940': attribute type 2 has an invalid length. [ 496.762243][T20012] netlink: 'syz.4.3940': attribute type 1 has an invalid length. [ 497.090697][T20005] C speed is unknown, defaulting to 1000 [ 497.157467][T20044] xt_TCPMSS: Only works on TCP SYN packets [ 497.181915][ T5900] syz_tun: tun_net_xmit 110 [ 497.447704][T20069] syzkaller0: entered promiscuous mode [ 497.478207][T20069] syzkaller0: entered allmulticast mode [ 497.565615][T20077] netdevsim netdevsim1: Firmware load for '..' refused, path contains '..' component [ 497.769714][T20082] netlink: 'syz.3.3960': attribute type 30 has an invalid length. [ 497.784091][T20087] syz_tun: tun_net_xmit 32782 [ 497.789346][T20087] syz_tun: tun_net_xmit 32782 [ 497.811907][T20087] syz_tun: tun_net_xmit 61 [ 498.107886][T20106] vlan2: entered allmulticast mode [ 498.113835][T20106] bridge3: entered allmulticast mode [ 498.163702][T20110] netlink: 'syz.1.3969': attribute type 1 has an invalid length. [ 498.201557][T20110] netlink: 'syz.1.3969': attribute type 2 has an invalid length. [ 498.410056][T20133] __nla_validate_parse: 11 callbacks suppressed [ 498.410075][T20133] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3977'. [ 498.412905][T20131] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3975'. [ 498.424311][T20122] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3972'. [ 498.437303][T20131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3975'. [ 498.457397][T20127] macvtap1: entered promiscuous mode [ 498.463304][T20127] syz_tun: entered promiscuous mode [ 498.473196][T20127] syz_tun: left promiscuous mode [ 498.571430][T20134] geneve2: entered promiscuous mode [ 498.577215][T20134] geneve2: entered allmulticast mode [ 498.745247][T20144] netlink: 'syz.2.3980': attribute type 1 has an invalid length. [ 498.793237][T20144] bond4: entered promiscuous mode [ 498.812804][T20144] 8021q: adding VLAN 0 to HW filter on device bond4 [ 498.906794][T20147] bond4: (slave bridge4): making interface the new active one [ 498.967442][T20147] bridge4: entered promiscuous mode [ 498.993200][T20147] bond4: (slave bridge4): Enslaving as an active interface with an up link [ 499.034492][T20144] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 499.072279][T20144] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 499.245852][T20171] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input5 [ 499.488808][T20174] syzkaller0: entered promiscuous mode [ 499.510819][T20174] syzkaller0: entered allmulticast mode [ 499.543419][T20156] C speed is unknown, defaulting to 1000 [ 499.639697][T20188] netlink: 'syz.3.3988': attribute type 11 has an invalid length. [ 499.943714][T20198] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3989'. [ 499.956802][T20198] netlink: 'syz.4.3989': attribute type 1 has an invalid length. [ 500.936645][T20209] : renamed from hsr0 (while UP) [ 500.977646][T20209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3991'. [ 500.987898][T20209] block nbd1: Unsupported socket: should be TCP or UNIX. [ 501.544257][T20243] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20001 [ 501.707112][T20250] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3998'. [ 501.940986][T20269] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4008'. [ 501.975257][T20270] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 502.243107][T20290] netlink: 'syz.2.4014': attribute type 12 has an invalid length. [ 502.292227][T20290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4014'. [ 502.328026][T20292] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4014'. [ 502.353350][T20290] netlink: 'syz.2.4014': attribute type 12 has an invalid length. [ 502.362832][T20290] netlink: 'syz.2.4014': attribute type 12 has an invalid length. [ 503.009542][T20326] xt_HMARK: spi-set and port-set can't be combined [ 503.244440][T20341] netlink: 'syz.0.4028': attribute type 1 has an invalid length. [ 503.399949][T20350] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 503.416386][T20350] syzkaller1: Linktype set failed because interface is up [ 503.426443][ T5945] syzkaller1: tun_net_xmit 90 [ 503.437597][T20315] C speed is unknown, defaulting to 1000 [ 503.641109][T20369] __nla_validate_parse: 13 callbacks suppressed [ 503.641130][T20369] netlink: 88 bytes leftover after parsing attributes in process `syz.3.4037'. [ 503.674558][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4033'. [ 504.191911][T20387] netlink: 'syz.1.4042': attribute type 1 has an invalid length. [ 504.270292][T20389] netlink: 'syz.0.4043': attribute type 5 has an invalid length. [ 504.320275][T20357] C speed is unknown, defaulting to 1000 [ 504.509539][T20393] xfrm1: entered allmulticast mode [ 504.860067][T20409] syzkaller0: entered promiscuous mode [ 505.902142][T20455] C speed is unknown, defaulting to 1000 [ 506.076692][T20444] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4058'. [ 506.184539][T20444] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4058'. [ 506.369634][T20505] netlink: 165 bytes leftover after parsing attributes in process `syz.3.4069'. [ 506.399791][T20508] xt_cgroup: xt_cgroup: no path or classid specified [ 506.442043][T20508] netlink: 'syz.0.4071': attribute type 1 has an invalid length. [ 506.598777][T20519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4074'. [ 507.073469][T20541] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4081'. [ 507.154659][T20541] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 507.276438][T20554] syzkaller0: entered promiscuous mode [ 507.293025][T20554] syzkaller0: entered allmulticast mode [ 507.317355][T20560] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4088'. [ 507.552768][T20542] C speed is unknown, defaulting to 1000 [ 507.612647][T20571] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4093'. [ 507.772917][T20586] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.4097'. [ 508.023640][T20607] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 508.156531][T20617] [ 508.158944][T20617] ====================================================== [ 508.165992][T20617] WARNING: possible circular locking dependency detected [ 508.173036][T20617] syzkaller #0 Not tainted [ 508.177472][T20617] ------------------------------------------------------ [ 508.184537][T20617] syz.0.4102/20617 is trying to acquire lock: [ 508.190622][T20617] ffffffff8fd49b38 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xbe/0x860 [ 508.200252][T20617] [ 508.200252][T20617] but task is already holding lock: [ 508.207631][T20617] ffffffff8fd49ad8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 508.217244][T20617] [ 508.217244][T20617] which lock already depends on the new lock. [ 508.217244][T20617] [ 508.227652][T20617] [ 508.227652][T20617] the existing dependency chain (in reverse order) is: [ 508.236707][T20617] [ 508.236707][T20617] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 508.244639][T20617] _raw_spin_lock_bh+0x36/0x50 [ 508.249971][T20617] nr_rt_ioctl+0x40c/0xf90 [ 508.254916][T20617] sock_do_ioctl+0x101/0x320 [ 508.260142][T20617] sock_ioctl+0x5c6/0x7f0 [ 508.265006][T20617] __se_sys_ioctl+0xfc/0x170 [ 508.270176][T20617] do_syscall_64+0x14d/0xf80 [ 508.275300][T20617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.281726][T20617] [ 508.281726][T20617] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 508.289725][T20617] _raw_spin_lock_bh+0x36/0x50 [ 508.295021][T20617] nr_rt_ioctl+0x215/0xf90 [ 508.300010][T20617] sock_do_ioctl+0x101/0x320 [ 508.305125][T20617] sock_ioctl+0x5c6/0x7f0 [ 508.309976][T20617] __se_sys_ioctl+0xfc/0x170 [ 508.315094][T20617] do_syscall_64+0x14d/0xf80 [ 508.320212][T20617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.326646][T20617] [ 508.326646][T20617] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 508.334467][T20617] __lock_acquire+0x15a5/0x2cf0 [ 508.339850][T20617] lock_acquire+0xf0/0x2e0 [ 508.344838][T20617] _raw_spin_lock_bh+0x36/0x50 [ 508.350143][T20617] nr_rt_device_down+0xbe/0x860 [ 508.355570][T20617] nr_device_event+0x137/0x150 [ 508.360934][T20617] notifier_call_chain+0x1be/0x400 [ 508.366591][T20617] __dev_notify_flags+0x16d/0x310 [ 508.372243][T20617] netif_change_flags+0xe8/0x1a0 [ 508.377714][T20617] dev_change_flags+0x130/0x260 [ 508.383153][T20617] dev_ioctl+0x7b4/0x1150 [ 508.388050][T20617] sock_do_ioctl+0x23e/0x320 [ 508.393167][T20617] sock_ioctl+0x5c6/0x7f0 [ 508.398037][T20617] __se_sys_ioctl+0xfc/0x170 [ 508.403157][T20617] do_syscall_64+0x14d/0xf80 [ 508.408279][T20617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.414700][T20617] [ 508.414700][T20617] other info that might help us debug this: [ 508.414700][T20617] [ 508.424929][T20617] Chain exists of: [ 508.424929][T20617] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 508.424929][T20617] [ 508.438755][T20617] Possible unsafe locking scenario: [ 508.438755][T20617] [ 508.446214][T20617] CPU0 CPU1 [ 508.451577][T20617] ---- ---- [ 508.456938][T20617] lock(nr_neigh_list_lock); [ 508.461626][T20617] lock(&nr_node->node_lock); [ 508.468924][T20617] lock(nr_neigh_list_lock); [ 508.476127][T20617] lock(nr_node_list_lock); [ 508.480740][T20617] [ 508.480740][T20617] *** DEADLOCK *** [ 508.480740][T20617] [ 508.488879][T20617] 2 locks held by syz.0.4102/20617: [ 508.494072][T20617] #0: ffffffff8fbccfc8 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 508.502878][T20617] #1: ffffffff8fd49ad8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 508.512894][T20617] [ 508.512894][T20617] stack backtrace: [ 508.518795][T20617] CPU: 0 UID: 0 PID: 20617 Comm: syz.0.4102 Not tainted syzkaller #0 PREEMPT(full) [ 508.518814][T20617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 508.518823][T20617] Call Trace: [ 508.518832][T20617] [ 508.518840][T20617] dump_stack_lvl+0xe8/0x150 [ 508.518864][T20617] print_circular_bug+0x2e1/0x300 [ 508.518890][T20617] check_noncircular+0x12e/0x150 [ 508.518916][T20617] __lock_acquire+0x15a5/0x2cf0 [ 508.518940][T20617] ? __lock_acquire+0x6b5/0x2cf0 [ 508.518964][T20617] lock_acquire+0xf0/0x2e0 [ 508.518982][T20617] ? nr_rt_device_down+0xbe/0x860 [ 508.518999][T20617] ? nr_rt_device_down+0xbe/0x860 [ 508.519012][T20617] _raw_spin_lock_bh+0x36/0x50 [ 508.519034][T20617] ? nr_rt_device_down+0xbe/0x860 [ 508.519046][T20617] nr_rt_device_down+0xbe/0x860 [ 508.519059][T20617] ? nr_device_event+0x12f/0x150 [ 508.519086][T20617] nr_device_event+0x137/0x150 [ 508.519108][T20617] notifier_call_chain+0x1be/0x400 [ 508.519135][T20617] __dev_notify_flags+0x16d/0x310 [ 508.519160][T20617] ? __pfx___dev_notify_flags+0x10/0x10 [ 508.519182][T20617] ? __dev_change_flags+0x4c6/0x690 [ 508.519211][T20617] ? __pfx___dev_change_flags+0x10/0x10 [ 508.519236][T20617] ? full_name_hash+0x92/0xe0 [ 508.519259][T20617] netif_change_flags+0xe8/0x1a0 [ 508.519284][T20617] dev_change_flags+0x130/0x260 [ 508.519307][T20617] dev_ioctl+0x7b4/0x1150 [ 508.519328][T20617] sock_do_ioctl+0x23e/0x320 [ 508.519348][T20617] ? __pfx_sock_do_ioctl+0x10/0x10 [ 508.519364][T20617] ? do_futex+0x395/0x420 [ 508.519420][T20617] sock_ioctl+0x5c6/0x7f0 [ 508.519437][T20617] ? __pfx_sock_ioctl+0x10/0x10 [ 508.519454][T20617] ? __fget_files+0x2a/0x420 [ 508.519480][T20617] ? __fget_files+0x3a0/0x420 [ 508.519502][T20617] ? __fget_files+0x2a/0x420 [ 508.519525][T20617] ? bpf_lsm_file_ioctl+0x9/0x20 [ 508.519544][T20617] ? __pfx_sock_ioctl+0x10/0x10 [ 508.519560][T20617] __se_sys_ioctl+0xfc/0x170 [ 508.519578][T20617] do_syscall_64+0x14d/0xf80 [ 508.519591][T20617] ? trace_irq_disable+0x3b/0x150 [ 508.519621][T20617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.519636][T20617] ? clear_bhb_loop+0x40/0x90 [ 508.519653][T20617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.519668][T20617] RIP: 0033:0x7fdad059c799 [ 508.519684][T20617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.519699][T20617] RSP: 002b:00007fdad1497028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 508.519716][T20617] RAX: ffffffffffffffda RBX: 00007fdad0816180 RCX: 00007fdad059c799 [ 508.519728][T20617] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000005 [ 508.519738][T20617] RBP: 00007fdad0632c99 R08: 0000000000000000 R09: 0000000000000000 [ 508.519748][T20617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 508.519758][T20617] R13: 00007fdad0816218 R14: 00007fdad0816180 R15: 00007ffe2c739738 [ 508.519776][T20617] [ 508.816133][T20608] netlink: 'syz.1.4103': attribute type 1 has an invalid length. [ 508.824352][T20608] __nla_validate_parse: 2 callbacks suppressed [ 508.824369][T20608] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4103'. [ 512.222065][ T2017] block nbd4: Possible stuck request ffff888026508000: control (read@0,1024B). Runtime 270 seconds [ 512.232884][ T2017] block nbd4: Possible stuck request ffff888026508200: control (read@1024,1024B). Runtime 270 seconds [ 512.243916][ T2017] block nbd4: Possible stuck request ffff888026508400: control (read@2048,1024B). Runtime 270 seconds [ 512.255427][ T2017] block nbd4: Possible stuck request ffff888026508600: control (read@3072,1024B). Runtime 270 seconds [ 513.661531][T17617] Bluetooth: hci4: command 0x0406 tx timeout