last executing test programs: 1m30.460967514s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 1m15.498408347s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 1m0.153393463s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 45.509442468s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 30.995621853s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 17.459265509s ago: executing program 2 (id=2444): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {}, [@FRA_FLOW={0x8, 0xb, 0x17}]}, 0x24}, 0x1, 0x700, 0x0, 0x7000000}, 0x0) 17.424810536s ago: executing program 3 (id=1399): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x29, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) syz_emit_ethernet(0x4e, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0086dd60000000000000bbff020000000000001cd33320cf00000000000000018400907800060000200100"/78], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500d285d1000000bf09000000000000550901000000000095000000000000000000000000000000b7020000000000008500000000000000b70095000000000000004db68f2c672e1b3807a7319d7e15630fa5e72e89d2db078dc09c9b922c2c6f019210ee9048ade2a61c6a57acdd32b8dba9c2a066d89a2519"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$key(0xf, 0x3, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x12, 0xff, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r5, 0x8982, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f00000001c0)={0x1d, r7}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r6, 0x6b, 0x4, &(0x7f0000000240)=0x1, 0x4) sendmsg$can_j1939(r6, &(0x7f0000000080)={&(0x7f0000000200), 0x18, &(0x7f0000000340)={&(0x7f00000000c0)="10", 0x1}}, 0x0) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x142800) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021000000c00000000000000000000005900e6f9a7fe6b78bf70470001000000010015004e220000070019000000000002004e216401010000000000000000000a004e220000002f00000000000000000000ffffac1414bb0500000000000000"], 0x60}}, 0x8000) r8 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="310000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a01010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e206401010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000657eac685c678902e30d749c0f9bc49190a5ab9f7b9e59b30e7bf60a2f7fd90063ac457c1a42f13792d2a066bd9cc879342d3b5e9567c418da19fcd1ede8c584454c25c91066df58a2dc5a82350b2a58"], 0x490) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000700)={0x2, &(0x7f0000000000)=[{0x4}, {0x6}]}, 0x10) 17.414556915s ago: executing program 2 (id=2445): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80003, 0x6b) r1 = socket(0x200000000000011, 0x3, 0x0) ioctl$FIOCLEX(r1, 0x5451) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname(r2, 0x0, 0x0) bind$packet(r1, &(0x7f0000000240), 0x14) getsockname$packet(r1, &(0x7f00000022c0)={0x11, 0x0, 0x0}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000008c0)=ANY=[@ANYBLOB="e00100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="9101000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r3, @ANYBLOB="a4011880740001801400040023cdf344594605d4ae594be7eadc5c47050006000800000014000500c4c9391ca90d60af690fd96fd4b7edb20800010009000000140005001cbae6056282a410243d2685031e7a6508000100ff00000014000500efaf8e806c0913c3daf5e9a4d2df4d9c0500020000000000340001800500060005000000080001000300000005000600010000000d0002004026247d2d40212a0000000008000100000400006c0001800500060000000000140005008e8ba4a2434b3dd0ca408a191c4e6f3d14000500d6fbc93881c7181fff86a75736bd567d0800010003000084304be3000000000014000500e6f914b13e94fb06a05add4ff1ef42ff140004000ab6f515c19e4d7dfa464b86d9edee858c00018014000400d773fb7a4aa89c23b19a6bca9ea3cc1a140005000832865efb22587f98b58c5a3d701b99140004009164bca070b3292496ced90c21213b5f140005004a50d27eadccea82d1714e3e3b37d62f140004006f62359f63f1cc179a90f9e821d654c808000100feffffff14000500a9a61a1b8e09b0bd196c14da4e40b0dd0500020000000000686d697d7684a46328b387092cc05bfb9ab563b82cca61d450a15914063dfb57c922abbb592a71f5546be641a65595ee4890228985a81aabb73adfcce0871ac93d2b2cd3f9fa661f4da7076d74b7050493b39f958b828b11c3d7316cc7990ec7b2db18dbb986531a713a586960ae16abccda4a3263071cd738b8cd1cabac4364a976bc223d9e8df1568313c099c5136e5cce80bb17f7926bca87d18734f3f34f5f75fcb5db31f18d33631f6e234c717f7ee0fcd2be98e1f7be447835d7354c03764509930abbf3d6385d8ac3f36da6b5a44308f53c"], 0x1e0}}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000180)={0xfffffffe, {{0xa, 0x4e24, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x88) r4 = socket$key(0xf, 0x3, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB='\x00'], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{r7}, &(0x7f0000000780), &(0x7f00000007c0)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r8}, 0x10) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a090000000000000000000200000009000200737966310000000008000440000000000900010073797a300000000008000340000000011400000011"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000240)={0x0, 0x68, &(0x7f0000000000)={&(0x7f0000001940)=ANY=[@ANYBLOB="140000001000010000000000e80000000000000a50000000140a09000000000000000000020000000900020073797a3100000000080004400000000f0900010073797a30000000000800034000000001"], 0x64}}, 0x0) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000980)={'wg2\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="0b031407e0ff640f0200475400f6a13bb1000e00080008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r10}, 0x14) recvmmsg(r4, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0216000002"], 0x10}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 16.075798235s ago: executing program 2 (id=2449): socket(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x19, 0x4, 0x4, 0x9, 0x0, 0x1}, 0x48) socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x801, 0x84) socket$inet(0x2, 0x80001, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYBLOB="4c000000100001040000006c0000000000000000", @ANYRES32=0x0, @ANYBLOB="93630100200501001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3], 0x4c}}, 0x0) 12.655737849s ago: executing program 2 (id=2456): socket$nl_audit(0x10, 0x3, 0x9) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@ipv6_newnexthop={0x30, 0x68, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xe0ff}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x5}, @NHA_ENCAP={0x8, 0x8, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x4}}, @NHA_OIF={0x8, 0x5, r1}]}, 0x30}}, 0x0) 12.467774805s ago: executing program 2 (id=2459): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0xa}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x81c, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @multicast1}, {0x0, 0x88f7, 0x8}}}}}}, 0x2e) 10.638858754s ago: executing program 2 (id=2467): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x30000000}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfe00, 0xa0}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x9a02fff0}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2.604207594s ago: executing program 4 (id=2520): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, [@sadb_spirange={0x2, 0x18}]}, 0x20}}, 0x3000000) 2.439579731s ago: executing program 4 (id=2521): bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-512-generic\x00'}, 0x58) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x74) r1 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000800)={{{@in6=@private0, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000900)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) r4 = accept4$nfc_llcp(r0, &(0x7f00000009c0), &(0x7f0000000a40)=0x60, 0x80000) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r7 = openat$cgroup_ro(r6, &(0x7f0000000080)='rdma.current\x00', 0x275a, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r9, 0x108d45d223d353fb}, 0x14}}, 0x0) r10 = getpid() r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r13 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r12, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r13}}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000180)=0x0) r15 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000001c0)='ns/user\x00') sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x144, r9, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r10}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r13}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r14}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x3}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r15}}]}, 0x144}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) r16 = socket$netlink(0x10, 0x3, 0x0) r17 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r16, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r18}, @nested={0xb, 0x0, 0x0, 0x1, [@generic="976b6408686030"]}]}, 0x24}], 0x1}, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000a80)={0x0, 0x0, 0x0}, &(0x7f0000000ac0)=0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000d40)=[{{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000140)="97322ea628a37a62a1bcc1496ccc27ab02a20efdb91241283abbda05b634361eb7d6e105cef7f1b9e056149eae8c3f45a1d7c82fd337e5c0cdd8af4d81eb828bac25e5052460c472badbf132fdce17d8c0b838c26fa7bb945f9b2fcd27b580c16cc6d272f8c83f7f6122016dfcdd898780b5c2e3618d4a6f03a65b30b70724012ca0646e847eac66", 0x88}, {&(0x7f0000000200)="0b8405ae9b098472d23974693d51bc5ab437b6b92b2c95a0ab24020a77780b8e85ee530d505874d8387165a4c492cb92", 0x30}, {&(0x7f0000000240)="bd44eb4bb8e2ba10337cb563a56fcde8d140c7c7a13f1825bf5ee19d186e19a1bcaae06452288e49cc5e8782c370e8bb2189ccc5f55915189cf1a0447f4e51116d667611b27325f12dc0879ec0a1285c5ee00a5338aa7049aca2c03f4f7b54c9cdeadaa343b0eea137143ff65a3cf0a8de832d72257c2b24a21ac5b5c00bb93e3f73561e5bfa10300adf114ff69b8cc9d0c073caa612f8a2fdd729cf3baf59ec7a0f7cc2969afea3307ecac9187bae80f91d5c43c70b66d7a22b0e766246c17860d42eb539ec555e", 0xc8}, {&(0x7f0000000340)="a482c6d7a2042bd526e08c6761df78c72b459e10d4c843641dd7f42fefa07ce5f38f226d8863ea0654ea0f9c09d491260fe273a0ca46509070e851fe61363314d08170377539444e4e6c543b4b5ed5f503dd34991a0471e62c2f90cd3d77324dac9bed1113a5fdfa89eacb1b5c697ec6b1bfe274b9", 0x75}, {&(0x7f00000003c0)="4ecbd78bb64f0c1c1e8ca8ca478284a4191dc16a681b50fec3621763fdd7822790a8027822ab3e96ed1b6106f73f00198d34", 0x32}, {&(0x7f0000000400)="6b8ebda30e6edd02b0bbc5927480b02e594a3e7e653f5c5ff600f1e3d034d1df3282a0977c09913a5268f3a270ceb572059e93ea18a87c81987db18bbf4fad40cb6a39a5cfcfafe49eb1f33d48950258918382231411d200bd01abf6e40d243b1fbd7724f104b1592db051bb2b05ec2bd39954b95e436d28ad88fc9cdf479ceb83001714c0b6d8ee4acfb1d9c7e2d7dc8935b4287dde512951c606535349de48d03ad9700038785b7665e4b3bdf0d2e8b2b848260e623947b60ef658ff6805377ac9efa860d3a3ca3ed1939b350ece26d4e28a5436ae3682095a7c0b863d3d307ae2d8afb6b270888b6dd0", 0xeb}, {&(0x7f0000000500)="d19ee5d0b4a3322f00353d9f4ac9cfc02838808cdcae5b3502c3a21f656bb5c357084af2108013f629fe8c7c80baec89984d1ff98fbeccb650c9c56c12a456f626ff9fb9216139a466f01a5cbb2c4ce1186115c5dee2656d71496b7320f53baef0e4540a6193e1bf788e68cc2418b974baa5735638432ece4f1274142007f0f53d2e1b300d6dc07ecd821aa17bf7cd23a8e902fd699069b830e838294a9237ddeacc694dc9308f6f37d20ba71379e42dba7a0897ac176e3e57b1fe807b3f3fa9a8cee646de5c36d8da7c874b8cc53f2452b1617ae48ec4", 0xd7}, {&(0x7f0000000600)="8b", 0x1}, {&(0x7f0000000640)="4d2e57a5b35fbc7ecbce5c06b545267dabd217a2b7faf26dc8d6787cd39aca645c849e74638fb25920ed27aaccdabc3cb037233074dad392d7cc4a04a624cc79599cfea06bce39779b6d48a7c19ca94f36d01fc08710a3d06288b02c06bfcb4c92783fe8593c171c6797fdd24e69862f65c15f41509d7d83799ca23d7242ec642fc503c4a0abb2fa446c65b14a85005503779a5b7211ae6f02bfc229492d5f98996aa213f0b1d59d828a2d461365f7f13bc2d46fb1bcc8897652b81fea0d43ebc68296ad8895e78238e639c965", 0xcd}], 0x9, &(0x7f0000000c00)=[@rights={{0x2c, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r1, r2, r3}}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r4, r0]}}, @cred={{0x1c, 0x1, 0x2, {r14, r18, r19}}}, @rights={{0x14, 0x1, 0x1, [r8]}}, @rights={{0x24, 0x1, 0x1, [r0, r20, r0, r0, r0]}}, @rights={{0x30, 0x1, 0x1, [r0, 0xffffffffffffffff, r0, r0, 0xffffffffffffffff, r0, r0, r0]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r0, r0, r0, r0]}}], 0x128, 0x1}}], 0x1, 0x200088c0) 1.808676141s ago: executing program 0 (id=2524): syz_emit_ethernet(0x7e, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd602e5cea004889ff20010000000000000000000000000002ff028dff000000000000000000000001000400"], 0x0) 1.649412951s ago: executing program 0 (id=2526): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001cc0)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0xfecc) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x6, 0x6, 0x8}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}]}, &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='fib6_table_lookup\x00', r3}, 0x10) r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000000)="fc0000001a000708ab092500090007000aab0700a90100001d6051932100018010000000090000000000ffff00039815fa2c1ec28656aaa79bb94b46fe000000bc00030005000000140000270400117c22ebc205214000000000008935d0730206001720d7d5bbc91a3e3280775e9ddefd5a32e280fc83ab820d9473decc9204d287f605f7029ddef2fe082038f4f8b29d3ef3d92c83170c5bba4a46d284a710af333ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd1a6b567b4d5715587e658a1ad0a4f01731d05b0310b0041f2d48a99c03f080548deac270e33429fd3000175e63fb8d38a87041bf29e", 0xfc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r5, 0x11c, 0x4, 0x0, &(0x7f00000000c0)) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x94, 0x4, "00cc"}]}}}], 0x18}, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x4c}}, 0x0) 1.492034302s ago: executing program 0 (id=2527): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800060000000000000000000000000085000000a000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.398287846s ago: executing program 4 (id=2529): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 1.357242955s ago: executing program 0 (id=2530): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) getsockopt$sock_buf(r1, 0x1, 0x3b, 0x0, &(0x7f0000000140)) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@deltaction={0x24, 0x31, 0x34eeeaa6bdafa981, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}]}, 0x24}}, 0x0) 1.126336678s ago: executing program 0 (id=2531): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) accept4(r0, &(0x7f00000000c0)=@in={0x2, 0x0, @loopback}, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) syz_80211_inject_frame(0x0, &(0x7f0000000140)=@data_frame={@a_msdu=@type00={{0x0, 0x2, 0x8}, {}, @broadcast, @device_a, @from_mac=@broadcast, {}, "", @value}, @random="d2e19a5c24a93497d82c0c7385ab"}, 0x28) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800460000200000000000119078000008907874cdcdbe83166749fe7a6d55e3d0ea702de2a283a22170f5e8705e8f101918f818764b996130835bfd3f5fa8298604a99a89dd892c698ae6d72506a0c7932aed96c21b520a330e953b7415777bf851290973f954549eead8604ec08047ead0b820f3b3b877662793c7c105956970abe131323abe3e629d1d195144f206ccc3c33e9c01de25433bea16f682c59864a6f057943b5a61f62a6601a81931e42dd6331f8d728bca6a870ef393f6e4517a337bab88c41113375ce2ccc5531036653772521e3ae45562308f39457f2d0c95e0243ffef72f366d621728ff985cbfaf5474f26f4bb9f5f0b10510981fc0810000000000000000000000000000738d1446ded87d59d47c817954929f9f5137f498e6b6cb578b3a51"], 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000580)=@data_frame={@a_msdu=@type11={{0x0, 0x2, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1}, {0x3}, @device_a, @device_a, @initial, {0x3, 0x6}, @broadcast}, @a_msdu=[{@device_a, @device_b, 0x4a, "3300629efba888e074692aedd7fb01e1be452f54c111a09c5dd1301f3a2932ccd35814f4035d8fb4c0cbf6c99576dfbc327572070ae362a101d579f61ea3df08401ae3a5d0dc376ea076"}, {@device_a, @broadcast}, {@broadcast, @device_a, 0xa1, "545364cde8e6a73b634db4f49f7c83431713c915add9c3f7ba07fa887e6fba1de096ed8a631a63e7e5f87d8f34a93307bb99cf3f58d7d74e838ca8860667683b5709057f8000328f1aad1dbee2aefe2a9bea250bc4aab9af198a498eba39b3d8c19ffc98a35085d40177c35e7d96cb5ae94f53b647a1d70f283e22440190604cc360b91bdd4059824b960b027507ecb47976b064b04be62a960d8b6606d6ab1a62"}, {@device_b, @device_a, 0x73, "568318e941c89767154a9b8ffd04dd4c0bb2c89c304548948041dfe7e176e011cffe043b45170d667aebdf10c47690e1513ee97c253304ce34177075548ac079d688d53a20759950dc50283211f3aff0b1f074ca3ab6a5d4ee9bbf39506539719082cca182c0dfd339056939d88be4eb545985"}, {@broadcast, @device_b, 0x44, "ce1d63978b214ebcde625172b11545345b5f64382e31aac84d1eae70834f3965ebf11bda071eb5ac3ba525acd460a8c2b59d72fbafa69e50345a0d0ab1b9324c4b53f58a"}]}, 0x20e) bind$inet(r1, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}}, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000140)=[{}, {0x5}]}) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f00000007c0)=ANY=[@ANYBLOB="383d20000802110000010802110000000802070000000000"], 0x18) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="100000000802110000010802110000000802110000002000000000000000002082848b960c121824"], 0x28) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 1.124913931s ago: executing program 4 (id=2532): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000a50000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}, 0x50) 1.090475825s ago: executing program 1 (id=2533): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x35}, [@ldst={0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x39) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000400)="08001efbb07d586e", 0x8}], 0x1, &(0x7f00000000c0)=[@ip_tos_int={{0x14}}], 0x4}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xc, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000153afba10241f3f8809ee50000000084fd000000bc588a178e93f4dbfc9e49a10000006110980000000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x0) (async) socketpair$unix(0x1, 0x0, 0x0, 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0xfffff00c}, {0x0, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10) (async) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000000c0), 0x3f, 0x0) (async) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000040)=@req3, 0x1c) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, &(0x7f0000000180), 0x4) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0xb, &(0x7f0000000140)=@framed={{}, [@exit, @ldst, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @tail_call]}, &(0x7f0000000440)='GPL\x00', 0x7}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x14, r6, 0x1}, 0x14}}, 0x0) (async) r7 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) (async) getsockname$packet(r7, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008600)=ANY=[@ANYBLOB="48000000100039040000000000000000000003e4", @ANYRES32=r8, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES16=r8], 0x48}}, 0x0) (async) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f0000000ac0)=r0, 0x4) (async) r10 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000140)={[{0x2d, 'rdma'}, {0x6, 'io'}]}, 0xa) (async) r11 = socket$unix(0x1, 0x2, 0x0) bind$unix(r11, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 938.400248ms ago: executing program 4 (id=2534): r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) unshare(0x2040400) socket$xdp(0x2c, 0x3, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) ppoll(&(0x7f0000000480)=[{r1}, {r0}, {r3}], 0x3, &(0x7f0000000100)={0x77359400}, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) 775.783983ms ago: executing program 1 (id=2535): bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x3d0, 0x1, 0xe66f, 0x2404, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5, 0x3}, 0x48) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, 0x0, &(0x7f0000000400)) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) sendmmsg$inet(r0, &(0x7f0000004a80)=[{{&(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x34}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @empty}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@cipso={0x86, 0xf, 0x3, [{0x1, 0x9, "72c7cf886addc7"}]}]}}}], 0x60}}, {{0x0, 0x0, 0x0}, 0x6400}, {{&(0x7f0000002740)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000002940)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x20000000) 689.109192ms ago: executing program 1 (id=2536): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007008100", @ANYRES32=r1, @ANYBLOB="000000000000000014001a80100005800c"], 0x34}}, 0x0) 508.538149ms ago: executing program 1 (id=2537): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b00)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x54583}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev}]}}}]}, 0x44}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000d40)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @empty}}}], 0x20, 0x900}}], 0x1, 0x0) 355.549076ms ago: executing program 0 (id=2538): bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-512-generic\x00'}, 0x58) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x74) r1 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000800)={{{@in6=@private0, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000900)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) r4 = accept4$nfc_llcp(r0, &(0x7f00000009c0), &(0x7f0000000a40)=0x60, 0x80000) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r7 = openat$cgroup_ro(r6, &(0x7f0000000080)='rdma.current\x00', 0x275a, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r9, 0x108d45d223d353fb}, 0x14}}, 0x0) r10 = getpid() r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r13 = gettid() sendmsg$DEVLINK_CMD_RELOAD(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r12, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r13}}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000180)=0x0) r15 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000001c0)='ns/user\x00') sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x144, r9, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r10}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r13}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r14}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x3}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r15}}]}, 0x144}, 0x1, 0x0, 0x0, 0x4000001}, 0x80) r16 = socket$netlink(0x10, 0x3, 0x0) r17 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r17, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r16, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)={0x24, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r18}, @nested={0xb, 0x0, 0x0, 0x1, [@generic="976b6408686030"]}]}, 0x24}], 0x1}, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000a80)={0x0, 0x0, 0x0}, &(0x7f0000000ac0)=0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000d40)=[{{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000140)="97322ea628a37a62a1bcc1496ccc27ab02a20efdb91241283abbda05b634361eb7d6e105cef7f1b9e056149eae8c3f45a1d7c82fd337e5c0cdd8af4d81eb828bac25e5052460c472badbf132fdce17d8c0b838c26fa7bb945f9b2fcd27b580c16cc6d272f8c83f7f6122016dfcdd898780b5c2e3618d4a6f03a65b30b70724012ca0646e847eac66", 0x88}, {&(0x7f0000000200)="0b8405ae9b098472d23974693d51bc5ab437b6b92b2c95a0ab24020a77780b8e85ee530d505874d8387165a4c492cb92", 0x30}, {&(0x7f0000000240)="bd44eb4bb8e2ba10337cb563a56fcde8d140c7c7a13f1825bf5ee19d186e19a1bcaae06452288e49cc5e8782c370e8bb2189ccc5f55915189cf1a0447f4e51116d667611b27325f12dc0879ec0a1285c5ee00a5338aa7049aca2c03f4f7b54c9cdeadaa343b0eea137143ff65a3cf0a8de832d72257c2b24a21ac5b5c00bb93e3f73561e5bfa10300adf114ff69b8cc9d0c073caa612f8a2fdd729cf3baf59ec7a0f7cc2969afea3307ecac9187bae80f91d5c43c70b66d7a22b0e766246c17860d42eb539ec555e", 0xc8}, {&(0x7f0000000340)="a482c6d7a2042bd526e08c6761df78c72b459e10d4c843641dd7f42fefa07ce5f38f226d8863ea0654ea0f9c09d491260fe273a0ca46509070e851fe61363314d08170377539444e4e6c543b4b5ed5f503dd34991a0471e62c2f90cd3d77324dac9bed1113a5fdfa89eacb1b5c697ec6b1bfe274b9", 0x75}, {&(0x7f00000003c0)="4ecbd78bb64f0c1c1e8ca8ca478284a4191dc16a681b50fec3621763fdd7822790a8027822ab3e96ed1b6106f73f00198d34", 0x32}, {&(0x7f0000000400)="6b8ebda30e6edd02b0bbc5927480b02e594a3e7e653f5c5ff600f1e3d034d1df3282a0977c09913a5268f3a270ceb572059e93ea18a87c81987db18bbf4fad40cb6a39a5cfcfafe49eb1f33d48950258918382231411d200bd01abf6e40d243b1fbd7724f104b1592db051bb2b05ec2bd39954b95e436d28ad88fc9cdf479ceb83001714c0b6d8ee4acfb1d9c7e2d7dc8935b4287dde512951c606535349de48d03ad9700038785b7665e4b3bdf0d2e8b2b848260e623947b60ef658ff6805377ac9efa860d3a3ca3ed1939b350ece26d4e28a5436ae3682095a7c0b863d3d307ae2d8afb6b270888b6dd0", 0xeb}, {&(0x7f0000000500)="d19ee5d0b4a3322f00353d9f4ac9cfc02838808cdcae5b3502c3a21f656bb5c357084af2108013f629fe8c7c80baec89984d1ff98fbeccb650c9c56c12a456f626ff9fb9216139a466f01a5cbb2c4ce1186115c5dee2656d71496b7320f53baef0e4540a6193e1bf788e68cc2418b974baa5735638432ece4f1274142007f0f53d2e1b300d6dc07ecd821aa17bf7cd23a8e902fd699069b830e838294a9237ddeacc694dc9308f6f37d20ba71379e42dba7a0897ac176e3e57b1fe807b3f3fa9a8cee646de5c36d8da7c874b8cc53f2452b1617ae48ec4", 0xd7}, {&(0x7f0000000600)="8b", 0x1}, {&(0x7f0000000640)="4d2e57a5b35fbc7ecbce5c06b545267dabd217a2b7faf26dc8d6787cd39aca645c849e74638fb25920ed27aaccdabc3cb037233074dad392d7cc4a04a624cc79599cfea06bce39779b6d48a7c19ca94f36d01fc08710a3d06288b02c06bfcb4c92783fe8593c171c6797fdd24e69862f65c15f41509d7d83799ca23d7242ec642fc503c4a0abb2fa446c65b14a85005503779a5b7211ae6f02bfc229492d5f98996aa213f0b1d59d828a2d461365f7f13bc2d46fb1bcc8897652b81fea0d43ebc68296ad8895e78238e639c965", 0xcd}], 0x9, &(0x7f0000000c00)=[@rights={{0x2c, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r1, r2, r3}}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r4, r0]}}, @cred={{0x1c, 0x1, 0x2, {r14, r18, r19}}}, @rights={{0x14, 0x1, 0x1, [r8]}}, @rights={{0x24, 0x1, 0x1, [r0, r20, r0, r0, r0]}}, @rights={{0x30, 0x1, 0x1, [r0, 0xffffffffffffffff, r0, r0, 0xffffffffffffffff, r0, r0, r0]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r0, r0, r0, r0]}}], 0x128, 0x1}}], 0x1, 0x200088c0) 258.465888ms ago: executing program 1 (id=2539): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="4d7e00c300000000000027000000040002"], 0x1c}, 0x4, 0x700000000000000}, 0x0) 96.136242ms ago: executing program 1 (id=2540): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r1, 0x111, 0x2, 0x0, 0x20000000) setsockopt$inet_int(r0, 0x0, 0x17, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x10, r5, 0x0) mmap(&(0x7f00004e7000/0x2000)=nil, 0x2000, 0x0, 0x13, r5, 0x0) mmap(&(0x7f0000b15000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0x581, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x46a02}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @sit={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_RELAY_PREFIXLEN={0x6, 0xe, 0x1000}, @IFLA_IPTUN_6RD_PREFIXLEN={0x6}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @remote}]}}}]}, 0x48}}, 0x0) 0s ago: executing program 4 (id=2541): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.empty_time\x00', 0x275a, 0x0) syz_emit_ethernet(0x242, &(0x7f00000006c0)=ANY=[@ANYBLOB="bbbbbbbbbbbb777de85bf4dd86dd60000000020c3afffe8000000000000000000000000000bbff020000000000000000000000000001860090780000000000000000000000000007a78ce54006598080a8030003004023493b87aafaffffffffffe8bf23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d00010000000500000000260004000018fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c4b927db4e2dce6f9829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3001d06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb81608240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000000000005e"], 0x0) socket(0xa, 0x1, 0x7f) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="01000000000000000009030000000c00050000000000000000000c0002000000000000000000040007800c000800000000000000000008000100000000004400078008000100", @ANYBLOB, @ANYRES32, @ANYBLOB="08000100", @ANYRES32], 0x90}}, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={@multicast2, @local}, 0xc) kernel console output (not intermixed with test programs): adv_slave_1 [ 237.275302][T10344] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.291558][T10344] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 237.303353][T10344] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.326101][T10344] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 237.340980][T10344] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.353730][T10344] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.369016][T10554] 8021q: adding VLAN 0 to HW filter on device team0 [ 237.411960][T10344] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.442427][T10344] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.462964][T10344] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.471727][T10344] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.540938][ T5151] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.548195][ T5151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 237.640409][ T5151] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.647669][ T5151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 237.951386][ T5787] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 237.987636][ T5787] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 238.043569][ T5103] Bluetooth: hci0: command tx timeout [ 238.067342][ T1066] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 238.083836][ T1066] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 238.636612][T10554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 238.660736][T10824] netlink: 'syz.1.1705': attribute type 1 has an invalid length. [ 238.692925][T10824] netlink: 616 bytes leftover after parsing attributes in process `syz.1.1705'. [ 238.740048][T10828] netlink: 'syz.2.1812': attribute type 55 has an invalid length. [ 238.826234][T10554] veth0_vlan: entered promiscuous mode [ 238.870614][T10554] veth1_vlan: entered promiscuous mode [ 238.997318][T10554] veth0_macvtap: entered promiscuous mode [ 239.047205][T10554] veth1_macvtap: entered promiscuous mode [ 239.111682][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 239.131663][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.154735][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 239.179147][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.189362][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 239.200287][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.211721][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 239.226054][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.240758][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 239.263197][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.284979][T10554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 239.334085][T10852] netlink: 'syz.0.1815': attribute type 10 has an invalid length. [ 239.405516][T10852] team0: Device hsr_slave_1 failed to register rx_handler [ 239.495025][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 239.532930][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.549950][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 239.577307][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.592555][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 239.613121][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.630612][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 239.644144][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.661738][T10554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 239.683734][T10554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.711319][T10554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 239.791129][T10554] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.794258][T10873] netlink: 'syz.2.1820': attribute type 1 has an invalid length. [ 239.809800][T10873] netlink: 612 bytes leftover after parsing attributes in process `syz.2.1820'. [ 239.814970][T10554] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.838612][T10554] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.849385][T10554] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.959660][T10852] syz.0.1815 (10852) used greatest stack depth: 17840 bytes left [ 240.077912][T10881] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1821'. [ 240.287007][ T1066] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 240.323701][ T1066] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.410774][ T1042] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 240.430280][T10889] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1823'. [ 240.457340][ T1042] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.798299][T10900] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1827'. [ 240.942085][T10696] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.020440][T10696] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.087536][T10696] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.161448][T10696] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.180890][T10919] netlink: 'syz.0.1831': attribute type 1 has an invalid length. [ 241.207420][T10919] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.1831'. [ 241.312901][T10927] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1832'. [ 241.356589][T10932] netlink: 'syz.1.1834': attribute type 1 has an invalid length. [ 241.426595][T10554] syz-executor (10554) used greatest stack depth: 17136 bytes left [ 241.718677][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.137372][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.291921][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.418420][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.800051][ T12] bridge_slave_1: left allmulticast mode [ 242.826800][ T12] bridge_slave_1: left promiscuous mode [ 242.847648][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.884027][ T12] bridge_slave_0: left allmulticast mode [ 242.898405][ T12] bridge_slave_0: left promiscuous mode [ 242.912218][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.935398][T10972] netlink: 276 bytes leftover after parsing attributes in process `syz.1.1845'. [ 242.954006][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 242.968209][ T5109] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 242.979005][ T5109] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 242.988688][ T5109] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 242.999262][ T5109] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 243.007507][ T5109] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 243.883427][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.896876][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 243.910028][ T12] bond0 (unregistering): Released all slaves [ 243.927998][T10968] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.957974][T10988] netlink: 'syz.1.1847': attribute type 44 has an invalid length. [ 244.012844][T10968] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.096642][T10985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.106129][T10985] team0: Port device bond0 added [ 244.114826][T10992] netlink: 'syz.2.1848': attribute type 1 has an invalid length. [ 244.150801][T10992] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.1848'. [ 244.317390][T10968] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.343098][T11012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 244.371474][T11012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 244.415546][T11010] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 244.446994][T10968] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.476552][T11013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 244.512551][T11012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 244.587055][T11016] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1855'. [ 244.617842][T11016] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1855'. [ 244.728698][ T12] hsr_slave_0: left promiscuous mode [ 244.751515][ T12] hsr_slave_1: left promiscuous mode [ 244.769910][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 244.793869][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 244.818311][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 244.829278][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 244.881865][ T12] veth1_macvtap: left promiscuous mode [ 244.891606][ T12] veth0_macvtap: left promiscuous mode [ 244.901326][ T12] veth1_vlan: left promiscuous mode [ 244.910004][ T12] veth0_vlan: left promiscuous mode [ 245.072955][ T5103] Bluetooth: hci0: command tx timeout [ 245.445590][T11040] netlink: 'syz.2.1857': attribute type 5 has an invalid length. [ 245.756525][ T12] team0 (unregistering): Port device team_slave_1 removed [ 245.822282][ T12] team0 (unregistering): Port device team_slave_0 removed [ 246.260730][T11016] mac80211_hwsim hwsim29 wlan0: entered promiscuous mode [ 246.268375][T11016] macvlan2: entered promiscuous mode [ 246.279894][T11016] mac80211_hwsim hwsim29 wlan0: left promiscuous mode [ 246.348716][T11053] __nla_validate_parse: 1 callbacks suppressed [ 246.348736][T11053] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1860'. [ 246.373483][T11052] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1860'. [ 246.491773][T10968] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.569950][T10968] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.709901][T10968] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.761855][T11072] netlink: 'syz.2.1864': attribute type 1 has an invalid length. [ 246.773020][T11072] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.1864'. [ 246.878275][T10968] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.090155][T11089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.116781][T11084] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.160802][ T5109] Bluetooth: hci0: command tx timeout [ 247.213503][T11084] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.225778][T11095] ɶƣ0GCTw: entered promiscuous mode [ 247.268820][T10974] chnl_net:caif_netlink_parms(): no params data found [ 247.290471][T11084] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.512286][T10974] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.521566][T10974] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.555721][T10974] bridge_slave_0: entered allmulticast mode [ 247.580462][T10974] bridge_slave_0: entered promiscuous mode [ 247.653481][T10974] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.672235][T10974] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.688891][T10974] bridge_slave_1: entered allmulticast mode [ 247.701008][T11113] sctp: [Deprecated]: syz.2.1872 (pid 11113) Use of struct sctp_assoc_value in delayed_ack socket option. [ 247.701008][T11113] Use struct sctp_sack_info instead [ 247.703585][T10974] bridge_slave_1: entered promiscuous mode [ 247.747418][T11111] vcan0: entered promiscuous mode [ 247.753299][T11111] vlan2: entered promiscuous mode [ 247.760744][T11111] vcan0: left promiscuous mode [ 247.837549][T10974] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 247.858069][T10974] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 247.875875][ T5109] Bluetooth: hci4: command 0x0405 tx timeout [ 248.126644][T10974] team0: Port device team_slave_0 added [ 248.159382][T11128] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1875'. [ 248.188461][T11128] syz_tun: entered promiscuous mode [ 248.213673][T11128] macsec1: entered promiscuous mode [ 248.228382][T11128] macsec1: entered allmulticast mode [ 248.237198][T11128] syz_tun: entered allmulticast mode [ 248.253601][T11131] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.308845][T10974] team0: Port device team_slave_1 added [ 248.436252][T11131] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.511930][T11155] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1879'. [ 248.533822][T10974] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 248.540813][T10974] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 248.606264][T10974] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 248.609826][T11160] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1882'. [ 248.650148][T11131] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.699012][T11155] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 248.760598][T10974] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 248.779923][T10974] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 248.815971][T11166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 248.830285][T11166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 248.843316][T10974] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 248.862240][T11131] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.908368][T11166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 248.980122][T11166] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 249.015124][T11173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 249.118302][T10974] hsr_slave_0: entered promiscuous mode [ 249.131823][T10974] hsr_slave_1: entered promiscuous mode [ 249.147735][T10974] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 249.162719][T10974] Cannot create hsr debugfs directory [ 249.232905][ T5103] Bluetooth: hci0: command tx timeout [ 249.305327][T11131] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.380518][T11131] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.443245][T11131] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.508684][T11131] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 249.577047][T11186] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1889'. [ 249.980705][T11201] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1893'. [ 250.025189][T11201] netlink: 'syz.1.1893': attribute type 1 has an invalid length. [ 250.111848][T11209] netlink: 'syz.4.1894': attribute type 1 has an invalid length. [ 250.139239][T11209] netlink: 612 bytes leftover after parsing attributes in process `syz.4.1894'. [ 250.389951][T11215] netlink: 'syz.4.1896': attribute type 3 has an invalid length. [ 250.401075][T11217] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1895'. [ 250.634657][T11213] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 250.982193][T10974] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 251.050930][T11235] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.114081][T10974] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 251.186122][T11235] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.223574][T11254] x_tables: duplicate underflow at hook 1 [ 251.247158][T10974] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 251.297494][T10974] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 251.312890][ T5103] Bluetooth: hci0: command tx timeout [ 251.353399][T11240] __nla_validate_parse: 2 callbacks suppressed [ 251.353421][T11240] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1902'. [ 251.389762][T11235] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.414807][T11259] (unnamed net_device) (uninitialized): (slave tunl0): Device is not bonding slave [ 251.430551][T11259] (unnamed net_device) (uninitialized): option active_slave: invalid value (tunl0) [ 251.451416][T11235] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.467422][T11264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1906'. [ 251.604516][T11266] syzkaller1: entered promiscuous mode [ 251.610042][T11266] syzkaller1: entered allmulticast mode [ 251.848599][T10974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.916677][T10974] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.926941][T11279] netlink: 'syz.2.1913': attribute type 11 has an invalid length. [ 251.966265][ T785] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.973487][ T785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.989244][T11283] x_tables: duplicate underflow at hook 1 [ 252.024347][ T785] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.031518][ T785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.176660][T10974] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 252.243472][T11296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1918'. [ 252.442460][T11303] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1919'. [ 252.464751][T11303] bridge0: port 2(bridge_slave_1) entered disabled state [ 252.472759][T11303] bridge0: port 1(bridge_slave_0) entered disabled state [ 252.695623][T10974] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 252.961447][T10974] veth0_vlan: entered promiscuous mode [ 253.010381][T10974] veth1_vlan: entered promiscuous mode [ 253.103989][T10974] veth0_macvtap: entered promiscuous mode [ 253.127198][T10974] veth1_macvtap: entered promiscuous mode [ 253.188350][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 253.219902][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.233059][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 253.253692][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.274309][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 253.286569][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.306839][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 253.319435][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.330245][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 253.341640][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.358782][T10974] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 253.379522][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 253.391140][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.413217][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 253.456865][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.475510][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 253.490249][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.500559][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 253.511718][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.522901][T10974] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 253.534851][T10974] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 253.551364][T10974] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 253.575052][T10974] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.598562][T10974] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.623248][T10974] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.631999][T10974] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 253.825110][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 253.900229][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 253.931270][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 254.030765][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 254.058226][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 254.490134][T11376] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1934'. [ 254.788446][T11394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 254.874317][T11397] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 254.895082][T11394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 255.071336][T11411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1942'. [ 255.093037][T11411] block nbd0: not configured, cannot reconfigure [ 255.650497][T11444] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1948'. [ 255.768983][T11235] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.821430][T11451] netlink: 'syz.2.1950': attribute type 1 has an invalid length. [ 255.891578][T11235] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.927407][T11235] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 256.007431][T11235] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 256.053986][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.067558][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.104150][T11468] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1953'. [ 256.133555][T11462] netlink: 872 bytes leftover after parsing attributes in process `syz.1.1954'. [ 256.177731][T11462] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.185368][T11462] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.193007][T11462] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.200206][T11462] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.303518][T11477] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1956'. [ 256.586242][ T1066] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.913799][T11540] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.127269][ T1066] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.201918][T11540] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.283896][ T5098] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 258.300491][ T5098] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 258.312721][ T5098] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 258.341344][ T5098] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 258.364910][ T5098] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 258.375834][ T5098] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 258.466769][ T1066] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.526398][T11540] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.639843][ T1066] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.701184][T11540] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.730337][T11572] __nla_validate_parse: 1 callbacks suppressed [ 258.730364][T11572] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1970'. [ 259.099516][T11590] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1975'. [ 259.132511][T11540] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 259.157507][T11540] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 259.167728][ T1066] bridge_slave_1: left allmulticast mode [ 259.177608][ T1066] bridge_slave_1: left promiscuous mode [ 259.185333][ T1066] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.199557][ T1066] bridge_slave_0: left allmulticast mode [ 259.205978][ T1066] bridge_slave_0: left promiscuous mode [ 259.211847][ T1066] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.883868][ T5109] Bluetooth: hci1: command 0x0405 tx timeout [ 260.007065][ T1066] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 260.021046][ T1066] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 260.049979][ T1066] bond0 (unregistering): Released all slaves [ 260.089854][T11540] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.179150][T11540] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.217772][T11622] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1980'. [ 260.378659][T11624] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 260.443255][ T5103] Bluetooth: hci0: command tx timeout [ 260.680723][ T1066] hsr_slave_0: left promiscuous mode [ 260.722688][ T1066] hsr_slave_1: left promiscuous mode [ 260.769134][ T1066] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 260.779013][T11647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1985'. [ 260.801087][ T1066] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 260.825459][ T1066] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.831648][T11651] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1985'. [ 260.847069][ T1066] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 260.899663][ T1066] veth1_macvtap: left promiscuous mode [ 260.908314][ T1066] veth0_macvtap: left promiscuous mode [ 260.921024][ T1066] veth1_vlan: left promiscuous mode [ 260.928415][ T1066] veth0_vlan: left promiscuous mode [ 261.120925][T11666] netlink: 'syz.2.1988': attribute type 3 has an invalid length. [ 261.132825][T11666] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1988'. [ 261.152422][T11666] netlink: 'syz.2.1988': attribute type 3 has an invalid length. [ 261.174522][T11666] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1988'. [ 261.691221][ T1066] team0 (unregistering): Port device team_slave_1 removed [ 261.737274][ T1066] team0 (unregistering): Port device team_slave_0 removed [ 262.132088][T11646] ɶƣ0GCTw: entered promiscuous mode [ 262.139833][T11647] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1985'. [ 262.238305][T11560] chnl_net:caif_netlink_parms(): no params data found [ 262.268036][T11675] netlink: 'syz.0.1989': attribute type 10 has an invalid length. [ 262.292531][T11675] team0: Port device dummy0 added [ 262.332287][T11673] netlink: 'syz.4.1990': attribute type 8 has an invalid length. [ 262.441336][T11680] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 262.533362][ T5103] Bluetooth: hci0: command tx timeout [ 262.598017][T11680] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 262.817032][T11705] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1996'. [ 262.991831][T11680] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.079212][T11560] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.089515][T11560] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.097208][T11560] bridge_slave_0: entered allmulticast mode [ 263.106690][T11560] bridge_slave_0: entered promiscuous mode [ 263.141258][T11680] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.179005][T11560] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.187314][T11560] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.202421][T11560] bridge_slave_1: entered allmulticast mode [ 263.212289][T11560] bridge_slave_1: entered promiscuous mode [ 263.304492][T11560] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 263.365238][T11560] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 263.455814][T11680] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.482200][T11680] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.499670][T11560] team0: Port device team_slave_0 added [ 263.530726][T11680] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.561524][T11680] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.604814][T11560] team0: Port device team_slave_1 added [ 263.627386][T11727] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2000'. [ 263.724601][T11560] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 263.738365][T11560] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.780473][T11560] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 263.825647][T11560] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 263.843050][T11560] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 263.843725][T11733] netlink: 'syz.1.2002': attribute type 1 has an invalid length. [ 263.923550][T11560] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 264.024092][T11737] netlink: 'syz.4.2003': attribute type 3 has an invalid length. [ 264.042772][T11737] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2003'. [ 264.062359][T11737] netlink: 'syz.4.2003': attribute type 3 has an invalid length. [ 264.080584][T11737] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2003'. [ 264.131608][T11560] hsr_slave_0: entered promiscuous mode [ 264.163838][T11560] hsr_slave_1: entered promiscuous mode [ 264.197979][T11560] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 264.229744][T11560] Cannot create hsr debugfs directory [ 264.593122][ T5103] Bluetooth: hci0: command tx timeout [ 264.641842][T11773] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.701672][T11778] FAULT_INJECTION: forcing a failure. [ 264.701672][T11778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 264.736860][T11778] CPU: 0 PID: 11778 Comm: syz.4.2013 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 264.747157][T11778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 264.757256][T11778] Call Trace: [ 264.760565][T11778] [ 264.763524][T11778] dump_stack_lvl+0x241/0x360 [ 264.768244][T11778] ? __pfx_dump_stack_lvl+0x10/0x10 [ 264.773483][T11778] ? __pfx__printk+0x10/0x10 [ 264.778107][T11778] ? __pfx_lock_release+0x10/0x10 [ 264.783181][T11778] should_fail_ex+0x3b0/0x4e0 [ 264.787915][T11778] _copy_from_user+0x2f/0xe0 [ 264.792546][T11778] copy_msghdr_from_user+0xae/0x680 [ 264.797785][T11778] ? __pfx___might_resched+0x10/0x10 [ 264.803117][T11778] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 264.808969][T11778] ? __might_fault+0xaa/0x120 [ 264.813696][T11778] do_recvmmsg+0x40f/0xae0 [ 264.818165][T11778] ? __pfx_lock_release+0x10/0x10 [ 264.823230][T11778] ? __pfx_do_recvmmsg+0x10/0x10 [ 264.828236][T11778] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 264.834169][T11778] ? ksys_write+0x23e/0x2c0 [ 264.838712][T11778] ? __pfx_lock_release+0x10/0x10 [ 264.843761][T11778] ? vfs_write+0x7c4/0xc90 [ 264.848192][T11778] ? __mutex_unlock_slowpath+0x21d/0x750 [ 264.853846][T11778] ? __fget_files+0x3f6/0x470 [ 264.858566][T11778] __x64_sys_recvmmsg+0x199/0x250 [ 264.863610][T11778] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 264.869174][T11778] ? do_syscall_64+0x100/0x230 [ 264.873953][T11778] ? do_syscall_64+0xb6/0x230 [ 264.878643][T11778] do_syscall_64+0xf3/0x230 [ 264.883155][T11778] ? clear_bhb_loop+0x35/0x90 [ 264.887847][T11778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.893761][T11778] RIP: 0033:0x7ff3d0975bd9 [ 264.898185][T11778] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 264.917801][T11778] RSP: 002b:00007ff3d1752048 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 264.926226][T11778] RAX: ffffffffffffffda RBX: 00007ff3d0b03f60 RCX: 00007ff3d0975bd9 [ 264.934208][T11778] RDX: 03ffffffffffff62 RSI: 00000000200005c0 RDI: 0000000000000007 [ 264.942182][T11778] RBP: 00007ff3d17520a0 R08: 0000000000000000 R09: 0000000000000000 [ 264.950270][T11778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 264.958248][T11778] R13: 000000000000004d R14: 00007ff3d0b03f60 R15: 00007fff2dd17178 [ 264.966241][T11778] [ 264.995458][T11783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.066262][T11773] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.122284][T11783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.172497][T11773] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.188948][T11783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.212153][T11783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 265.240940][T11792] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2018'. [ 265.404807][T11792] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2018'. [ 265.468619][T11773] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.685964][T11809] pim6reg: entered allmulticast mode [ 265.827187][T11803] pim6reg: left allmulticast mode [ 266.109690][T11773] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.138666][T11773] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.162367][T11560] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 266.189794][T11560] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 266.232512][T11773] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.251104][T11560] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 266.307483][T11773] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.354143][T11560] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 266.606929][T11849] netlink: 11 bytes leftover after parsing attributes in process `syz.2.2030'. [ 266.673027][ T5103] Bluetooth: hci0: command tx timeout [ 266.708673][T11560] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.787811][T11560] 8021q: adding VLAN 0 to HW filter on device team0 [ 266.799553][T11856] netlink: 'syz.0.2034': attribute type 1 has an invalid length. [ 266.829036][ T5148] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.836252][ T5148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 266.856777][T11858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 266.888146][ T5148] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.895381][ T5148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 266.918543][T11858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 267.059545][T11858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 267.426866][T11883] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.578613][T11560] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.604309][T11883] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.766228][T11883] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.804557][T11903] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2044'. [ 267.887107][T11883] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 268.029550][T11560] veth0_vlan: entered promiscuous mode [ 268.126538][T11560] veth1_vlan: entered promiscuous mode [ 268.239509][T11560] veth0_macvtap: entered promiscuous mode [ 268.268593][T11560] veth1_macvtap: entered promiscuous mode [ 268.340377][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 268.375041][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.400575][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 268.433191][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.450240][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 268.484727][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.501972][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 268.521171][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.540975][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 268.559924][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.582007][T11560] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 268.610763][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 268.634143][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.652206][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 268.674331][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.691617][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 268.728794][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.752842][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 268.765554][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.780301][T11560] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 268.799945][T11560] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 268.813135][T11560] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 268.896983][T11560] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.920541][T11560] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.951557][T11560] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.960821][T11560] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.044943][T11883] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.134473][T11883] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.241429][T11883] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.318637][T11883] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.373663][T11947] netlink: 184 bytes leftover after parsing attributes in process `syz.2.2054'. [ 269.390915][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 269.402851][T11947] netlink: 'syz.2.2054': attribute type 1 has an invalid length. [ 269.438053][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.523991][T11952] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 269.533080][ T5788] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 269.557978][ T5788] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.562163][T11958] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2058'. [ 269.585860][T11952] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 269.689408][T11956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 269.715126][T11952] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 270.128707][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 270.591378][T12017] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2070'. [ 270.609838][T12017] openvswitch: netlink: Tunnel attr 7 has unexpected len 4 expected 0 [ 271.196058][T12047] syz.4.2077[12047] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 271.199718][T12047] syz.4.2077[12047] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 271.269889][T12051] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.350660][T12051] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.448211][T12059] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.501938][T12051] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.537980][T12063] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2083'. [ 271.558790][T12063] 0X: renamed from caif0 [ 271.573530][T12063] 0X: entered allmulticast mode [ 271.578995][T12063] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 271.909457][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.995893][T12072] netlink: 55 bytes leftover after parsing attributes in process `syz.1.2085'. [ 272.589605][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.675784][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.742385][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.937331][T12108] netlink: 'syz.0.2087': attribute type 8 has an invalid length. [ 272.973970][T12108] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2087'. [ 272.995607][ T12] bridge_slave_1: left allmulticast mode [ 273.001305][ T12] bridge_slave_1: left promiscuous mode [ 273.019950][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.064811][T12116] netlink: 'syz.0.2087': attribute type 8 has an invalid length. [ 273.074557][ T12] bridge_slave_0: left allmulticast mode [ 273.090896][ T12] bridge_slave_0: left promiscuous mode [ 273.110267][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.130119][T12116] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2087'. [ 273.259685][T12129] netlink: 'syz.1.2093': attribute type 13 has an invalid length. [ 273.506087][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 273.516784][ T5109] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 273.526528][ T5109] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 273.536764][ T5109] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 273.546390][ T5109] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 273.553962][ T5109] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 273.940256][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 273.952196][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 273.968851][ T12] bond0 (unregistering): Released all slaves [ 274.089552][T12150] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2096'. [ 274.184845][T12152] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 274.236958][T12152] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 274.358909][T12158] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 274.414900][T12152] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 274.681119][ T12] hsr_slave_0: left promiscuous mode [ 274.688004][ T12] hsr_slave_1: left promiscuous mode [ 274.714372][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 274.722308][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 274.732993][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 274.741014][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 274.791757][ T12] veth1_macvtap: left promiscuous mode [ 274.798374][ T12] veth0_macvtap: left promiscuous mode [ 274.805966][ T12] veth1_vlan: left promiscuous mode [ 274.812181][ T12] veth0_vlan: left promiscuous mode [ 275.638710][ T5109] Bluetooth: hci0: command tx timeout [ 276.040778][T12200] netlink: 712 bytes leftover after parsing attributes in process `syz.0.2107'. [ 276.224724][T12202] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2108'. [ 276.241209][ T12] team0 (unregistering): Port device team_slave_1 removed [ 276.333547][ T12] team0 (unregistering): Port device team_slave_0 removed [ 277.370290][T12177] vlan2: entered promiscuous mode [ 277.392985][T12177] vlan2: entered allmulticast mode [ 277.713801][ T5109] Bluetooth: hci0: command tx timeout [ 277.861739][T12137] chnl_net:caif_netlink_parms(): no params data found [ 277.941249][T12229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.017009][T12229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.065359][T12225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2114'. [ 278.129362][T12229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.183753][T12229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.215014][T12242] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 278.420612][T12137] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.452976][T12137] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.479317][T12137] bridge_slave_0: entered allmulticast mode [ 278.508447][T12137] bridge_slave_0: entered promiscuous mode [ 278.557360][T12137] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.569217][T12137] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.578150][T12137] bridge_slave_1: entered allmulticast mode [ 278.587428][T12137] bridge_slave_1: entered promiscuous mode [ 278.627938][T12264] netlink: 'syz.4.2121': attribute type 1 has an invalid length. [ 278.636110][T12264] netlink: 612 bytes leftover after parsing attributes in process `syz.4.2121'. [ 278.697090][T12137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.727606][T12137] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 278.826024][T12137] team0: Port device team_slave_0 added [ 278.860654][T12137] team0: Port device team_slave_1 added [ 278.917492][T12137] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 278.934028][T12137] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 278.961374][T12137] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 278.976750][T12137] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 278.983941][T12137] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 279.022450][T12137] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 279.175802][T12137] hsr_slave_0: entered promiscuous mode [ 279.208525][T12137] hsr_slave_1: entered promiscuous mode [ 279.240993][T12137] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 279.258968][T12137] Cannot create hsr debugfs directory [ 279.478229][T12299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.532463][T12299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.639672][T12305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.658614][T12299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.710540][T12305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.796082][ T5109] Bluetooth: hci0: command tx timeout [ 279.858489][T12318] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2136'. [ 280.248078][T12333] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 280.421558][T12339] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2143'. [ 280.462774][T12337] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2142'. [ 280.570969][T12341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2144'. [ 280.876865][T12137] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 280.936939][T12137] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 280.980636][T12137] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 281.020972][T12137] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 281.044494][T12357] netlink: 'syz.0.2150': attribute type 5 has an invalid length. [ 281.335734][T12378] netlink: 'syz.1.2149': attribute type 4 has an invalid length. [ 281.445006][T12137] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.481807][T12137] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.519720][ T785] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.526939][ T785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.583458][ T785] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.590688][ T785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.874673][ T5103] Bluetooth: hci0: command tx timeout [ 282.040179][T12137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.214611][T12137] veth0_vlan: entered promiscuous mode [ 282.235241][T12137] veth1_vlan: entered promiscuous mode [ 282.311084][T12137] veth0_macvtap: entered promiscuous mode [ 282.360903][T12137] veth1_macvtap: entered promiscuous mode [ 282.417305][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 282.448497][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.481849][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 282.523152][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.536764][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 282.555047][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.578242][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 282.615494][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.638710][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 282.664630][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.696531][T12137] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.738814][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 282.756885][T12433] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2161'. [ 282.770405][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.786353][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 282.807653][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.847581][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 282.870856][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.890255][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 282.917680][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.940016][T12137] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 282.963473][T12137] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 282.988441][T12137] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 283.101210][T12137] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.145030][T12137] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.174793][T12137] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.202823][T12137] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.353197][T12447] Cannot find set identified by id 0 to match [ 283.540937][T12453] netlink: 'syz.0.2168': attribute type 4 has an invalid length. [ 283.646413][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.674605][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 283.700471][T12467] netlink: 3344 bytes leftover after parsing attributes in process `syz.1.2171'. [ 283.713662][ T5103] Bluetooth: hci2: command 0x0405 tx timeout [ 283.789710][T12469] xt_limit: Overflow, try lower: 0/0 [ 283.855756][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.882200][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 284.039347][T12486] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2176'. [ 284.232443][T12488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2178'. [ 284.255217][T12488] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.285703][T12488] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 284.297123][T12488] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 284.323292][T12488] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 284.455031][T12501] FAULT_INJECTION: forcing a failure. [ 284.455031][T12501] name failslab, interval 1, probability 0, space 0, times 0 [ 284.468153][T12501] CPU: 0 PID: 12501 Comm: syz.4.2180 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 284.478514][T12501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 284.488599][T12501] Call Trace: [ 284.491910][T12501] [ 284.494876][T12501] dump_stack_lvl+0x241/0x360 [ 284.499631][T12501] ? __pfx_dump_stack_lvl+0x10/0x10 [ 284.504868][T12501] ? __pfx__printk+0x10/0x10 [ 284.509510][T12501] should_fail_ex+0x3b0/0x4e0 [ 284.514242][T12501] ? skb_clone+0x20c/0x390 [ 284.518705][T12501] should_failslab+0x9/0x20 [ 284.523259][T12501] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 284.528698][T12501] skb_clone+0x20c/0x390 [ 284.532993][T12501] ? dev_queue_xmit_nit+0x220/0xc10 [ 284.538240][T12501] dev_queue_xmit_nit+0x419/0xc10 [ 284.543310][T12501] ? dev_queue_xmit_nit+0x2b/0xc10 [ 284.548477][T12501] dev_hard_start_xmit+0x15f/0x7e0 [ 284.553653][T12501] sch_direct_xmit+0x2b6/0x5f0 [ 284.558455][T12501] ? __pfx_sch_direct_xmit+0x10/0x10 [ 284.563766][T12501] __dev_queue_xmit+0x1d3f/0x3e90 [ 284.568866][T12501] ? netlink_unicast+0x7f0/0x990 [ 284.573815][T12501] ? ____sys_sendmsg+0x525/0x7d0 [ 284.578778][T12501] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.584863][T12501] ? __dev_queue_xmit+0x2da/0x3e90 [ 284.590019][T12501] ? __pfx___dev_queue_xmit+0x10/0x10 [ 284.595430][T12501] ? __copy_skb_header+0x437/0x5b0 [ 284.600581][T12501] ? __asan_memcpy+0x40/0x70 [ 284.605203][T12501] ? __copy_skb_header+0x437/0x5b0 [ 284.610337][T12501] ? __skb_clone+0x454/0x6c0 [ 284.614952][T12501] ? skb_clone+0x240/0x390 [ 284.619396][T12501] __netlink_deliver_tap+0x54d/0x7c0 [ 284.624711][T12501] ? netlink_deliver_tap+0x2e/0x1b0 [ 284.629923][T12501] netlink_deliver_tap+0x19d/0x1b0 [ 284.635077][T12501] netlink_sendskb+0x68/0x140 [ 284.639766][T12501] netlink_unicast+0x39d/0x990 [ 284.644541][T12501] ? __asan_memcpy+0x40/0x70 [ 284.649152][T12501] ? __pfx_netlink_unicast+0x10/0x10 [ 284.654463][T12501] netlink_rcv_skb+0x262/0x430 [ 284.659273][T12501] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 284.664746][T12501] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 284.670067][T12501] ? netlink_deliver_tap+0x2e/0x1b0 [ 284.675285][T12501] netlink_unicast+0x7f0/0x990 [ 284.680073][T12501] ? __pfx_netlink_unicast+0x10/0x10 [ 284.685454][T12501] ? __virt_addr_valid+0x183/0x520 [ 284.690603][T12501] ? __check_object_size+0x49c/0x900 [ 284.695927][T12501] ? bpf_lsm_netlink_send+0x9/0x10 [ 284.701153][T12501] netlink_sendmsg+0x8e4/0xcb0 [ 284.705941][T12501] ? __pfx_netlink_sendmsg+0x10/0x10 [ 284.711238][T12501] ? __import_iovec+0x536/0x820 [ 284.716096][T12501] ? aa_sock_msg_perm+0x91/0x160 [ 284.721050][T12501] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 284.726341][T12501] ? security_socket_sendmsg+0x87/0xb0 [ 284.731813][T12501] ? __pfx_netlink_sendmsg+0x10/0x10 [ 284.737132][T12501] __sock_sendmsg+0x221/0x270 [ 284.741841][T12501] ____sys_sendmsg+0x525/0x7d0 [ 284.746637][T12501] ? __pfx_____sys_sendmsg+0x10/0x10 [ 284.751987][T12501] __sys_sendmsg+0x2b0/0x3a0 [ 284.756597][T12501] ? __pfx___sys_sendmsg+0x10/0x10 [ 284.761725][T12501] ? vfs_write+0x7c4/0xc90 [ 284.766189][T12501] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 284.772543][T12501] ? do_syscall_64+0x100/0x230 [ 284.777320][T12501] ? do_syscall_64+0xb6/0x230 [ 284.782007][T12501] do_syscall_64+0xf3/0x230 [ 284.786520][T12501] ? clear_bhb_loop+0x35/0x90 [ 284.791212][T12501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.797229][T12501] RIP: 0033:0x7ff3d0975bd9 [ 284.801684][T12501] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 284.821312][T12501] RSP: 002b:00007ff3d1731048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 284.829769][T12501] RAX: ffffffffffffffda RBX: 00007ff3d0b04038 RCX: 00007ff3d0975bd9 [ 284.837759][T12501] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 284.845744][T12501] RBP: 00007ff3d17310a0 R08: 0000000000000000 R09: 0000000000000000 [ 284.853734][T12501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 284.861709][T12501] R13: 000000000000006e R14: 00007ff3d0b04038 R15: 00007fff2dd17178 [ 284.869707][T12501] [ 285.002946][T12511] netlink: 209848 bytes leftover after parsing attributes in process `syz.4.2184'. [ 285.024984][T12509] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2183'. [ 285.195926][T12522] macvlan5: entered promiscuous mode [ 285.211286][T12522] macvlan5: entered allmulticast mode [ 285.242201][T12522] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 285.284784][T12522] team0: Port device macvlan5 added [ 285.355336][T12529] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2188'. [ 285.381198][T12529] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2188'. [ 285.397825][T12534] netlink: 'syz.0.2189': attribute type 3 has an invalid length. [ 285.541793][T12542] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2192'. [ 285.839889][T12569] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2196'. [ 286.489282][ T1042] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.723252][ T1042] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.789282][T12622] netlink: 'syz.2.2208': attribute type 4 has an invalid length. [ 287.816066][T12622] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2208'. [ 287.909085][T12632] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 287.921083][ T1042] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.005156][T12632] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2209'. [ 288.098997][ T5103] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 288.129312][ T5103] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 288.138091][ T5103] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 288.190178][ T5103] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 288.199437][ T5103] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 288.208077][ T5103] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 288.244573][ T1042] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.660064][ T1042] bridge_slave_1: left allmulticast mode [ 288.665914][ T1042] bridge_slave_1: left promiscuous mode [ 288.671818][ T1042] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.685489][ T1042] bridge_slave_0: left allmulticast mode [ 288.691263][ T1042] bridge_slave_0: left promiscuous mode [ 288.697935][ T1042] bridge0: port 1(bridge_slave_0) entered disabled state [ 289.128670][ T1042] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 289.142345][ T1042] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 289.154696][ T1042] bond0 (unregistering): Released all slaves [ 289.423661][T12681] netlink: 'syz.1.2222': attribute type 7 has an invalid length. [ 289.431469][T12681] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2222'. [ 289.650843][T12696] netlink: 'syz.1.2225': attribute type 3 has an invalid length. [ 289.690364][T12641] chnl_net:caif_netlink_parms(): no params data found [ 289.754932][T12702] FAULT_INJECTION: forcing a failure. [ 289.754932][T12702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 289.825857][T12702] CPU: 0 PID: 12702 Comm: syz.0.2226 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 289.836080][T12702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 289.846174][T12702] Call Trace: [ 289.849491][T12702] [ 289.852455][T12702] dump_stack_lvl+0x241/0x360 [ 289.857272][T12702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 289.862512][T12702] ? __pfx__printk+0x10/0x10 [ 289.867144][T12702] ? __pfx_lock_release+0x10/0x10 [ 289.872227][T12702] should_fail_ex+0x3b0/0x4e0 [ 289.876966][T12702] _copy_from_iter+0x1f6/0x1960 [ 289.881866][T12702] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 289.887389][T12702] ? dev_get_by_index+0x23/0x2d0 [ 289.892404][T12702] ? __pfx__copy_from_iter+0x10/0x10 [ 289.897740][T12702] ? dev_get_by_index+0x23/0x2d0 [ 289.902716][T12702] packet_sendmsg+0x397b/0x6710 [ 289.907614][T12702] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 289.913029][T12702] ? __pfx___might_resched+0x10/0x10 [ 289.918343][T12702] ? aa_sk_perm+0x967/0xab0 [ 289.922872][T12702] ? __pfx_packet_sendmsg+0x10/0x10 [ 289.928098][T12702] ? __fget_files+0x29/0x470 [ 289.932706][T12702] ? aa_sock_msg_perm+0x91/0x160 [ 289.937663][T12702] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 289.942959][T12702] ? security_socket_sendmsg+0x87/0xb0 [ 289.948523][T12702] ? __pfx_packet_sendmsg+0x10/0x10 [ 289.953746][T12702] __sock_sendmsg+0x221/0x270 [ 289.958484][T12702] __sys_sendto+0x3a4/0x4f0 [ 289.963027][T12702] ? __pfx___sys_sendto+0x10/0x10 [ 289.968107][T12702] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 289.974109][T12702] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 289.980454][T12702] __x64_sys_sendto+0xde/0x100 [ 289.985248][T12702] do_syscall_64+0xf3/0x230 [ 289.989853][T12702] ? clear_bhb_loop+0x35/0x90 [ 289.994549][T12702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 290.000455][T12702] RIP: 0033:0x7f3379f75bd9 [ 290.004880][T12702] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 290.024500][T12702] RSP: 002b:00007f337ad10048 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 290.032935][T12702] RAX: ffffffffffffffda RBX: 00007f337a103f60 RCX: 00007f3379f75bd9 [ 290.040928][T12702] RDX: 000000000000e90c RSI: 00000000200000c0 RDI: 0000000000000003 [ 290.048908][T12702] RBP: 00007f337ad100a0 R08: 0000000020000540 R09: 0000000000000014 [ 290.056884][T12702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 290.064862][T12702] R13: 000000000000000b R14: 00007f337a103f60 R15: 00007fff590f5db8 [ 290.072871][T12702] [ 290.112487][T12707] netlink: 'syz.1.2228': attribute type 13 has an invalid length. [ 290.274165][ T5103] Bluetooth: hci0: command tx timeout [ 290.332538][T12723] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2231'. [ 290.342860][T12723] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 290.569220][ T1042] hsr_slave_0: left promiscuous mode [ 290.597078][ T1042] hsr_slave_1: left promiscuous mode [ 290.624897][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 290.660287][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 290.680425][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 290.692835][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 290.738068][ T1042] veth1_macvtap: left promiscuous mode [ 290.743938][ T1042] veth0_macvtap: left promiscuous mode [ 290.749635][ T1042] veth1_vlan: left promiscuous mode [ 290.761307][ T1042] veth0_vlan: left promiscuous mode [ 291.451229][ T1042] team0 (unregistering): Port device team_slave_1 removed [ 291.492515][ T1042] team0 (unregistering): Port device team_slave_0 removed [ 291.934033][T12755] (unnamed net_device) (uninitialized): (slave tunl0): Device is not bonding slave [ 291.948213][T12755] (unnamed net_device) (uninitialized): option active_slave: invalid value (tunl0) [ 291.961347][T12764] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2243'. [ 292.001342][T12764] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2243'. [ 292.011801][T12764] tipc: Invalid UDP bearer configuration [ 292.011856][T12764] tipc: Enabling of bearer rejected, failed to enable media [ 292.044853][T12769] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 292.096763][T12769] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 292.191497][T12777] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.2246'. [ 292.240756][T12777] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 292.353090][ T5103] Bluetooth: hci0: command tx timeout [ 292.401876][T12641] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.418058][T12641] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.429123][T12641] bridge_slave_0: entered allmulticast mode [ 292.441217][T12641] bridge_slave_0: entered promiscuous mode [ 292.468823][T12641] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.488847][T12641] bridge0: port 2(bridge_slave_1) entered disabled state [ 292.510401][T12641] bridge_slave_1: entered allmulticast mode [ 292.520428][T12791] Bluetooth: MGMT ver 1.22 [ 292.528683][T12641] bridge_slave_1: entered promiscuous mode [ 292.729677][T12641] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 292.767326][T12797] team0: Device is already in use. [ 292.790208][T12641] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.128412][T12641] team0: Port device team_slave_0 added [ 293.176272][T12641] team0: Port device team_slave_1 added [ 293.246522][T12830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2256'. [ 293.311803][T12833] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2257'. [ 293.439362][T12641] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 293.460202][T12641] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 293.516163][T12641] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 293.584938][T12641] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 293.611386][T12641] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 293.663421][T12641] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 293.861959][T12641] hsr_slave_0: entered promiscuous mode [ 293.901309][T12641] hsr_slave_1: entered promiscuous mode [ 293.909476][T12846] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2259'. [ 293.930050][T12641] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 293.939598][T12641] Cannot create hsr debugfs directory [ 293.996782][T12851] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 294.204027][T12855] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2261'. [ 294.252840][T12855] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 294.433689][ T5103] Bluetooth: hci0: command tx timeout [ 295.132515][T12888] netlink: 'syz.4.2268': attribute type 10 has an invalid length. [ 295.603121][T12908] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2272'. [ 295.635213][T12641] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 295.662350][T12641] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 295.692525][T12641] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 295.731547][T12641] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 295.911937][T12915] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2275'. [ 295.929633][T12915] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 296.008349][T12641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.077304][T12641] 8021q: adding VLAN 0 to HW filter on device team0 [ 296.109731][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.116961][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 296.178717][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.185967][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 296.307429][T12927] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2278'. [ 296.514473][ T5103] Bluetooth: hci0: command tx timeout [ 296.817732][T12948] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2282'. [ 296.889532][ C0] vcan0: j1939_xtp_rx_dat: no tx connection found [ 296.896110][ C0] vcan0: j1939_xtp_rx_dat: no rx connection found [ 296.902837][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.910707][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.918769][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.926680][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.934767][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.942699][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.950693][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.958629][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.966689][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.974640][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.982822][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 296.990682][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 296.998724][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.006706][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.014878][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.022783][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.030779][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.038711][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.046772][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.054707][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.062785][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.070666][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.078710][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.086633][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.094699][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.102579][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.110651][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.118584][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.126629][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.134579][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.142577][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.150491][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.158776][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.166704][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.174794][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.182709][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.190729][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.198662][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.206710][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.214619][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.222674][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.230647][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.238698][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.246627][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.254672][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.262547][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.270700][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.278647][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.286716][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.294636][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.302686][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.310650][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.318778][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.327093][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.335154][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.343076][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.351086][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.359105][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.367150][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.375040][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.383150][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.391017][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.399043][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.406943][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.414975][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.422880][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.430885][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.438799][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.446824][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.454740][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.462812][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.470681][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.478911][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.486830][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.494879][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.502778][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.510760][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.518675][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.526750][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.534675][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.542741][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 297.550632][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 297.990230][T12641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.081225][T12972] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2287'. [ 298.122495][T12972] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 298.193828][T12641] veth0_vlan: entered promiscuous mode [ 298.261389][T12641] veth1_vlan: entered promiscuous mode [ 298.287260][T12981] IPv6: addrconf: prefix option has invalid lifetime [ 298.434283][T12641] veth0_macvtap: entered promiscuous mode [ 298.473458][T12641] veth1_macvtap: entered promiscuous mode [ 298.498280][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 298.509234][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.531834][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 298.556800][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.574983][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 298.600365][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.618912][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 298.630894][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.660349][T12641] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 298.706299][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 298.737642][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.790278][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 298.818364][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.852348][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 298.878570][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.899896][T12641] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 298.911011][T12641] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 298.951294][T12641] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 299.079163][T12641] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.110066][T12641] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.144882][T13003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 299.155343][T12641] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.181610][T12641] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.206996][T13003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 299.329067][T13003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 299.476561][T13011] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 299.503964][ T4274] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 299.511871][ T4274] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 299.579255][T13020] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2295'. [ 299.629702][T13020] gtp0: entered promiscuous mode [ 299.655412][T13020] gtp0: entered allmulticast mode [ 299.762232][T13025] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2296'. [ 299.829343][ T1066] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 299.863186][ T1066] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 300.240975][T13039] netlink: 'syz.4.2298': attribute type 20 has an invalid length. [ 300.390228][T13046] FAULT_INJECTION: forcing a failure. [ 300.390228][T13046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 300.421111][T13046] CPU: 1 PID: 13046 Comm: syz.1.2300 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 300.431360][T13046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 300.441462][T13046] Call Trace: [ 300.444782][T13046] [ 300.447757][T13046] dump_stack_lvl+0x241/0x360 [ 300.452587][T13046] ? __pfx_dump_stack_lvl+0x10/0x10 [ 300.457851][T13046] ? __pfx__printk+0x10/0x10 [ 300.462496][T13046] ? __pfx_lock_release+0x10/0x10 [ 300.467595][T13046] should_fail_ex+0x3b0/0x4e0 [ 300.472366][T13046] _copy_from_user+0x2f/0xe0 [ 300.477030][T13046] copy_msghdr_from_user+0xae/0x680 [ 300.482307][T13046] ? __pfx___might_resched+0x10/0x10 [ 300.487661][T13046] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 300.493541][T13046] ? __might_fault+0xaa/0x120 [ 300.498296][T13046] do_recvmmsg+0x40f/0xae0 [ 300.502795][T13046] ? __pfx_lock_release+0x10/0x10 [ 300.507901][T13046] ? __pfx_do_recvmmsg+0x10/0x10 [ 300.512934][T13046] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 300.518887][T13046] ? ksys_write+0x23e/0x2c0 [ 300.523447][T13046] ? __pfx_lock_release+0x10/0x10 [ 300.528710][T13046] ? vfs_write+0x7c4/0xc90 [ 300.533195][T13046] ? __mutex_unlock_slowpath+0x21d/0x750 [ 300.538920][T13046] ? __fget_files+0x3f6/0x470 [ 300.543678][T13046] __x64_sys_recvmmsg+0x199/0x250 [ 300.548774][T13046] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 300.554388][T13046] ? do_syscall_64+0x100/0x230 [ 300.559209][T13046] ? do_syscall_64+0xb6/0x230 [ 300.563953][T13046] do_syscall_64+0xf3/0x230 [ 300.568518][T13046] ? clear_bhb_loop+0x35/0x90 [ 300.573259][T13046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.579219][T13046] RIP: 0033:0x7fdaebd75bd9 [ 300.583691][T13046] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 300.603366][T13046] RSP: 002b:00007fdaecad6048 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 300.611847][T13046] RAX: ffffffffffffffda RBX: 00007fdaebf03f60 RCX: 00007fdaebd75bd9 [ 300.619870][T13046] RDX: 03ffffffffffff62 RSI: 00000000200005c0 RDI: 0000000000000007 [ 300.627895][T13046] RBP: 00007fdaecad60a0 R08: 0000000000000000 R09: 0000000000000000 [ 300.636005][T13046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 300.644020][T13046] R13: 000000000000000b R14: 00007fdaebf03f60 R15: 00007ffd256e9c28 [ 300.652061][T13046] [ 300.871132][T13072] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2306'. [ 301.047374][ T1042] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.806800][ T1042] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.871297][ T1042] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 301.953668][ T1042] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.162496][ T1042] bridge_slave_1: left allmulticast mode [ 302.183599][ T1042] bridge_slave_1: left promiscuous mode [ 302.197930][ T1042] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.219016][ T1042] bridge_slave_0: left allmulticast mode [ 302.225260][ T1042] bridge_slave_0: left promiscuous mode [ 302.231252][ T1042] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.691154][T13114] netlink: 'syz.1.2312': attribute type 49 has an invalid length. [ 302.832754][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 302.867935][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 302.886248][ T5109] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 302.905309][ T5109] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 302.919018][ T5109] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 302.947843][ T5109] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 302.956378][ T5109] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 303.029174][T13122] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2317'. [ 303.215406][ T1042] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 303.230621][ T1042] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 303.250143][ T1042] bond0 (unregistering): Released all slaves [ 303.281150][T13108] netlink: 'syz.1.2312': attribute type 21 has an invalid length. [ 303.289334][T13108] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2312'. [ 303.312201][T13108] netlink: 'syz.1.2312': attribute type 5 has an invalid length. [ 303.332526][T13108] netlink: 'syz.1.2312': attribute type 6 has an invalid length. [ 303.352559][T13108] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2312'. [ 303.375079][T13114] netlink: 'syz.1.2312': attribute type 49 has an invalid length. [ 303.386468][T13125] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2317'. [ 303.406034][T13125] netlink: 'syz.4.2317': attribute type 25 has an invalid length. [ 303.441685][T13125] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 303.450893][T13125] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 303.459522][T13125] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 303.467887][T13125] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 303.765952][T13144] xt_TPROXY: Can be used only with -p tcp or -p udp [ 303.880655][ T1042] hsr_slave_0: left promiscuous mode [ 303.920920][ T1042] hsr_slave_1: left promiscuous mode [ 303.931284][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 303.972802][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 304.021639][ T1042] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 304.041098][ T1042] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 304.121281][ T1042] veth1_macvtap: left promiscuous mode [ 304.144930][ T1042] veth0_macvtap: left promiscuous mode [ 304.150641][ T1042] veth1_vlan: left promiscuous mode [ 304.172828][ T1042] veth0_vlan: left promiscuous mode [ 305.006566][ T5103] Bluetooth: hci0: command tx timeout [ 305.039813][ T1042] team0 (unregistering): Port device team_slave_1 removed [ 305.080742][ T1042] team0 (unregistering): Port device team_slave_0 removed [ 305.587263][T13184] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2331'. [ 305.763842][T13194] syzkaller1: entered promiscuous mode [ 305.782174][T13194] syzkaller1: entered allmulticast mode [ 306.189553][T13220] ipip2: entered promiscuous mode [ 306.221468][T13119] chnl_net:caif_netlink_parms(): no params data found [ 306.321569][T13228] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2339'. [ 306.349574][T13231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2341'. [ 306.358667][T13228] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 306.503305][T13243] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2342'. [ 306.540778][T13245] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2343'. [ 306.665548][T13119] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.690266][T13119] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.723405][T13119] bridge_slave_0: entered allmulticast mode [ 306.731007][T13119] bridge_slave_0: entered promiscuous mode [ 306.760876][T13119] bridge0: port 2(bridge_slave_1) entered blocking state [ 306.788908][T13119] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.809225][T13119] bridge_slave_1: entered allmulticast mode [ 306.829569][T13119] bridge_slave_1: entered promiscuous mode [ 306.912453][T13259] dummy0: entered promiscuous mode [ 306.957000][T13259] dummy0: left promiscuous mode [ 307.057141][T13119] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 307.074957][ T5103] Bluetooth: hci0: command tx timeout [ 307.091262][T13264] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2348'. [ 307.138970][T13119] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.211724][T13119] team0: Port device team_slave_0 added [ 307.236781][T13119] team0: Port device team_slave_1 added [ 307.314350][T13119] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.321466][T13119] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.365582][T13119] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 307.380869][T13119] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 307.388586][T13119] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.429529][T13282] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.2354'. [ 307.432020][T13119] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 307.446132][T13282] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 307.624632][T13119] hsr_slave_0: entered promiscuous mode [ 307.647355][T13119] hsr_slave_1: entered promiscuous mode [ 307.658145][T13119] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 307.667476][T13119] Cannot create hsr debugfs directory [ 307.920603][T13303] netlink: 'syz.1.2358': attribute type 3 has an invalid length. [ 308.583095][T13335] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2366'. [ 308.593639][T13335] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 308.610361][T13333] vlan2: entered promiscuous mode [ 308.615928][T13333] bridge0: entered promiscuous mode [ 308.624994][T13333] bridge0: port 3(vlan2) entered blocking state [ 308.632319][T13333] bridge0: port 3(vlan2) entered disabled state [ 308.638988][T13333] vlan2: entered allmulticast mode [ 308.644409][T13333] bridge0: entered allmulticast mode [ 308.661732][T13333] vlan2: left allmulticast mode [ 308.667257][T13333] bridge0: left allmulticast mode [ 308.685915][T13333] bridge0: left promiscuous mode [ 308.809326][T13340] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2367'. [ 308.838539][T13342] syz.2.2368[13342] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 308.838705][T13342] syz.2.2368[13342] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 308.864207][T13340] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2367'. [ 309.067105][T13119] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 309.113438][T13349] macvlan6: entered promiscuous mode [ 309.121068][T13349] macvlan6: entered allmulticast mode [ 309.137320][T13349] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 309.153302][ T5103] Bluetooth: hci0: command tx timeout [ 309.156875][T13349] team0: Port device macvlan6 added [ 309.188191][T13119] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 309.204033][T13119] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 309.235827][T13119] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 309.423090][T13364] netlink: 'syz.2.2375': attribute type 7 has an invalid length. [ 309.462327][T13365] netlink: 'syz.1.2376': attribute type 13 has an invalid length. [ 309.537049][T13119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.597752][T13372] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8 [ 309.612119][T13119] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.654690][ T5147] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.661929][ T5147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.692094][ T5147] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.699327][ T5147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.294994][T13119] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.313986][T13406] netlink: 'syz.1.2388': attribute type 3 has an invalid length. [ 310.389341][T13410] (unnamed net_device) (uninitialized): (slave tunl0): Device is not bonding slave [ 310.412334][T13410] (unnamed net_device) (uninitialized): option active_slave: invalid value (tunl0) [ 310.499097][T13408] vlan2: entered promiscuous mode [ 310.532913][T13408] bridge0: entered promiscuous mode [ 310.561966][T13408] bridge0: port 4(vlan2) entered blocking state [ 310.587359][T13408] bridge0: port 4(vlan2) entered disabled state [ 310.615174][T13408] vlan2: entered allmulticast mode [ 310.641265][T13408] bridge0: entered allmulticast mode [ 310.739267][T13408] vlan2: left allmulticast mode [ 310.755740][T13408] bridge0: left allmulticast mode [ 310.767937][T13408] bridge0: left promiscuous mode [ 310.958520][T13119] veth0_vlan: entered promiscuous mode [ 311.019957][T13119] veth1_vlan: entered promiscuous mode [ 311.115995][T13119] veth0_macvtap: entered promiscuous mode [ 311.147161][T13119] veth1_macvtap: entered promiscuous mode [ 311.233732][ T5103] Bluetooth: hci0: command tx timeout [ 311.237475][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.298995][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.322687][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.341908][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.383452][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.413756][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.445558][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 311.473627][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.486603][T13119] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 311.499430][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 311.510409][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.525591][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 311.551745][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.562677][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 311.576057][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.586284][T13119] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 311.597366][T13119] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 311.609519][T13119] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 311.671268][T13119] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.687689][T13119] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.698663][T13119] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.717804][T13119] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.786692][T13469] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.904376][T13469] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.021618][T13469] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.135329][T13469] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.301313][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 312.329170][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 312.420917][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 312.434782][T13493] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 312.465353][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 312.491586][T13469] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.551779][T13469] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.661514][T13469] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.711255][T13469] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.733387][T13512] netlink: 'syz.1.2418': attribute type 10 has an invalid length. [ 312.796482][T13512] team0: Port device dummy0 added [ 312.948116][T13522] __nla_validate_parse: 3 callbacks suppressed [ 312.948153][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2420'. [ 312.990761][T13524] netlink: 'syz.1.2421': attribute type 10 has an invalid length. [ 313.501118][T13555] netlink: 'syz.0.2429': attribute type 10 has an invalid length. [ 313.528517][T13555] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 313.609414][T13560] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 313.621044][T13560] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.648442][T13562] openvswitch: ɶƣ0GCTw: Dropping previously announced user features [ 313.699755][T13560] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 313.709902][T13560] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.792023][T13560] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 313.808670][T13560] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.893628][T13560] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 313.923179][T13560] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 314.058519][T13560] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.078151][T13560] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.121878][T13560] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.136282][T13560] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.178658][T13560] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.187481][T13560] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.226335][T13560] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.248602][T13560] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.289528][T13586] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2440'. [ 314.317483][T13587] 8021q: adding VLAN 0 to HW filter on device ipvlan5 [ 314.391862][T13589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.422089][T13589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.507276][T13596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.534842][T13589] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 314.649939][ T5788] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 314.695583][T13601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2445'. [ 314.727278][T13600] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2445'. [ 315.251653][ T5788] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.332852][ T5788] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.407958][ T5788] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 315.558862][ T5788] bridge_slave_1: left allmulticast mode [ 315.566783][ T5788] bridge_slave_1: left promiscuous mode [ 315.574459][ T5788] bridge0: port 2(bridge_slave_1) entered disabled state [ 315.584790][ T5788] bridge_slave_0: left allmulticast mode [ 315.590478][ T5788] bridge_slave_0: left promiscuous mode [ 315.597002][ T5788] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.294400][ T5109] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 316.305345][ T5109] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 316.314658][ T5109] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 316.343220][ T5109] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 316.362141][ T5109] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 316.370176][ T5109] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 317.476578][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.493330][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.434012][ T5109] Bluetooth: hci0: command tx timeout [ 319.059407][ T5788] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 319.071292][ T5788] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.083592][ T5788] bond0 (unregistering): Released all slaves [ 319.096610][T13606] netlink: 'syz.4.2450': attribute type 22 has an invalid length. [ 319.118356][T13611] vlan2: entered promiscuous mode [ 319.130417][T13611] veth0: entered promiscuous mode [ 319.139617][T13611] team0: Port device vlan2 added [ 319.164972][T13624] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.304916][T13624] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.343455][T13638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 319.367900][T13638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 319.430043][T13624] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.433102][T13638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 319.489987][T13642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 319.554579][T13644] openvswitch: netlink: Key type 191 is out of range max 32 [ 319.610188][T13624] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.732121][ T5788] hsr_slave_0: left promiscuous mode [ 319.748514][ T5788] hsr_slave_1: left promiscuous mode [ 319.760427][ T5788] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 319.775488][ T5788] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 319.788883][ T5788] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 319.803264][ T5788] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 319.839506][ T5788] veth1_macvtap: left promiscuous mode [ 319.845518][ T5788] veth0_macvtap: left promiscuous mode [ 319.851218][ T5788] veth1_vlan: left promiscuous mode [ 319.857534][ T5788] veth0_vlan: left promiscuous mode [ 320.151004][T13668] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2463'. [ 320.523061][ T5109] Bluetooth: hci0: command tx timeout [ 320.572114][ T5788] team0 (unregistering): Port device team_slave_1 removed [ 320.618736][ T5788] team0 (unregistering): Port device team_slave_0 removed [ 321.323517][T13624] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.407044][T13624] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.521758][T13624] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.551617][T13624] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.614658][T13694] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 321.800233][T13621] chnl_net:caif_netlink_parms(): no params data found [ 321.863790][T13706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.927844][T13706] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 322.070226][T13716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 322.185783][T13717] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 322.197328][ T5103] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 322.207223][T13717] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 322.208806][ T5103] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 322.226801][T13717] gretap1: entered promiscuous mode [ 322.232063][T13717] gretap1: entered allmulticast mode [ 322.237615][ T5103] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 322.255048][ T5103] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 322.264198][ T5103] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 322.271707][ T5103] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 322.448434][T13621] bridge0: port 1(bridge_slave_0) entered blocking state [ 322.462843][T13621] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.474657][T13621] bridge_slave_0: entered allmulticast mode [ 322.493208][T13621] bridge_slave_0: entered promiscuous mode [ 322.509863][T13621] bridge0: port 2(bridge_slave_1) entered blocking state [ 322.528029][T13621] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.544217][T13621] bridge_slave_1: entered allmulticast mode [ 322.572159][T13621] bridge_slave_1: entered promiscuous mode [ 322.596193][ T5103] Bluetooth: hci0: command tx timeout [ 322.701008][T13742] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2481'. [ 322.757608][T13621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 322.797104][T13744] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 322.850555][ T5788] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 322.891534][T13621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 322.960363][T13744] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 322.997977][ T5788] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.099687][T13758] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2487'. [ 323.100999][T13621] team0: Port device team_slave_0 added [ 323.131885][T13744] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.164251][ T5788] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.223579][T13621] team0: Port device team_slave_1 added [ 323.234932][T13759] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2487'. [ 323.250468][T13744] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.291648][T13758] team0: Port device team_slave_0 removed [ 323.357102][ T5788] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.371911][T13759] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2487'. [ 323.381469][T13759] tipc: Started in network mode [ 323.386521][T13759] tipc: Node identity aaaaaaaaaa0c, cluster identity 4711 [ 323.401708][T13759] tipc: Enabled bearer , priority 16 [ 323.501990][T13621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 323.512691][T13621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 323.541519][T13621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 323.571304][T13621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 323.581472][T13621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 323.608522][T13621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 323.795897][T13621] hsr_slave_0: entered promiscuous mode [ 323.809185][T13621] hsr_slave_1: entered promiscuous mode [ 323.823749][T13621] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 323.831349][T13621] Cannot create hsr debugfs directory [ 324.198363][T13722] chnl_net:caif_netlink_parms(): no params data found [ 324.220700][ T5788] bridge_slave_1: left allmulticast mode [ 324.227400][ T5788] bridge_slave_1: left promiscuous mode [ 324.239275][ T5788] bridge0: port 2(bridge_slave_1) entered disabled state [ 324.253247][ T5788] bridge_slave_0: left allmulticast mode [ 324.259218][ T5788] bridge_slave_0: left promiscuous mode [ 324.267810][ T5788] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.356105][ T5103] Bluetooth: hci4: command tx timeout [ 324.406623][ T5152] tipc: Node number set to 10922666 [ 324.586771][ T5788] ip6gretap0 (unregistering): left promiscuous mode [ 324.596018][T13789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.610832][T13789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.676197][T13789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.686518][ T5103] Bluetooth: hci0: command tx timeout [ 324.695619][T13789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.087946][ T5788] bond0 (unregistering): left allmulticast mode [ 325.094505][ T5788] bond_slave_0: left allmulticast mode [ 325.100012][ T5788] bond_slave_1: left allmulticast mode [ 325.105858][ T5788] dummy0: left allmulticast mode [ 325.110822][ T5788] macvlan4: left allmulticast mode [ 325.116060][ T5788] vlan1: left allmulticast mode [ 325.120928][ T5788] veth0_vlan: left allmulticast mode [ 325.127152][ T5788] bond0 (unregistering): left promiscuous mode [ 325.133607][ T5788] bond_slave_0: left promiscuous mode [ 325.139145][ T5788] bond_slave_1: left promiscuous mode [ 325.145061][ T5788] dummy0: left promiscuous mode [ 325.150069][ T5788] macvlan4: left promiscuous mode [ 325.155417][ T5788] vlan1: left promiscuous mode [ 325.180870][ T5788] team0: Port device macvlan2 removed [ 325.201177][ T5788] team0: Port device macvlan5 removed [ 325.229464][ T5788] team0: Port device macvlan6 removed [ 325.253453][ T5788] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 325.274373][ T5788] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 325.295825][ T5788] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 325.312388][ T5788] bond0 (unregistering): (slave macvlan4): Releasing backup interface [ 325.326111][ T5788] bond0 (unregistering): Released all slaves [ 325.350633][ T5788] bond1 (unregistering): (slave vcan1): Releasing backup interface [ 325.369578][ T5788] bond1 (unregistering): Released all slaves [ 325.923777][T13722] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.954593][T13722] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.964208][T13722] bridge_slave_0: entered allmulticast mode [ 325.990641][T13722] bridge_slave_0: entered promiscuous mode [ 326.070430][T13822] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2500'. [ 326.162825][T13722] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.170008][T13722] bridge0: port 2(bridge_slave_1) entered disabled state [ 326.195414][T13722] bridge_slave_1: entered allmulticast mode [ 326.210177][T13722] bridge_slave_1: entered promiscuous mode [ 326.225097][T13824] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2500'. [ 326.240290][T13827] netlink: 'syz.1.2501': attribute type 4 has an invalid length. [ 326.394646][T13835] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2503'. [ 326.433317][ T5103] Bluetooth: hci4: command tx timeout [ 326.460447][T13838] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.491019][T13838] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.565992][T13838] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.568819][T13722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 326.606281][T13838] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.712078][T13722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 326.840713][T13722] team0: Port device team_slave_0 added [ 326.880704][T13722] team0: Port device team_slave_1 added [ 326.917858][ T5788] hsr_slave_0: left promiscuous mode [ 326.941715][ T5788] hsr_slave_1: left promiscuous mode [ 326.960140][ T5788] veth0: left promiscuous mode [ 326.965379][ T5788] veth1_macvtap: left promiscuous mode [ 326.970950][ T5788] veth0_macvtap: left promiscuous mode [ 326.976895][ T5788] veth1_vlan: left promiscuous mode [ 326.982570][ T5788] veth0_vlan: left promiscuous mode [ 327.150109][ T5788] team0 (unregistering): Port device vlan2 removed [ 327.650073][ T5788] team0 (unregistering): Port device team_slave_1 removed [ 327.697256][ T5788] team0 (unregistering): Port device team_slave_0 removed [ 328.290153][T13744] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.424419][T13855] netlink: 'syz.1.2508': attribute type 4 has an invalid length. [ 328.511771][T13744] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.521282][ T5103] Bluetooth: hci4: command tx timeout [ 328.545588][T13744] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.553215][T13859] netlink: 'syz.4.2510': attribute type 1 has an invalid length. [ 328.555371][T13722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 328.572016][T13722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 328.599183][T13722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 328.614496][T13722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 328.622295][T13722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 328.675609][T13722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 328.729037][T13868] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2511'. [ 328.730973][T13744] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.950920][T13722] hsr_slave_0: entered promiscuous mode [ 328.963722][T13722] hsr_slave_1: entered promiscuous mode [ 328.970523][T13722] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 328.984195][T13722] Cannot create hsr debugfs directory [ 329.007341][T13872] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2513'. [ 329.066269][T13879] netlink: 144 bytes leftover after parsing attributes in process `syz.4.2515'. [ 329.199414][T13621] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 329.230889][T13621] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 329.260255][T13621] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 329.266809][T13882] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.308280][T13621] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 329.467188][T13895] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.477677][T13895] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.550695][T13895] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.560803][T13895] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.621990][T13895] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.632462][T13895] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.700229][T13895] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.715268][T13895] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.980014][T13621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 330.016379][T13895] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.043057][T13895] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.091282][T13895] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.109738][T13895] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.168107][T13621] 8021q: adding VLAN 0 to HW filter on device team0 [ 330.227831][T13895] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.253016][T13895] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.265243][ T785] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.269091][T13914] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2525'. [ 330.272473][ T785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 330.323162][T13916] netlink: 'syz.0.2526': attribute type 3 has an invalid length. [ 330.334682][ T785] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.341861][ T785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 330.389750][T13895] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.400742][T13895] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.592859][ T5103] Bluetooth: hci4: command tx timeout [ 330.624183][T13924] netlink: 'syz.1.2528': attribute type 10 has an invalid length. [ 330.685361][T13930] netlink: 'syz.1.2528': attribute type 10 has an invalid length. [ 330.729794][T13930] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 330.779934][T13722] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 330.804768][T13722] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 330.860615][T13722] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 330.879939][T13932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 330.895299][T13722] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 331.269762][T13621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 331.302056][T13722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 331.398867][T13722] 8021q: adding VLAN 0 to HW filter on device team0 [ 331.450417][ T785] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.457662][ T785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.538355][T13958] ipip0: entered promiscuous mode [ 331.581459][ T5095] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.588796][ T5095] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.658911][T13962] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.703640][T13968] netlink: 'syz.1.2539': attribute type 2 has an invalid length. [ 331.716617][T13621] veth0_vlan: entered promiscuous mode [ 331.831130][T13962] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.929860][T13621] veth1_vlan: entered promiscuous mode [ 331.966568][T13962] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.034901][T13978] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2541'. [ 332.069477][ T4274] ================================================================== [ 332.070668][T13978] block nbd0: not configured, cannot reconfigure [ 332.077573][ T4274] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x28/0x9e0 [ 332.077609][ T4274] Write of size 8 at addr ffff88806164b008 by task kworker/u8:8/4274 [ 332.077628][ T4274] [ 332.077637][ T4274] CPU: 1 PID: 4274 Comm: kworker/u8:8 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 332.112612][ T4274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 332.122705][ T4274] Workqueue: l2tp l2tp_tunnel_del_work [ 332.128205][ T4274] Call Trace: [ 332.131505][ T4274] [ 332.134465][ T4274] dump_stack_lvl+0x241/0x360 [ 332.139177][ T4274] ? __pfx_dump_stack_lvl+0x10/0x10 [ 332.144410][ T4274] ? __pfx__printk+0x10/0x10 [ 332.149028][ T4274] ? _printk+0xd5/0x120 [ 332.153213][ T4274] ? __virt_addr_valid+0x183/0x520 [ 332.158365][ T4274] ? __virt_addr_valid+0x183/0x520 [ 332.163518][ T4274] print_report+0x169/0x550 [ 332.168060][ T4274] ? __virt_addr_valid+0x183/0x520 [ 332.173214][ T4274] ? __virt_addr_valid+0x183/0x520 [ 332.178358][ T4274] ? __virt_addr_valid+0x44e/0x520 [ 332.183503][ T4274] ? __phys_addr+0xba/0x170 [ 332.188050][ T4274] ? l2tp_session_delete+0x28/0x9e0 [ 332.193280][ T4274] kasan_report+0x143/0x180 [ 332.197827][ T4274] ? l2tp_session_delete+0x28/0x9e0 [ 332.203067][ T4274] kasan_check_range+0x282/0x290 [ 332.208041][ T4274] l2tp_session_delete+0x28/0x9e0 [ 332.213098][ T4274] ? l2tp_tunnel_del_work+0x1d3/0x330 [ 332.218533][ T4274] l2tp_tunnel_del_work+0x1cb/0x330 [ 332.223777][ T4274] ? process_scheduled_works+0x945/0x1830 [ 332.229529][ T4274] process_scheduled_works+0xa2c/0x1830 [ 332.235172][ T4274] ? __pfx_process_scheduled_works+0x10/0x10 [ 332.241193][ T4274] ? assign_work+0x364/0x3d0 [ 332.245814][ T4274] worker_thread+0x86d/0xd50 [ 332.250438][ T4274] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 332.256368][ T4274] ? __kthread_parkme+0x169/0x1d0 [ 332.261418][ T4274] ? __pfx_worker_thread+0x10/0x10 [ 332.266532][ T4274] kthread+0x2f0/0x390 [ 332.270613][ T4274] ? __pfx_worker_thread+0x10/0x10 [ 332.275761][ T4274] ? __pfx_kthread+0x10/0x10 [ 332.280388][ T4274] ret_from_fork+0x4b/0x80 [ 332.284841][ T4274] ? __pfx_kthread+0x10/0x10 [ 332.289467][ T4274] ret_from_fork_asm+0x1a/0x30 [ 332.294285][ T4274] [ 332.297302][ T4274] [ 332.299619][ T4274] Allocated by task 13972: [ 332.304037][ T4274] kasan_save_track+0x3f/0x80 [ 332.308715][ T4274] __kasan_kmalloc+0x98/0xb0 [ 332.313340][ T4274] __kmalloc_noprof+0x1f9/0x400 [ 332.318220][ T4274] l2tp_session_create+0x3b/0xc20 [ 332.323253][ T4274] pppol2tp_connect+0xca3/0x17a0 [ 332.328208][ T4274] __sys_connect+0x2df/0x310 [ 332.332800][ T4274] __x64_sys_connect+0x7a/0x90 [ 332.337597][ T4274] do_syscall_64+0xf3/0x230 [ 332.342105][ T4274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.348090][ T4274] [ 332.350408][ T4274] Freed by task 5788: [ 332.354390][ T4274] kasan_save_track+0x3f/0x80 [ 332.359088][ T4274] kasan_save_free_info+0x40/0x50 [ 332.364145][ T4274] poison_slab_object+0xe0/0x150 [ 332.369094][ T4274] __kasan_slab_free+0x37/0x60 [ 332.373883][ T4274] kfree+0x149/0x360 [ 332.377815][ T4274] __sk_destruct+0x58/0x5f0 [ 332.382354][ T4274] rcu_core+0xafd/0x1830 [ 332.386629][ T4274] handle_softirqs+0x2c4/0x970 [ 332.391419][ T4274] __irq_exit_rcu+0xf4/0x1c0 [ 332.396034][ T4274] irq_exit_rcu+0x9/0x30 [ 332.400304][ T4274] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 332.405980][ T4274] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 332.412004][ T4274] [ 332.414346][ T4274] Last potentially related work creation: [ 332.420075][ T4274] kasan_save_stack+0x3f/0x60 [ 332.424786][ T4274] __kasan_record_aux_stack+0xac/0xc0 [ 332.430197][ T4274] call_rcu+0x167/0xa70 [ 332.434485][ T4274] pppol2tp_release+0x24b/0x350 [ 332.439361][ T4274] sock_close+0xbc/0x240 [ 332.443605][ T4274] __fput+0x24a/0x8a0 [ 332.447652][ T4274] task_work_run+0x24f/0x310 [ 332.452245][ T4274] syscall_exit_to_user_mode+0x168/0x360 [ 332.457887][ T4274] do_syscall_64+0x100/0x230 [ 332.462501][ T4274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.468399][ T4274] [ 332.470718][ T4274] The buggy address belongs to the object at ffff88806164b000 [ 332.470718][ T4274] which belongs to the cache kmalloc-1k of size 1024 [ 332.484767][ T4274] The buggy address is located 8 bytes inside of [ 332.484767][ T4274] freed 1024-byte region [ffff88806164b000, ffff88806164b400) [ 332.498494][ T4274] [ 332.500816][ T4274] The buggy address belongs to the physical page: [ 332.507228][ T4274] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61648 [ 332.515984][ T4274] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 332.524489][ T4274] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 332.532064][ T4274] page_type: 0xffffefff(slab) [ 332.537189][ T4274] raw: 00fff00000000040 ffff888015041dc0 ffffea0001830000 dead000000000002 [ 332.545803][ T4274] raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 332.554416][ T4274] head: 00fff00000000040 ffff888015041dc0 ffffea0001830000 dead000000000002 [ 332.563112][ T4274] head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 332.571798][ T4274] head: 00fff00000000003 ffffea0001859201 ffffffffffffffff 0000000000000000 [ 332.580472][ T4274] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 332.589140][ T4274] page dumped because: kasan: bad access detected [ 332.595553][ T4274] page_owner tracks the page as allocated [ 332.601269][ T4274] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 1042, tgid 1042 (kworker/u8:5), ts 81782388702, free_ts 23633600641 [ 332.621978][ T4274] post_alloc_hook+0x1f3/0x230 [ 332.626758][ T4274] get_page_from_freelist+0x2e4c/0x2f10 [ 332.632342][ T4274] __alloc_pages_noprof+0x256/0x6c0 [ 332.637584][ T4274] alloc_slab_page+0x5f/0x120 [ 332.642268][ T4274] allocate_slab+0x5a/0x2f0 [ 332.646770][ T4274] ___slab_alloc+0xcd1/0x14b0 [ 332.651447][ T4274] __slab_alloc+0x58/0xa0 [ 332.655773][ T4274] __kmalloc_noprof+0x257/0x400 [ 332.660642][ T4274] ieee802_11_parse_elems_full+0xdb/0x2880 [ 332.666466][ T4274] ieee80211_ibss_rx_queued_mgmt+0x4c8/0x2d70 [ 332.672558][ T4274] ieee80211_iface_work+0x8a5/0xf20 [ 332.677818][ T4274] cfg80211_wiphy_work+0x2db/0x490 [ 332.682980][ T4274] process_scheduled_works+0xa2c/0x1830 [ 332.688560][ T4274] worker_thread+0x86d/0xd50 [ 332.693151][ T4274] kthread+0x2f0/0x390 [ 332.697616][ T4274] ret_from_fork+0x4b/0x80 [ 332.702033][ T4274] page last free pid 1 tgid 1 stack trace: [ 332.707830][ T4274] free_unref_page+0xd22/0xea0 [ 332.712614][ T4274] free_contig_range+0x9e/0x160 [ 332.717481][ T4274] destroy_args+0x8a/0x890 [ 332.721920][ T4274] debug_vm_pgtable+0x4be/0x550 [ 332.726793][ T4274] do_one_initcall+0x248/0x880 [ 332.731580][ T4274] do_initcall_level+0x157/0x210 [ 332.736523][ T4274] do_initcalls+0x3f/0x80 [ 332.740866][ T4274] kernel_init_freeable+0x435/0x5d0 [ 332.746065][ T4274] kernel_init+0x1d/0x2b0 [ 332.750394][ T4274] ret_from_fork+0x4b/0x80 [ 332.754819][ T4274] ret_from_fork_asm+0x1a/0x30 [ 332.759590][ T4274] [ 332.761907][ T4274] Memory state around the buggy address: [ 332.767531][ T4274] ffff88806164af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 332.775603][ T4274] ffff88806164af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 332.783673][ T4274] >ffff88806164b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 332.791734][ T4274] ^ [ 332.796077][ T4274] ffff88806164b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 332.804171][ T4274] ffff88806164b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 332.812408][ T4274] ================================================================== [ 332.860256][ T4274] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 332.867615][ T4274] CPU: 0 PID: 4274 Comm: kworker/u8:8 Not tainted 6.10.0-rc6-syzkaller-01259-g3abbd7ed8b76 #0 [ 332.877897][ T4274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 332.887989][ T4274] Workqueue: l2tp l2tp_tunnel_del_work [ 332.893492][ T4274] Call Trace: [ 332.896782][ T4274] [ 332.899721][ T4274] dump_stack_lvl+0x241/0x360 [ 332.904425][ T4274] ? __pfx_dump_stack_lvl+0x10/0x10 [ 332.909642][ T4274] ? __pfx__printk+0x10/0x10 [ 332.914283][ T4274] ? preempt_schedule+0xe1/0xf0 [ 332.919165][ T4274] ? vscnprintf+0x5d/0x90 [ 332.923514][ T4274] panic+0x349/0x860 [ 332.927436][ T4274] ? check_panic_on_warn+0x21/0xb0 [ 332.932571][ T4274] ? __pfx_panic+0x10/0x10 [ 332.937022][ T4274] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 332.943108][ T4274] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 332.949447][ T4274] ? print_report+0x502/0x550 [ 332.954151][ T4274] check_panic_on_warn+0x86/0xb0 [ 332.959107][ T4274] ? l2tp_session_delete+0x28/0x9e0 [ 332.964312][ T4274] end_report+0x77/0x160 [ 332.968571][ T4274] kasan_report+0x154/0x180 [ 332.973100][ T4274] ? l2tp_session_delete+0x28/0x9e0 [ 332.978320][ T4274] kasan_check_range+0x282/0x290 [ 332.983274][ T4274] l2tp_session_delete+0x28/0x9e0 [ 332.988323][ T4274] ? l2tp_tunnel_del_work+0x1d3/0x330 [ 332.993706][ T4274] l2tp_tunnel_del_work+0x1cb/0x330 [ 332.998933][ T4274] ? process_scheduled_works+0x945/0x1830 [ 333.004660][ T4274] process_scheduled_works+0xa2c/0x1830 [ 333.010224][ T4274] ? __pfx_process_scheduled_works+0x10/0x10 [ 333.016216][ T4274] ? assign_work+0x364/0x3d0 [ 333.020815][ T4274] worker_thread+0x86d/0xd50 [ 333.025421][ T4274] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 333.031327][ T4274] ? __kthread_parkme+0x169/0x1d0 [ 333.036385][ T4274] ? __pfx_worker_thread+0x10/0x10 [ 333.041546][ T4274] kthread+0x2f0/0x390 [ 333.045679][ T4274] ? __pfx_worker_thread+0x10/0x10 [ 333.050832][ T4274] ? __pfx_kthread+0x10/0x10 [ 333.055454][ T4274] ret_from_fork+0x4b/0x80 [ 333.059910][ T4274] ? __pfx_kthread+0x10/0x10 [ 333.064545][ T4274] ret_from_fork_asm+0x1a/0x30 [ 333.069381][ T4274] [ 333.072733][ T4274] Kernel Offset: disabled [ 333.077098][ T4274] Rebooting in 86400 seconds..