0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2822.621097][T32017] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:35:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100ff020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:35:57 executing program 2: socket$inet6(0xa, 0x0, 0x8001) 06:35:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@dellink={0x58, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_GROUP={0x8, 0x1b, 0x75}, @IFLA_MAP={0x24}, @IFLA_PORT_SELF={0xc, 0x19, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5}]}]}, 0x58}}, 0x0) [ 2823.032581][T32023] bond1331: (slave bridge2241): Enslaving as a backup interface with an up link 06:35:57 executing program 2: mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x666ef210e3f0e8bb, 0xffffffffffffffff, 0x0) [ 2823.184063][T32023] bond1331: (slave bridge2242): Enslaving as a backup interface with a down link 06:35:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010003020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:35:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x8089ffffffff}, 0x0) [ 2823.729358][T32085] bond1332: (slave bridge2243): Enslaving as a backup interface with an up link [ 2823.954278][T32083] bond1332: (slave bridge2244): Enslaving as a backup interface with a down link 06:35:58 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:35:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000100)={0x2, 'vlan0\x00'}) 06:35:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010004020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:35:58 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x10, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:35:58 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:35:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x4000000000000}, 0x0) [ 2824.254432][T32168] validate_nla: 3 callbacks suppressed [ 2824.254451][T32168] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:35:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010005020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2824.440310][T32175] bond1333: (slave bridge2245): Enslaving as a backup interface with an up link 06:35:59 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(r0, &(0x7f0000006c40)=[{{&(0x7f0000000080)=@alg, 0xffffffffffffff58, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/161, 0xa1}, {&(0x7f00000001c0)=""/167, 0xab}, {&(0x7f0000000280)=""/46, 0x2e}], 0x3, &(0x7f0000000300)=""/127, 0x7f}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000380)=""/168, 0xa8}, {&(0x7f0000000440)=""/168, 0xa8}, {&(0x7f0000005340)=""/26, 0x15}, {&(0x7f0000000540)=""/160, 0xa0}, {&(0x7f0000000600)=""/42, 0x2a}, {&(0x7f0000000640)=""/17, 0x11}, {&(0x7f0000000680)=""/58, 0x3a}, {&(0x7f00000006c0)=""/67, 0x43}], 0x8, &(0x7f00000007c0)=""/4096, 0x1000}}, {{&(0x7f00000017c0)=@in6={0xa, 0x0, 0x0, @initdev}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001840)=""/175, 0xaf}], 0x1, &(0x7f0000001940)=""/168, 0xa8}}, {{&(0x7f0000001a00)=@l2tp={0x2, 0x0, @initdev}, 0x80, &(0x7f0000003cc0)=[{&(0x7f0000001a80)=""/58, 0x3a}, {&(0x7f0000001ac0)=""/68, 0x44}, {&(0x7f0000001b40)=""/8, 0x8}, {&(0x7f0000001b80)=""/4096, 0x1000}, {&(0x7f0000002b80)=""/85, 0x55}, {&(0x7f0000002c00)=""/4096, 0x1000}, {&(0x7f0000003c00)=""/53, 0x35}, {&(0x7f0000003c40)=""/100, 0x64}], 0x8, &(0x7f0000003d40)=""/77, 0x4d}}, {{&(0x7f0000003dc0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000005100)=[{&(0x7f0000003e40)=""/181, 0xb5}, {&(0x7f0000003f00)=""/57, 0x39}, {&(0x7f0000003f40)=""/85, 0x55}, {&(0x7f0000003fc0)=""/4096, 0x9b2}, {&(0x7f0000004fc0)=""/172, 0xac}, {&(0x7f0000005080)=""/69, 0x45}], 0x6, &(0x7f0000005180)=""/244, 0xf4}}, {{&(0x7f0000005280)=@generic, 0x80, &(0x7f0000006780), 0x0, &(0x7f0000005300)=""/54, 0x36}}, {{0x0, 0x0, &(0x7f0000006b80)=[{&(0x7f0000006880)=""/67, 0x43}, {&(0x7f0000006900)=""/216, 0xd8}, {&(0x7f0000006a00)=""/77, 0x4d}, {&(0x7f0000006a80)=""/113, 0x71}, {&(0x7f0000006b00)=""/118, 0x76}], 0x5, &(0x7f0000006c00)=""/47, 0x2f}}], 0x7, 0x0, &(0x7f0000006e40)) [ 2824.503868][T32168] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:35:59 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001680)=@raw={'raw\x00', 0x9, 0x3, 0x1f8, 0xa0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x160, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x0, 0x5, 0x6}}}}, {{@uncond, 0x0, 0xa0, 0xc0, 0x0, {}, [@common=@addrtype={{0x30}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x258) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x54) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) [ 2824.691112][T32175] bond1333: (slave bridge2246): Enslaving as a backup interface with a down link 06:35:59 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x8000000000000}, 0x0) [ 2824.834199][T32230] x_tables: duplicate underflow at hook 3 06:35:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010006020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2825.100344][T32238] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:00 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x10, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2825.536899][T32240] bond1334: (slave bridge2247): Enslaving as a backup interface with an up link [ 2825.592661][T32230] x_tables: duplicate underflow at hook 3 [ 2825.674427][T32238] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2825.852518][T32253] bond1334: (slave bridge2248): Enslaving as a backup interface with a down link 06:36:01 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x2000400) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 06:36:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010007020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:01 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:01 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x40000000000000}, 0x0) 06:36:01 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x10, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2826.904431][T32341] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:01 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010008020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:01 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @empty}, @loopback, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@empty, 'bridge_slave_0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@common=@unspec=@cpu={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) [ 2827.099169][T32349] bond1335: (slave bridge2249): Enslaving as a backup interface with an up link [ 2827.130747][T32349] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:01 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x40030000000000}, 0x0) 06:36:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010009020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2827.243236][T32396] x_tables: duplicate underflow at hook 3 06:36:02 executing program 2: r0 = socket$inet(0x2, 0xa, 0x0) getsockname(r0, 0x0, &(0x7f0000000080)=0x33) [ 2827.391991][T32401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) bind$packet(r0, 0x0, 0x43) [ 2827.820854][T32405] bond1336: (slave bridge2250): Enslaving as a backup interface with an up link [ 2827.911560][T32401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:03 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:03 executing program 2: socket$nl_audit(0x10, 0x3, 0x9) 06:36:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000a020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:03 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xe0ffff00000000}, 0x0) 06:36:03 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:03 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:03 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x9, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "b073b87b5b5b1757c0363b88a59d9a4676047f17fd955be3885b62950880"}}, {{@ipv6={@empty, @loopback, [], [], 'veth0_vlan\x00', 'dummy0\x00', {}, {}, 0x0, 0x0, 0x0, 0x7128b8abb15ea785}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) 06:36:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000b020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2828.489196][T32495] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_newroute={0x24, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x4}]}, 0x24}}, 0x0) [ 2828.980029][T32499] bond1337: (slave bridge2251): Enslaving as a backup interface with an up link [ 2829.045028][T32506] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:03 executing program 2: r0 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000880)) 06:36:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000e020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_newroute={0x30, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @empty}]}, 0x30}}, 0x0) [ 2829.383496][T32499] bond1337: (slave bridge2252): Enslaving as a backup interface with a down link 06:36:04 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000050001"], 0x5c}}, 0x0) 06:36:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 06:36:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010010020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:04 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:04 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2830.051617][T32607] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001200010027bd7000fddbdf2505001400030020"], 0x5c}}, 0x0) [ 2830.291682][T32615] bond1338: (slave bridge2253): Enslaving as a backup interface with an up link 06:36:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010011020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2830.341798][T32607] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2830.362041][T32661] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.2'. 06:36:05 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x100000000000000}, 0x0) 06:36:05 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@nat={'nat\x00', 0x1b, 0x5, 0x4f0, 0x0, 0xf0, 0xffffffff, 0xf0, 0xf0, 0x420, 0x420, 0xffffffff, 0x420, 0x420, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv6=@mcast2, @ipv6=@remote, @port, @icmp_id}}}, {{@ipv6={@mcast2, @loopback, [], [], 'hsr0\x00', 'bridge_slave_0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@srh={{0x30}}, @common=@icmp6={{0x28}, {0x0, "16ab"}}]}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, [], [], 'gre0\x00', 'vcan0\x00'}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@multicast1, @ipv6=@mcast1, @icmp_id, @gre_key}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@inet=@dscp={{0x28}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x0, @ipv4, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @icmp_id, @icmp_id}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x550) [ 2830.584363][T32667] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010021020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2830.628253][T32671] x_tables: duplicate underflow at hook 1 06:36:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) [ 2831.112357][T32675] bond1339: (slave bridge2254): Enslaving as a backup interface with an up link [ 2831.198397][T32667] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:06 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:06 executing program 2: pselect6(0x2c, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x0) 06:36:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010069020202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x200000000000000}, 0x0) 06:36:06 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:06 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2831.701603][T32765] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv6_getaddrlabel={0x1c, 0x4a, 0x9}, 0x1c}}, 0x0) 06:36:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002030202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:06 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x420, 0x138, 0x98, 0x138, 0x1d0, 0x98, 0x388, 0x388, 0x388, 0x388, 0x388, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x3}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'hsr0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@inet=@udp={{0x30}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x49c) [ 2832.054935][ T302] bond1340: (slave bridge2255): Enslaving as a backup interface with an up link [ 2832.065557][ T350] x_tables: duplicate underflow at hook 1 06:36:06 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0) [ 2832.268380][T32765] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002040202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:07 executing program 2: r0 = socket$inet(0x2, 0xa, 0x0) getsockname(r0, 0x0, &(0x7f0000000040)) [ 2832.547763][ T305] bond1340: (slave bridge2256): Enslaving as a backup interface with a down link 06:36:07 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x300000000000000}, 0x0) 06:36:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0x3f) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) 06:36:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002050202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:07 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, 0x0, 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:07 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:07 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2833.297790][ T414] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:08 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000002280)={&(0x7f0000001dc0), 0xc, 0x0}, 0x0) 06:36:08 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004000)={0x14, 0x1, 0x6, 0x101}, 0x14}}, 0x0) 06:36:08 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x24, 0x4, 0x8, 0x101, 0x0, 0x0, {}, [@CTA_TIMEOUT_L4PROTO={0x5}, @CTA_TIMEOUT_L3PROTO={0x6}]}, 0x24}}, 0x0) [ 2833.762379][ T417] bond1341: (slave bridge2257): Enslaving as a backup interface with an up link [ 2833.848710][ T417] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002060202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:08 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1, 0x1, 0x4, 0x0, 0x0, 0x0, {}, [@NFULA_CFG_QTHRESH={0x8}]}, 0x1c}}, 0x0) 06:36:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_newroute={0x24, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {}, [@RTA_EXPIRES={0x8}]}, 0x24}}, 0x0) [ 2834.231042][ T417] bond1341: (slave bridge2258): Enslaving as a backup interface with a down link 06:36:09 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x400000000000000}, 0x0) 06:36:09 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002070202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:09 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(r0, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10003, 0x0) 06:36:09 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, 0x0, 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2834.626485][ T501] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2835.000116][ T509] bond1342: (slave bridge2259): Enslaving as a backup interface with an up link [ 2835.105744][ T501] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2835.150385][ T525] bond1342: (slave bridge2260): Enslaving as a backup interface with a down link 06:36:10 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:10 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000002280)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002240)={0x0}}, 0x0) 06:36:10 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002080202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x500000000000000}, 0x0) [ 2835.422638][ T590] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002090202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) [ 2835.580625][ T3265] ieee802154 phy0 wpan0: encryption failed: -22 [ 2835.587030][ T3265] ieee802154 phy1 wpan1: encryption failed: -22 06:36:10 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, 0x0, 0xffffffffffffff86) [ 2835.934388][ T596] bond1343: (slave bridge2261): Enslaving as a backup interface with an up link 06:36:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f000000b840)=[{0x0, 0x0, 0x0}, {&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x81}], 0x2, 0x0) [ 2836.048672][ T590] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x600000000000000}, 0x0) 06:36:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020a0202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:11 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, 0x0, 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2836.357873][ T664] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2836.784724][ T665] bond1344: (slave bridge2262): Enslaving as a backup interface with an up link [ 2836.875498][ T664] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020b0202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:12 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@filter={'filter\x00', 0xe, 0x4, 0x3f8, 0xffffffff, 0x0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x328, 0x328, 0x328, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [], [], 'macvlan1\x00', 'ipvlan0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@private1, @remote, [], [], 'bond_slave_1\x00', 'gre0\x00'}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@mh={{0x28}, {"16da"}}, @common=@icmp6={{0x28}, {0x0, "8772"}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x100, 0x138, 0x0, {}, [@common=@mh={{0x28}, {"101a"}}, @common=@frag={{0x30}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) 06:36:12 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:12 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x700000000000000}, 0x0) 06:36:12 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2838.154829][ T767] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020e0202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000003a0001"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000003480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x160, 0x0) [ 2838.221380][ T774] x_tables: duplicate underflow at hook 2 06:36:13 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000240)=@raw={'raw\x00', 0x9, 0x3, 0x2e0, 0x128, 0xffffffff, 0xffffffff, 0x128, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xc0, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@icmp={{0x28}, {0x0, '7c'}}, @inet=@rpfilter={{0x28}}]}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x340) [ 2838.439722][ T771] bond1345: (slave bridge2263): Enslaving as a backup interface with an up link [ 2838.497743][ T767] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2838.518397][ T824] x_tables: duplicate underflow at hook 3 06:36:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002100202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {0xa, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}}, 0x0) [ 2838.694813][ T771] bond1345: (slave bridge2264): Enslaving as a backup interface with a down link [ 2838.771062][ T833] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2838.778356][ T833] IPv6: NLM_F_CREATE should be set when creating new route [ 2838.785612][ T833] IPv6: NLM_F_CREATE should be set when creating new route 06:36:13 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x800000000000000}, 0x0) 06:36:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv6_deladdr={0x48, 0x15, 0x526883875b15ba5, 0x0, 0x0, {}, [@IFA_LOCAL={0x14, 0x2, @empty}, @IFA_FLAGS={0x8}, @IFA_ADDRESS={0x14, 0x1, @dev}]}, 0x48}}, 0x0) 06:36:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002110202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2839.030351][ T844] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2839.454982][ T847] bond1346: (slave bridge2265): Enslaving as a backup interface with an up link [ 2839.521208][ T847] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2839.652052][ T847] bond1346: (slave bridge2266): Enslaving as a backup interface with a down link 06:36:14 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:14 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:14 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@security={'security\x00', 0xe, 0x4, 0x538, 0xffffffff, 0x260, 0x120, 0x0, 0xffffffff, 0xffffffff, 0x468, 0x468, 0x468, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@inet=@set4={{0x50}}]}, @common=@inet=@SET1={0x28}}, {{@ipv6={@mcast2, @local, [], [], 'netdevsim0\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x140, 0x0, {}, [@common=@mh={{0x28}, {"48f1"}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "c6b4cacc44bf9dd503b42cc224c553f3ea966515446c41292a91bb146b21fa6fcd667c170ad02392fc150588111eb5f43d92cc6c60d4c77496b1508151308c24"}}}, {{@ipv6={@mcast1, @empty, [], [], 'xfrm0\x00', 'bridge0\x00'}, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@private0, @private0, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, @loopback, @mcast2, @dev, @mcast2, @dev, @ipv4={'\x00', '\xff\xff', @multicast2}]}}]}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x598) 06:36:14 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002210202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x900000000000000}, 0x0) [ 2840.286946][ T932] x_tables: duplicate underflow at hook 2 06:36:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002690202020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2840.327533][ T936] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000018001daa0000000000001f000a00000000000007"], 0x1c}}, 0x0) [ 2840.754685][ T941] bond1347: (slave bridge2267): Enslaving as a backup interface with an up link [ 2840.798320][ T963] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2840.813235][ T941] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:15 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000023c0)={0x90, 0x0, 0x0, 0x0, 0x0, "", [@nested={0x7f, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @typed={0x8, 0x0, 0x0, 0x0, @u32}, @generic="2fba7d1ccf15c308826631d91a3f946fe919524f200a5fc26cab53745d4c064d1b8b8820f9458b4718e76005d2419a423c4ec611e765ddc0c93a0cc760bfe0f6bfe7ee5042cbb3e986c166", @typed={0x4}, @typed={0x8, 0x0, 0x0, 0x0, @uid}]}]}, 0x90}], 0x1}, 0x0) 06:36:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020302020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000003a0001002000000020e2bb80d8"], 0x14}}, 0x0) [ 2841.043336][ T941] bond1347: (slave bridge2268): Enslaving as a backup interface with a down link 06:36:15 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:16 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xa00000000000000}, 0x0) 06:36:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) 06:36:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020402020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:16 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000032c0)={0x0, 0x0, &(0x7f0000003280)={&(0x7f0000000040)=@newchain={0x24, 0x64, 0x323}, 0x24}}, 0x0) [ 2841.876269][ T1050] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:16 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, 0x0, 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2842.158311][ T1057] bond1348: (slave bridge2269): Enslaving as a backup interface with an up link 06:36:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020502020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:17 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2c, 0x2, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_TUPLE_REPLY={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @broadcast}}}]}]}, 0x2c}}, 0x0) [ 2842.264067][ T1050] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:17 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xc00000000000000}, 0x0) 06:36:17 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockname(r0, 0x0, &(0x7f0000004780)) 06:36:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020602020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2842.482158][ T1114] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2842.830431][ T1118] bond1349: (slave bridge2270): Enslaving as a backup interface with an up link [ 2842.894192][ T1124] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2843.087028][ T1118] bond1349: (slave bridge2271): Enslaving as a backup interface with a down link 06:36:18 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, 0x0, &(0x7f0000000400)) 06:36:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020702020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:18 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, 0x0, 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xe00000000000000}, 0x0) 06:36:18 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2843.524793][ T1207] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="5c0000001a000107"], 0x5c}}, 0x0) 06:36:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020802020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2843.725632][ T1212] bond1350: (slave bridge2272): Enslaving as a backup interface with an up link [ 2843.760915][ T1207] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:18 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x3, 0x2, 0x101}, 0x14}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x4, 0x1, 0x101}, 0x14}}, 0x0) [ 2843.871174][ T1212] bond1350: (slave bridge2273): Enslaving as a backup interface with a down link 06:36:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf00000000000000}, 0x0) 06:36:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000080)='bridge0\x00') 06:36:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020902020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2844.274062][ T1277] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2844.506661][ T1280] bond1351: (slave bridge2274): Enslaving as a backup interface with an up link [ 2844.539464][ T1277] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:19 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:19 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, 0x0, 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:19 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000640)=@nat={'nat\x00', 0x1b, 0x5, 0x5d8, 0x230, 0x3d8, 0xffffffff, 0x0, 0x118, 0x508, 0x508, 0xffffffff, 0x508, 0x508, 0x5, 0x0, {[{{@ipv6={@local, @mcast1, [], [], 'veth1_to_hsr\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@hl={{0x28}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x11, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4=@multicast2}}}, {{@ipv6={@loopback, @loopback, [], [], 'ipvlan0\x00'}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, "f815"}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@mcast2, @icmp_id, @gre_key}}}, {{@ipv6={@private1, @empty, [], [], 'tunl0\x00', 'veth0_macvtap\x00'}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0}}, @common=@inet=@tos={{0x28}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@empty, @ipv6=@private0, @port, @gre_key}}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@frag={{0x30}}]}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x638) 06:36:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020a02020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x1000000000000000}, 0x0) 06:36:19 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) [ 2845.170702][ T1362] x_tables: duplicate underflow at hook 1 06:36:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001500a55b00000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="140002"], 0x40}}, 0x0) [ 2845.482808][ T1374] bond1352: (slave bridge2275): Enslaving as a backup interface with an up link [ 2845.530140][ T1415] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2845.564293][ T1374] validate_nla: 1 callbacks suppressed [ 2845.564313][ T1374] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:20 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x24, 0x3, 0x1, 0x3, 0x0, 0x0, {}, [@CTA_LABELS={0x4}, @CTA_TUPLE_ORIG={0x4}, @CTA_ZONE={0x6}]}, 0x24}}, 0x0) 06:36:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020b02020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2845.742760][ T1391] bond1352: (slave bridge2276): Enslaving as a backup interface with a down link 06:36:20 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000005880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12000, 0x0) 06:36:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x1f00000000000000}, 0x0) [ 2846.115403][ T1434] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2846.385537][ T1435] bond1353: (slave bridge2277): Enslaving as a backup interface with an up link [ 2846.408119][ T1434] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:21 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020e02020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:21 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv4_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}}, 0x1c}}, 0x0) 06:36:21 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) 06:36:21 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x2000000000000000}, 0x0) [ 2846.768690][ T1509] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:21 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, 0x2, 0x1, 0x101}, 0x14}}, 0x0) [ 2847.265943][ T1512] bond1354: (slave bridge2278): Enslaving as a backup interface with an up link [ 2847.292125][ T1509] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:22 executing program 2: syz_emit_ethernet(0x4e, &(0x7f0000000080)={@random="2bc67fb0b372", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "ac7a71", 0x18, 0x3a, 0x0, @empty, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @private2}}}}}}, 0x0) 06:36:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002021002020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x3f00000000000000}, 0x0) 06:36:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0xb, 0x0, &(0x7f0000000000)=0x56) 06:36:22 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) [ 2847.632782][ T1574] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2847.934397][ T1576] bond1355: (slave bridge2279): Enslaving as a backup interface with an up link [ 2847.992951][ T1574] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2848.177253][ T1576] bond1355: (slave bridge2280): Enslaving as a backup interface with a down link 06:36:23 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002021102020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:23 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4148812, r0, 0x0) 06:36:23 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x4800000000000000}, 0x0) 06:36:23 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x1c, 0xd, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) [ 2848.490632][ T1664] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:23 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) 06:36:23 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0x0, &(0x7f000000f340)=[@cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x10}}], 0x30}, 0x0) [ 2848.881078][ T1672] bond1356: (slave bridge2281): Enslaving as a backup interface with an up link 06:36:23 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000003a000125"], 0x14}}, 0x0) [ 2848.957419][ T1664] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002022102020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:23 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000002c0)=@filter={'filter\x00', 0xe, 0x4, 0x3e0, 0xffffffff, 0x210, 0x0, 0x210, 0xffffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@loopback, @private0, [], [], 'tunl0\x00', 'bond_slave_0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@eui64={{0x28}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "5f823b6bfbe7b6bb9c5ad0fbe8e405efd811bd17398f0f828a2d39b1c014"}}}, {{@uncond, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@ah={{0x30}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x440) [ 2849.189381][ T1672] bond1356: (slave bridge2282): Enslaving as a backup interface with a down link 06:36:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x4c00000000000000}, 0x0) [ 2849.252877][ T1741] x_tables: duplicate underflow at hook 2 [ 2849.407552][ T1746] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2849.721650][ T1747] bond1357: (slave bridge2283): Enslaving as a backup interface with an up link [ 2849.890280][ T1746] bond1357: (slave bridge2284): Enslaving as a backup interface with a down link 06:36:24 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002026902020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:24 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00000019000100000000000000000002000000000000000000000010"], 0x2c}}, 0x0) 06:36:24 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:24 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, 0x0, 0x0, 0x40012500, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x5c071b0000000000}, 0x0) 06:36:24 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=@newtclass={0x2c, 0x28, 0xbf27e26afd59c791, 0x0, 0x0, {}, [@tclass_kind_options=@c_cbs={0x8}]}, 0x2c}}, 0x0) [ 2850.230748][ T1824] bond1358: (slave bridge2285): Enslaving as a backup interface with an up link 06:36:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020203020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2850.481480][ T1869] bond1358: (slave bridge2286): Enslaving as a backup interface with a down link 06:36:25 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001a0069f12035b2b6be3c391651696a859c1f9846f406"], 0x5c}}, 0x0) 06:36:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x5d071b0000000000}, 0x0) 06:36:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020204020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:25 executing program 2: epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000400)) [ 2850.767499][ T1894] validate_nla: 3 callbacks suppressed [ 2850.767520][ T1894] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2851.191546][ T1898] bond1359: (slave bridge2287): Enslaving as a backup interface with an up link [ 2851.253287][ T1894] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:26 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:26 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, 0x0, 0x0, 0x40012500, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:26 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x9, 0x3, 0x2b0, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'ip6gretap0\x00', 'erspan0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) 06:36:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020205020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x5e071b0000000000}, 0x0) 06:36:26 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2851.833123][ T1986] x_tables: duplicate underflow at hook 3 [ 2851.842330][ T1989] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020206020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@dellink={0x24, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_PORT_SELF={0x4}]}, 0x24}}, 0x0) [ 2852.233394][ T1994] bond1360: (slave bridge2288): Enslaving as a backup interface with an up link 06:36:27 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv6_deladdr={0x32, 0x15, 0x526883875b15ba5, 0x0, 0x0, {}, [@IFA_LOCAL={0x14, 0x2, @private1}, @IFA_FLAGS={0x8}]}, 0x34}}, 0x0) [ 2852.306911][ T1989] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020207020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2852.531543][ T1994] bond1360: (slave bridge2289): Enslaving as a backup interface with a down link [ 2852.562656][ T2064] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. 06:36:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x5f071b0000000000}, 0x0) 06:36:27 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x9, 0x3, 0x328, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x258, 0xffffffff, 0xffffffff, 0x258, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @dev, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0x100, 0x138, 0x0, {}, [@common=@hl={{0x28}}, @common=@ah={{0x30}}]}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0x100, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@frag={{0x30}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) [ 2852.799783][ T2072] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2852.859335][ T2074] x_tables: duplicate underflow at hook 3 [ 2853.064274][ T2075] bond1361: (slave bridge2290): Enslaving as a backup interface with an up link [ 2853.141384][ T2072] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2853.251400][ T2075] bond1361: (slave bridge2291): Enslaving as a backup interface with a down link 06:36:28 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0x9, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020208020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:28 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x17, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x65}}, 0x0) 06:36:28 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, 0x0, 0x0, 0x40012500, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:28 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x6000000000000000}, 0x0) [ 2854.288236][ T2187] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020209020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:29 executing program 2: accept4(0xffffffffffffffff, 0x0, 0x0, 0x180000) 06:36:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@delqdisc={0x2c, 0x25, 0x1, 0x0, 0x0, {}, [@TCA_RATE={0x6}]}, 0x2c}}, 0x0) [ 2854.732253][ T2193] bond1362: (slave bridge2292): Enslaving as a backup interface with an up link 06:36:29 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x1c}}, 0x0) [ 2854.772840][ T2187] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:29 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020a020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:29 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x60071b0000000000}, 0x0) [ 2854.942079][ T2260] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2855.067484][ T2265] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2855.549280][ T2267] bond1363: (slave bridge2293): Enslaving as a backup interface with an up link [ 2855.694056][ T2265] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2855.781878][ T2269] bond1363: (slave bridge2294): Enslaving as a backup interface with a down link 06:36:30 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:30 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020b020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:30 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x5, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {0xa, 0x80}}, 0x75}}, 0x0) 06:36:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x61071b0000000000}, 0x0) 06:36:30 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x0, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2856.097442][ T2344] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:31 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000100)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f0, 0x0, 0x168, 0x0, 0x3a0, 0x0, 0x458, 0x458, 0x458, 0x458, 0x458, 0x6, 0x0, {[{{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@ah={{0x30}}]}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@uncond, 0x0, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@icmp={{0x28}, {0x0, "d863"}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}, {{@ip={@local, @multicast1, 0x0, 0x0, 'macvlan1\x00', 'veth1_to_hsr\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ah={{0x30}}, @common=@ah={{0x30}}]}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x550) 06:36:31 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d616300000005000400000000000900020073797a3000000000240007800c00028008000140000000020c000180080001400000000008000640003d003f05000500020000000500010006"], 0x70}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) [ 2856.436375][ T2352] bond1364: (slave bridge2295): Enslaving as a backup interface with an up link [ 2856.447051][ T2399] x_tables: duplicate underflow at hook 1 [ 2856.516909][ T2344] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020e020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2856.695853][ T2352] bond1364: (slave bridge2296): Enslaving as a backup interface with a down link 06:36:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020210020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:31 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x62071b0000000000}, 0x0) 06:36:31 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x0, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) [ 2856.998387][ T2419] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2857.411888][ T2421] bond1365: (slave bridge2297): Enslaving as a backup interface with an up link [ 2857.551916][ T2419] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2857.646741][ T2457] bond1365: (slave bridge2298): Enslaving as a backup interface with a down link 06:36:32 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_newroute={0x24, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {}, [@RTA_PRIORITY={0x8, 0x6, 0xb6}]}, 0x24}}, 0x0) 06:36:32 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020211020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:32 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x63071b0000000000}, 0x0) 06:36:32 executing program 2: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x4c, 0x12, 0x1}, 0x4c}}, 0x0) [ 2857.856968][ T2512] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020221020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:32 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x318, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @mcast2, [], [], 'ip6gretap0\x00', 'syzkaller1\x00'}, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@ipv4={'\x00', '\xff\xff', @local}, [], 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x2}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) 06:36:32 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000002280)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002240)={&(0x7f0000001e00)={0x420}, 0x420}}, 0x0) [ 2858.040059][ T2558] x_tables: duplicate underflow at hook 3 06:36:32 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x9, 0x3, 0x260, 0xc8, 0xffffffff, 0xffffffff, 0xc8, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], [], 'bond_slave_1\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2c0) 06:36:32 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x0, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname(r0, &(0x7f0000001200)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, &(0x7f0000001280)=0x80) [ 2858.309041][ T2517] bond1366: (slave bridge2299): Enslaving as a backup interface with an up link [ 2858.397490][ T2517] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2858.638625][ T2543] bond1366: (slave bridge2300): Enslaving as a backup interface with a down link 06:36:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020269020200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:34 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv6_deladdr={0x34, 0x15, 0x526883875b15ba5, 0x0, 0x0, {}, [@IFA_CACHEINFO, @IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x3f}}]}, 0x34}}, 0x0) 06:36:34 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x64071b0000000000}, 0x0) 06:36:34 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:34 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:34 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) [ 2859.447101][ T2623] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202030200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2859.605911][ T2626] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 06:36:34 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0x1c}}, 0x0) [ 2859.930815][ T2630] bond1367: (slave bridge2301): Enslaving as a backup interface with an up link [ 2860.020802][ T2681] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2860.028134][ T2681] IPv6: NLM_F_CREATE should be set when creating new route [ 2860.035565][ T2681] IPv6: NLM_F_CREATE should be set when creating new route 06:36:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202040200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2860.153744][ T2630] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:34 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001a6987"], 0x5c}}, 0x0) [ 2860.382626][ T2635] bond1367: (slave bridge2302): Enslaving as a backup interface with a down link 06:36:35 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'lo\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='\b']}) 06:36:35 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x65071b0000000000}, 0x0) 06:36:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202050200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2860.671512][ T2706] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:35 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:35 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:35 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000002280)={&(0x7f0000001dc0), 0xc, &(0x7f0000002240)={&(0x7f0000001e00)={0x430, 0x3f3, 0x0, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, [0x0, 0x400, 0x5, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc73d, 0x2, 0x48, 0x0, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe0], [0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d9, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x0, 0x0, 0xffffffff, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x66bf, 0x1, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], 0xe, ['veth0_to_team\x00']}}, 0x430}}, 0x0) [ 2861.151062][ T2710] bond1368: (slave bridge2303): Enslaving as a backup interface with an up link 06:36:35 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={0x0}}, 0x0) [ 2861.254456][ T2706] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2861.556774][ T2713] bond1368: (slave bridge2304): Enslaving as a backup interface with a down link 06:36:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202060200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:36 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x470, 0x230, 0x230, 0x230, 0x198, 0x230, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x3d8, 0x6, 0x0, {[{{@ip={@local, @loopback, 0x0, 0x0, 'bridge0\x00', 'bond0\x00'}, 0x0, 0xb8, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@socket0={{0x20}}]}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28}}, {{@ip={@remote, @rand_addr, 0x0, 0x0, 'veth0_vlan\x00', 'rose0\x00'}, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@osf={{0x50}, {'syz1\x00'}}]}, @ECN={0x28}}, {{@ip={@multicast2, @multicast2, 0x0, 0x0, 'vlan0\x00', 'veth1_macvtap\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4d0) 06:36:36 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:36 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x6558000000000000}, 0x0) [ 2861.829479][ T2798] x_tables: duplicate underflow at hook 1 06:36:36 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0x14}}, 0x1c}}, 0x0) [ 2861.897058][ T2797] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202070200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:36 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) 06:36:36 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2862.336502][ T2805] bond1369: (slave bridge2305): Enslaving as a backup interface with an up link [ 2862.394589][ T2797] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:37 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@security={'security\x00', 0xe, 0x4, 0x3f0, 0xffffffff, 0x210, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x320, 0x320, 0x320, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @private0}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@ipv6={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [], [], 'macsec0\x00', 'batadv0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@common=@ah={{0x30}}, @common=@hl={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, 'W!'}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) 06:36:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202080200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:37 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x66071b0000000000}, 0x0) [ 2862.587297][ T2868] x_tables: duplicate underflow at hook 2 06:36:37 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_delroute={0x50, 0x19, 0x1, 0x0, 0x0, {}, [@RTA_MULTIPATH={0xc}, @RTA_DST={0x8, 0x1, @remote}, @RTA_MARK={0x8}, @RTA_ENCAP_TYPE={0x6}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc}}]}, 0x50}}, 0x0) [ 2862.691368][ T2871] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2863.211401][ T2873] bond1370: (slave bridge2306): Enslaving as a backup interface with an up link 06:36:38 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001a0069f120ac7000fddb9769ff662ecb5b10529c68df"], 0x5c}}, 0x0) [ 2863.346756][ T2873] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202090200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2863.636813][ T2896] bond1370: (slave bridge2307): Enslaving as a backup interface with a down link 06:36:38 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:38 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) 06:36:38 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x67071b0000000000}, 0x0) 06:36:38 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:38 executing program 2: socketpair(0x11, 0xa, 0x0, 0x0) 06:36:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020a0200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2863.951770][ T2971] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:38 executing program 2: unshare(0x2000400) 06:36:38 executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) sendmsg$unix(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000680)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0xfffffffffffffffd}], 0x9}, 0x0) 06:36:39 executing program 2: r0 = epoll_create(0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) [ 2864.431915][ T2978] bond1371: (slave bridge2308): Enslaving as a backup interface with an up link [ 2864.512400][ T2971] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:39 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SIGNAL_INFO(r0, &(0x7f00000001c0)={&(0x7f0000000000), 0x2, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3f2, 0x0, 0x0, 0x0, "", ["", "", ""]}, 0x10}}, 0x0) 06:36:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020b0200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname(r0, 0x0, 0x0) [ 2864.909121][ T2978] bond1371: (slave bridge2309): Enslaving as a backup interface with a down link 06:36:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001900010000000000000000000200000000000000000000001002"], 0x2c}}, 0x0) 06:36:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020e0200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:40 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:40 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) 06:36:40 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x6800000000000000}, 0x0) 06:36:40 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) [ 2865.710930][ T3103] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.2'. 06:36:40 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockname(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, &(0x7f00000002c0)=0x80) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, 0x0) [ 2865.768490][ T3106] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:40 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x270, 0x160, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @private1, [], [], 'ip6gretap0\x00', 'bridge0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@hbh, @common=@frag]}, @common=@inet=@LOG={0x0, 'LOG\x00', 0x0, {0x0, 0x0, "a9183fb14c832a5fb345dd79abde5b7b593503fd0a3e5ac57cdae795304c"}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@unspec=@CLASSIFY}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xfefb) [ 2866.290240][ T3110] bond1372: (slave bridge2310): Enslaving as a backup interface with an up link 06:36:41 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000009c0)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x2c0, 0x2c0, 0x2c0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private0, @local, [], [], 'vlan0\x00', 'nr0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], [], 'wg0\x00', 'bond_slave_1\x00'}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@hl={{0x28}}, @common=@unspec=@pkttype={{0x28}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) [ 2866.366750][ T3110] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202100200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2866.570519][ T3172] x_tables: duplicate underflow at hook 2 06:36:41 executing program 2: socketpair(0x11, 0xa, 0x2, 0x0) [ 2866.704387][ T3110] bond1372: (slave bridge2311): Enslaving as a backup interface with a down link 06:36:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x6c00000000000000}, 0x0) 06:36:41 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 2867.068695][ T3193] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2867.344634][ T3196] bond1373: (slave bridge2312): Enslaving as a backup interface with an up link [ 2867.393453][ T3202] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2867.472906][ T3196] bond1373: (slave bridge2313): Enslaving as a backup interface with a down link 06:36:43 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xa, &(0x7f0000000180)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202110200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:43 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) 06:36:43 executing program 4: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190000030000090008000500"/36], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 06:36:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) 06:36:43 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x7400000000000000}, 0x0) [ 2868.462641][ T3285] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) 06:36:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202210200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:43 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 2868.969369][ T3291] bond1374: (slave bridge2314): Enslaving as a backup interface with an up link [ 2869.051189][ T3285] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202690200000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:44 executing program 2: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x14, 0x14, 0x1, 0x0, 0x0, {0x11}}, 0x14}}, 0x0) [ 2869.449194][ T3294] bond1374: (slave bridge2315): Enslaving as a backup interface with a down link 06:36:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_delroute={0x2c, 0x19, 0x1, 0x0, 0x0, {}, [@RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc}}]}, 0x2c}}, 0x0) 06:36:44 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xa, &(0x7f0000000180)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x7a00000000000000}, 0x0) 06:36:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020300000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:44 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x9, 0x3, 0x2b0, 0xf0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) 06:36:44 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) 06:36:44 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@security={'security\x00', 0xe, 0x4, 0x548, 0xffffffff, 0x360, 0x360, 0x0, 0xffffffff, 0xffffffff, 0x478, 0x478, 0x478, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@hl={{0x28}}, @common=@srh={{0x30}}]}, @common=@unspec=@STANDARD={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'syzkaller1\x00', 'netdevsim0\x00'}, 0x0, 0x210, 0x238, 0x0, {}, [@common=@ah={{0x30}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00', @empty, @mcast1, @loopback, @dev, @remote, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, @local, @mcast1, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, @private0, @private2]}}]}, @common=@inet=@SET1={0x28}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@eui64={{0x28}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5a8) [ 2870.155168][ T3401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2870.168740][ T3400] x_tables: duplicate underflow at hook 3 06:36:44 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@dellink={0x28, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 06:36:45 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0xe, 0x4, 0x350, 0xffffffff, 0x0, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x280, 0x280, 0x280, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ipv6={@loopback, @dev, [], [], 'veth0_to_batadv\x00', 'bond0\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) [ 2870.487145][ T3458] x_tables: duplicate underflow at hook 2 06:36:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_timeval(r0, 0x1, 0x1, 0x0, &(0x7f0000000180)) [ 2870.649141][ T3407] bond1375: (slave bridge2316): Enslaving as a backup interface with an up link 06:36:45 executing program 4: unshare(0x2000400) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) [ 2870.755359][ T3401] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, 0x0, 0x0) 06:36:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020400000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2871.018560][ T3407] bond1375: (slave bridge2317): Enslaving as a backup interface with a down link 06:36:46 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xa, &(0x7f0000000180)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:46 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x288, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@dev, @local, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x1d10}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x23, 0x0, "1ff6995016a2246b0a7f07e3c2f0a3fd4af53e725a83b5b835516d78c7f2"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e8) 06:36:46 executing program 2: r0 = socket(0xa, 0x3, 0x7) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x0) 06:36:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x8000000000000000}, 0x0) 06:36:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020500000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:46 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) [ 2871.730182][ T3512] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2871.754261][ T3516] x_tables: duplicate underflow at hook 3 06:36:46 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) 06:36:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020600000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2871.977401][ T3519] bond1376: (slave bridge2318): Enslaving as a backup interface with an up link 06:36:46 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5b8, 0x98, 0x98, 0x1f0, 0x0, 0x3e0, 0x520, 0x520, 0x520, 0x520, 0x520, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x4}}}, {{@ip={@remote, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0xc8, 0x1f0, 0x0, {}, [@common=@addrtype={{0x30}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:devicekit_power_exec_t:s0\x00'}}}, {{@uncond, 0x0, 0x100, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@rateest={{0x68}, {'wlan1\x00', 'wlan0\x00'}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x618) [ 2872.028725][ T3519] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14}, 0x14}}, 0x0) [ 2872.171035][ T3574] x_tables: duplicate underflow at hook 1 [ 2872.242758][ T3519] bond1376: (slave bridge2319): Enslaving as a backup interface with a down link 06:36:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@ipv6_newroute={0x28, 0x18, 0xbd0b0df1038ea9e9, 0x0, 0x0, {}, [@RTA_MULTIPATH={0xc}]}, 0x28}}, 0x0) 06:36:47 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000480)=@security={'security\x00', 0xe, 0x4, 0x320, 0xffffffff, 0xd0, 0x168, 0xd0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xc0, 0x120}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CLASSIFY={0x28}}, {{@ip={@broadcast, @broadcast, 0x0, 0x0, 'lo\x00', 'gre0\x00'}, 0x0, 0x70, 0xd0}, @common=@SET}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x393) 06:36:47 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0x0, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020700000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:47 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x8100000000000000}, 0x0) 06:36:47 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0xffffffffffffff75, 0x453, 0x0, 0x0, 0x0, "cecbb97c050500e09f6fd74fbb769ddd1acca24b2d34453db78c345138dfe286b32e0a16973cb454afc4e3c1f342165e257e9e08a60e3ddd7e17f6a7ad34c124008c71097f7031db29d94794f70e84c3aca1f41306f84b7d4b72ce1493b9355cc12feaedd2ab874282c3e94ffabb3114246a6d01d5dfa69843e2bd8a974f5a793f739706e40a262bc44f66d1269b7f818edfad467033b9ba650bb3eefc6945c0a9538e6c08ac024136f5be35afc17327abe14ed786b7df817a6b79530f356056a58bdf8ea4a5ae9733bcbee50544d651f9a3d3676b7d38bf95624544", [""]}, 0xb8}}, 0x0) 06:36:47 executing program 4: r0 = socket(0x2, 0x3, 0x7) bind$alg(r0, 0x0, 0x0) 06:36:47 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) [ 2873.262648][ T3618] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0xb4}}, 0x1c}}, 0x0) [ 2873.390021][ T3627] bond1377: (slave bridge2320): Enslaving as a backup interface with an up link 06:36:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020800000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2873.445039][ T3627] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x88a8ffff00000000}, 0x0) 06:36:48 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x1, 0x4, 0x201, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_TIMEOUT={0x8}]}, 0x2c}}, 0x0) 06:36:48 executing program 2: r0 = socket(0x11, 0x3, 0x0) bind$alg(r0, 0x0, 0x0) 06:36:48 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000005200)=@security={'security\x00', 0xe, 0x4, 0x358, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2c0, 0x2c0, 0x2c0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev, 0x0, 0x0, [], 0x3}}}, {{@ip={@private, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'vlan0\x00', 'ip6gretap0\x00'}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00'}}]}, @common=@SET={0x60}}, {{@ip={@local, @broadcast, 0x0, 0x0, 'syz_tun\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b8) [ 2873.631841][ T3677] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2873.966496][ T3683] bond1378: (slave bridge2321): Enslaving as a backup interface with an up link [ 2874.169497][ T3683] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2874.271936][ T3683] bond1378: (slave bridge2322): Enslaving as a backup interface with a down link 06:36:49 executing program 2: syz_emit_ethernet(0x15, &(0x7f0000000080)={@dev, @remote, @val={@void, {0x8100, 0x0, 0x1}}, {@x25}}, 0x0) 06:36:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) 06:36:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020900000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:49 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x0) 06:36:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 06:36:49 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0x0, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:49 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x460, 0x0, 0x318, 0x1b8, 0x1b8, 0x118, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x6, 0x0, {[{{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x0, 0x8001}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) [ 2874.674256][ T3762] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:49 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@nat={'nat\x00', 0x1b, 0x5, 0x528, 0x0, 0x1e0, 0xffffffff, 0x1e0, 0x1e0, 0x458, 0x458, 0xffffffff, 0x458, 0x458, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, [], [], 'gre0\x00', 'wg1\x00'}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@multicast1, @ipv4=@dev, @gre_key, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv4=@multicast2, @ipv4=@local}}}, {{@uncond, 0x0, 0x118, 0x160, 0x0, {}, [@common=@unspec=@ipvs={{0x48}, {@ipv4=@broadcast}}, @common=@mh={{0x28}, {"813c"}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv4=@broadcast, @port, @gre_key}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@mh={{0x28}, {"176e"}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@private, @ipv6=@dev, @gre_key, @icmp_id}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x588) 06:36:49 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}}, 0x0) [ 2874.791591][ T3798] x_tables: duplicate underflow at hook 1 06:36:49 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x1c8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x298, 0xffffffff, 0xffffffff, 0x298, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}]}, @common=@unspec=@AUDIT={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) [ 2874.837868][ T3814] x_tables: duplicate underflow at hook 1 [ 2875.026504][ T3824] x_tables: duplicate underflow at hook 3 06:36:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, 0x0, 0x0) [ 2875.118209][ T3768] bond1379: (slave bridge2323): Enslaving as a backup interface with an up link [ 2875.178670][ T3828] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2875.221560][ T3762] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020a00000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2875.443764][ T3797] bond1379: (slave bridge2324): Enslaving as a backup interface with a down link 06:36:50 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0x0, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:50 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000100)={&(0x7f0000000000), 0x8, &(0x7f00000000c0)={&(0x7f0000000140)={0x5c, 0x3, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x5c}}, 0x0) 06:36:50 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x6, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0xffab}}, 0x0) 06:36:50 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xa916000000000000}, 0x0) 06:36:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020b00000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:50 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x0) 06:36:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020e00000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000240)=@mangle={'mangle\x00', 0x1f, 0x6, 0x610, 0x0, 0xd0, 0x2d8, 0x0, 0xd0, 0x540, 0x540, 0x540, 0x540, 0x540, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@loopback, @ipv6=@private1}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv6=@private0}}}, {{@uncond, 0x0, 0x118, 0x178, 0x0, {}, [@common=@hbh={{0x48}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@broadcast}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, [], [], 'ip6gre0\x00', 'team0\x00'}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@ipv4={'\x00', '\xff\xff', @private}, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x670) [ 2876.255255][ T3879] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:51 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000002280)={0x0, 0x0, &(0x7f0000002240)={&(0x7f0000001e00)={0x420}, 0x420}}, 0x0) 06:36:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x9, 0x3, 0x268, 0xc8, 0xffffffff, 0xffffffff, 0xc8, 0xffffffff, 0x198, 0xffffffff, 0xffffffff, 0x198, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@local, @private0, [], [], 'ip6gretap0\x00', 'erspan0\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2c8) [ 2876.391362][ T3891] x_tables: duplicate underflow at hook 1 [ 2876.479360][ T3922] x_tables: duplicate underflow at hook 3 06:36:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x320, 0x110, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @mcast2, [], [], 'ip6gretap0\x00', 'hsr0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 06:36:51 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000540)={0x28, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x8fc, 0x2}}]}, 0x28}}, 0x0) [ 2876.687930][ T3943] x_tables: duplicate underflow at hook 3 [ 2876.815106][ T3885] bond1380: (slave bridge2325): Enslaving as a backup interface with an up link [ 2876.886892][ T3885] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2877.060887][ T3885] bond1380: (slave bridge2326): Enslaving as a backup interface with a down link 06:36:53 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x0, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001800ebaa00000000000000000a0000000000000000000000060016"], 0x24}}, 0x0) 06:36:53 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}}, 0x0) 06:36:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202021000000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:53 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xc3ffffff00000000}, 0x0) 06:36:53 executing program 0: socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)=ANY=[], 0x8724) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r1, &(0x7f0000000100)=""/184, 0xffffffe8, 0x40012500, 0x0, 0xffffffffffffff49) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x0) [ 2878.661238][ T3996] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_delroute={0x1c, 0x19, 0x1}, 0x1c}}, 0x0) 06:36:53 executing program 2: r0 = socket$unix(0x1, 0x1, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000001480)) 06:36:53 executing program 2: r0 = socket(0x1, 0x3, 0x0) bind$alg(r0, 0x0, 0x0) [ 2878.896928][ T4000] bond1381: (slave bridge2327): Enslaving as a backup interface with an up link [ 2878.918942][ T4045] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202021100000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:53 executing program 4: socket(0x0, 0x8000c, 0x0) 06:36:53 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x1100, 0x4) [ 2879.188510][ T4000] bond1381: (slave bridge2328): Enslaving as a backup interface with a down link 06:36:54 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x0, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001900010000000000000000000200000022000012"], 0x2c}}, 0x0) 06:36:54 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xe4ffffff00000000}, 0x0) 06:36:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202022100000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:54 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x1c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 06:36:54 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'bond_slave_0\x00', &(0x7f0000000080)=@ethtool_link_settings={0x4c}}) [ 2879.969507][ T4122] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 06:36:54 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {}, [@RTA_GATEWAY={0x14, 0x5, @private1}]}, 0x30}}, 0x0) 06:36:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="2dcff6d5b34f61fe80ceaee434cf42d7023963ac3689fad31877f42b98804a465af4d55312d660de377326d6c67d7f6b2a77087f63db373ec7f5139665b2d7dfb8", 0x41) [ 2880.019682][ T4126] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000003a0001"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000003480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 06:36:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv4_getroute={0x1c, 0x1a, 0x1}, 0x1c}}, 0x0) 06:36:55 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3e0, 0x98, 0x138, 0x1f8, 0x1f8, 0x298, 0x348, 0x348, 0x348, 0x348, 0x348, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) 06:36:55 executing program 4: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getpeername(r0, 0x0, 0xffffffffffffffff) [ 2880.421981][ T4138] bond1382: (slave bridge2329): Enslaving as a backup interface with an up link [ 2880.436158][ T4206] x_tables: duplicate underflow at hook 1 [ 2880.466812][ T4126] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:55 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x0, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:55 executing program 0: r0 = socket$inet(0x10, 0x80003, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'veth1_virt_wifi\x00'}) 06:36:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x2e, 0x0, &(0x7f0000000080)) 06:36:55 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xe857c09700000000}, 0x0) 06:36:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202026900000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:55 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) 06:36:56 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000000c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x600, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x530, 0x530, 0x530, 0x530, 0x530, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x138, 0x160, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @private2, @mcast1, @mcast1}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, [], [], 'erspan0\x00', 'lo\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4=@private}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@mcast1, @ipv6=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x660) 06:36:56 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x40, 0x2, 0x3, 0x201, 0x0, 0x0, {}, [@NFQA_CFG_MASK={0x8}, @NFQA_CFG_QUEUE_MAXLEN={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9}, @NFQA_CFG_FLAGS={0x8}]}, 0x40}}, 0x0) [ 2881.307548][ T4255] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x9, 0x3, 0x2b8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1e8, 0xffffffff, 0xffffffff, 0x1e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @local, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x318) [ 2881.415132][ T4263] x_tables: duplicate underflow at hook 1 06:36:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5a8, 0x0, 0x0, 0x2c8, 0x1e0, 0x2c8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x6, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'team_slave_1\x00', 'team_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @empty, [], [], 'veth0_to_hsr\x00', 'veth0_macvtap\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@ipv6header={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@local, @mcast2, [], [], 'ip6tnl0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, {{@ipv6={@local, @empty, [], [], 'veth1_macvtap\x00', 'bridge0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@frag={{0x30}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x608) [ 2881.529402][ T4259] bond1383: (slave bridge2330): Enslaving as a backup interface with an up link [ 2881.552679][ T4312] x_tables: duplicate underflow at hook 1 [ 2881.564945][ T4259] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000640)=@nat={'nat\x00', 0x1b, 0x5, 0x5d8, 0x230, 0x3d8, 0xffffffff, 0x0, 0x118, 0x508, 0x508, 0xffffffff, 0x508, 0x508, 0x5, 0x0, {[{{@ipv6={@local, @mcast1, [], [], 'veth1_to_hsr\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@hl={{0x28}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4=@multicast2}}}, {{@ipv6={@loopback, @loopback, [], [], 'ipvlan0\x00'}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, "f815"}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@mcast2, @icmp_id, @gre_key}}}, {{@ipv6={@private1, @empty, [], [], 'tunl0\x00', 'veth0_macvtap\x00'}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0}}, @common=@inet=@tos={{0x28}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@empty, @ipv6=@private0, @port, @gre_key}}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@frag={{0x30}}]}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x638) [ 2881.580313][ T4314] x_tables: duplicate underflow at hook 3 06:36:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname(r0, 0x0, &(0x7f0000001280)) [ 2881.711036][ T4259] bond1383: (slave bridge2331): Enslaving as a backup interface with a down link [ 2881.749179][ T4320] x_tables: duplicate underflow at hook 1 06:36:57 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:57 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020202000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_pktinfo(r0, 0x0, 0x8, 0x0, 0x0) 06:36:57 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000), 0x4) 06:36:57 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x320, 0x138, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @private0, [], [], 'ip6gretap0\x00', 'veth1_to_batadv\x00'}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'veth1_macvtap\x00', {}, 'ipvlan0\x00'}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, "9f3b"}}, @common=@mh={{0x28}, {"5a84"}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 06:36:57 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 06:36:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {0xa, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}}, 0x0) [ 2882.446031][ T4375] x_tables: duplicate underflow at hook 3 [ 2882.474765][ T4377] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0x1c}}, 0x0) 06:36:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f00000000c0)={0x14, 0x5, 0x6, 0x301}, 0x14}}, 0x0) 06:36:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000100)={@mcast1}) [ 2882.821134][ T4386] bond1384: (slave bridge2332): Enslaving as a backup interface with an up link [ 2882.846225][ T4389] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2882.853520][ T4389] IPv6: NLM_F_CREATE should be set when creating new route [ 2882.860731][ T4389] IPv6: NLM_F_CREATE should be set when creating new route 06:36:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x0, 0x1, 0x2, {0x0, 0xee00}}}], 0xffffffffffffff70}, 0x0) [ 2882.897004][ T4436] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2882.932157][ T4386] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002600)) [ 2883.168060][ T4411] bond1384: (slave bridge2333): Enslaving as a backup interface with a down link 06:36:58 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:58 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) connect$netlink(r0, &(0x7f0000000180)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000002c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x14, 0x0, 0x9, 0x101}, 0x14}}, 0x0) 06:36:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020203000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:58 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001000eb"], 0x24}}, 0x0) 06:36:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth1_to_batadv\x00', &(0x7f0000000000)=@ethtool_ts_info}) 06:36:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf11f000000000000}, 0x0) [ 2883.771664][ T4484] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2883.824436][ T4486] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:58 executing program 0: sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, 0x0, 0x0) 06:36:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000400)="f3818a3c936bd5b59ee5859f2d3229f14d621298989ca7219f1effe548e1d8fc50d15a1c4e91166c45", 0x29) 06:36:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@gettfilter={0x34, 0x2e, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xfff1}}, [{0x8}, {0x8}]}, 0x34}}, 0x0) 06:36:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020204000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:58 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) 06:36:58 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1, &(0x7f0000000000)=0x8, 0x4) [ 2884.193693][ T4492] bond1385: (slave bridge2334): Enslaving as a backup interface with an up link [ 2884.263607][ T4486] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:59 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x0, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:36:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @broadcast}, @GTPA_LINK={0x8}]}, 0x24}}, 0x0) 06:36:59 executing program 0: accept$alg(0xffffffffffffffff, 0x0, 0x0) 06:36:59 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf21f000000000000}, 0x0) 06:36:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020205000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:36:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000001a0069f120ac7000fddbdf250a"], 0x5c}}, 0x0) [ 2884.880949][ T4586] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) connect$netlink(r0, &(0x7f00000016c0)=@proc, 0xffffffffffffff83) 06:36:59 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) accept4$alg(r0, 0x0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) 06:36:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020206000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2885.068033][ T4593] bond1386: (slave bridge2335): Enslaving as a backup interface with an up link 06:36:59 executing program 2: syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/time\x00') [ 2885.112052][ T4586] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:36:59 executing program 0: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000004540)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f0000003bc0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x0) 06:37:00 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) accept$alg(r0, 0x0, 0x0) [ 2885.374111][ T4632] bond1386: (slave bridge2336): Enslaving as a backup interface with a down link 06:37:00 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:00 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xf5ffffff00000000}, 0x0) 06:37:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000600)={'macvlan0\x00', &(0x7f0000002800)=@ethtool_eeprom={0xc}}) 06:37:00 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0) 06:37:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020207000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}}, 0x1c}}, 0x0) 06:37:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x9, 0x3, 0x3b0, 0x0, 0xffffffff, 0xffffffff, 0x1d0, 0xffffffff, 0x2e0, 0xffffffff, 0xffffffff, 0x2e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@empty, @mcast2, [], [], 'ip6gre0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, '/usr/sbin/cups-browsed\x00'}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x410) [ 2886.185891][ T4699] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001a0069f12035b2b6be3c391651696a859cb0e7d070be"], 0x5c}}, 0x0) 06:37:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, &(0x7f0000000000)='$', 0x1, 0xc4e73e473760e891, &(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80) [ 2886.439918][ T4744] x_tables: duplicate underflow at hook 3 06:37:01 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000480)=[{&(0x7f0000000040)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f00000003c0)=[{0x0}, {0x0}], 0x2}], 0x1, 0x0) 06:37:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, &(0x7f0000000000)='$', 0x1, 0xc4e73e473760e891, &(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80) [ 2886.550343][ T4701] bond1387: (slave bridge2337): Enslaving as a backup interface with an up link [ 2886.600168][ T4699] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:01 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) connect(r0, 0x0, 0x0) 06:37:02 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020208000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:02 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xfcffffff00000000}, 0x0) 06:37:02 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, &(0x7f0000000000)='$', 0x1, 0xc4e73e473760e891, &(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80) 06:37:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001800cbaa00000000000000000aeb"], 0x1c}}, 0x0) 06:37:02 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0x9, &(0x7f00000000c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x0) 06:37:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'veth1_virt_wifi\x00', &(0x7f0000000000)=@ethtool_ringparam={0x11}}) [ 2887.451501][ T4803] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:02 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, &(0x7f0000000000)='$', 0x1, 0xc4e73e473760e891, &(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80) 06:37:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@ipv4_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {}, [@RTA_PRIORITY={0x8}]}, 0x24}}, 0x0) [ 2887.583336][ T4808] bond1388: (slave bridge2338): Enslaving as a backup interface with an up link [ 2887.604766][ T4803] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:02 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xfeffffff00000000}, 0x0) 06:37:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020209000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:02 executing program 2: bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x0}, 0x10) [ 2887.874915][ T4866] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2888.186472][ T4874] bond1389: (slave bridge2339): Enslaving as a backup interface with an up link [ 2888.243296][ T4866] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:03 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@ipv6_newroute={0x34, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {}, [@RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5}}, @RTA_METRICS={0x4}, @RTA_OIF={0x8}]}, 0x34}}, 0x0) 06:37:03 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) 06:37:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020c000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:03 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x18, 0x0, 0x1, 0xc01, 0x0, 0x0, {}, [@CTA_TUPLE_REPLY={0x4}]}, 0x18}}, 0x0) 06:37:03 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 06:37:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_timeval(r0, 0x1, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0xfffffffffffffeeb) [ 2888.849942][ T4954] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020e000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:03 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @remote}, 0x10) 06:37:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@security={'security\x00', 0xe, 0x4, 0x3f0, 0xffffffff, 0x210, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x320, 0x320, 0x320, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @private0}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28}}, {{@ipv6={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [], [], 'macsec0\x00', 'batadv0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@common=@ah={{0x30}}, @common=@hl={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, 'W!'}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) 06:37:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x78}}, 0x0) connect$netlink(r0, &(0x7f0000000000), 0xc) [ 2889.169465][ T5009] x_tables: duplicate underflow at hook 2 06:37:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) accept$packet(r0, 0x0, 0x0) [ 2889.259467][ T4964] bond1390: (slave bridge2340): Enslaving as a backup interface with an up link [ 2889.355698][ T4964] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2889.558920][ T4967] bond1390: (slave bridge2341): Enslaving as a backup interface with a down link 06:37:04 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], 0x0, 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:04 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth0_virt_wifi\x00', 0x0}) 06:37:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='ip_vti0\x00') 06:37:04 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, 0x0, 0x4}, 0x14}}, 0x0) 06:37:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020f000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:04 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xffffffff00000000}, 0x0) 06:37:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001500a55b0000", @ANYRES32=0x0, @ANYBLOB="140002"], 0x40}}, 0x0) 06:37:04 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5a8, 0x0, 0x0, 0x2c8, 0x1e0, 0x2c8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x6, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'team_slave_1\x00', 'team_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0x1}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @empty, [], [], 'veth0_to_hsr\x00', 'veth0_macvtap\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@ipv6header={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@local, @mcast2, [], [], 'ip6tnl0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, {{@ipv6={@local, @empty, [], [], 'veth1_macvtap\x00', 'bridge0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@frag={{0x30}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x608) [ 2890.086605][ T5065] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2890.267988][ T5107] x_tables: duplicate underflow at hook 1 06:37:05 executing program 0: syz_genetlink_get_family_id$tipc2(&(0x7f0000001640), 0xffffffffffffffff) 06:37:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) [ 2890.442304][ T5068] bond1391: (slave bridge2342): Enslaving as a backup interface with an up link 06:37:05 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x9, 0x3, 0x298, 0xd8, 0xffffffff, 0xffffffff, 0xd8, 0xffffffff, 0x200, 0xffffffff, 0xffffffff, 0x200, 0xffffffff, 0x3, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'ip6erspan0\x00', 'ip_vti0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfffc, 0x8, 0x0, '\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@addrtype={{0x30}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="9bb7347ebeaa"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) [ 2890.516356][ T5077] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 06:37:05 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x9, 0x3, 0x2b0, 0x110, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@local, @private0, [], [], 'ip6gretap0\x00', 'erspan0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x3, 0x0, 0x0, 0x0, 'syz0\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x216) [ 2890.598997][ T5068] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2890.657135][ T5125] x_tables: duplicate underflow at hook 3 [ 2890.749287][ T5131] x_tables: duplicate underflow at hook 3 [ 2890.773170][ T5080] bond1391: (slave bridge2343): Enslaving as a backup interface with a down link 06:37:06 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], 0x0, 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020260000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:06 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@ipv6_newroute={0x44, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {}, [@RTA_PREF={0x5}, @RTA_OIF={0x8}, @RTA_ENCAP_TYPE={0x6}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @SEG6_LOCAL_SRH={0xc}}]}, 0x44}}, 0x0) 06:37:06 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x14, 0x0, 0x1, 0xc01}, 0x14}}, 0x0) 06:37:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x1c8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x298, 0xffffffff, 0xffffffff, 0x298, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}]}, @common=@unspec=@AUDIT={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) 06:37:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xffffffff89800000}, 0x0) [ 2891.332168][ T5163] x_tables: duplicate underflow at hook 3 [ 2891.361071][ T5166] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:06 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) 06:37:06 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x460, 0x0, 0x318, 0x1b8, 0x1b8, 0x118, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x6, 0x0, {[{{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@unspec=@cluster={{0x30}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) 06:37:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202f0000400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname(r0, 0x0, &(0x7f0000000100)) 06:37:06 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000640)=""/13, &(0x7f0000000680)=0xd) [ 2891.696485][ T5218] x_tables: duplicate underflow at hook 1 06:37:06 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) accept$alg(r0, 0x0, 0x0) [ 2891.824704][ T5225] IPVS: length: 13 != 8 [ 2891.837086][ T5173] bond1392: (slave bridge2344): Enslaving as a backup interface with an up link [ 2891.916962][ T5173] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2892.129864][ T5184] bond1392: (slave bridge2345): Enslaving as a backup interface with a down link 06:37:07 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], 0x0, 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:07 executing program 2: socket$inet(0x2, 0x3, 0xd8) 06:37:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200030400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001a0069f120ac7000fddadf250a4e8d4cd7a46ebac95a"], 0x5c}}, 0x0) 06:37:07 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newneigh={0x1c, 0x1c, 0x1}, 0x1c}}, 0x0) 06:37:07 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 06:37:07 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x270, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @local, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x1d10}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2d0) [ 2892.700069][ T5274] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202e7030400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000046c0)={'ip6tnl0\x00', 0x0}) 06:37:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x18, 0x4) [ 2892.919272][ T5317] x_tables: duplicate underflow at hook 3 06:37:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) 06:37:07 executing program 2: r0 = socket$inet(0x2, 0x3, 0xd8) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0) [ 2893.078776][ T5280] bond1393: (slave bridge2346): Enslaving as a backup interface with an up link [ 2893.144370][ T5280] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2893.338784][ T5280] bond1393: (slave bridge2347): Enslaving as a backup interface with a down link 06:37:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@filter={'filter\x00', 0xe, 0x4, 0x348, 0xffffffff, 0x330, 0x0, 0xf8, 0xffffffff, 0xffffffff, 0x490, 0x490, 0x490, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @local, [], [], 'veth0_to_bond\x00', 'rose0\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @remote, [], [], 'veth0_vlan\x00', 'lo\x00'}, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a8) 06:37:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001900010000000000000000000200000022"], 0x2c}}, 0x0) 06:37:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200050400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:08 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3e0, 0x98, 0x138, 0x1f8, 0x1f8, 0x298, 0x348, 0x348, 0x348, 0x348, 0x348, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) 06:37:08 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x0, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}}, 0x0) [ 2893.953842][ T5378] x_tables: duplicate underflow at hook 1 [ 2893.954198][ T5379] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. 06:37:08 executing program 0: r0 = socket(0xa, 0x3, 0x7) connect$netlink(r0, 0x0, 0x0) 06:37:08 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3f0, 0x0, 0x308, 0xc8, 0x0, 0x1c8, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x6, 0x0, {[{{@ip={@private, @multicast2, 0x0, 0x0, 'veth1_to_hsr\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0xbd5bdd057d2022e4}, 0x0, 0x70, 0x98}, @inet=@TOS={0x28}}, {{@ip={@private, @dev, 0x0, 0x0, 'hsr0\x00', 'gre0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}, {{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'macvlan1\x00', 'veth1_to_hsr\x00'}, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) 06:37:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020f050400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2894.046673][ T5382] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000001480)=[{&(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e, 0x0}], 0x1, 0xc0c0) 06:37:08 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x80, 0x4) 06:37:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb}, 0x1c}}, 0x0) 06:37:09 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000640)=@nat={'nat\x00', 0x1b, 0x5, 0x5d8, 0x0, 0x118, 0xffffffff, 0x3d8, 0x3d8, 0x508, 0x508, 0xffffffff, 0x508, 0x508, 0x5, 0x0, {[{{@ipv6={@local, @mcast1, [], [], 'veth1_to_hsr\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@hl={{0x28}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@remote, @ipv6=@ipv4={'\x00', '\xff\xff', @private}}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, "f815"}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@mcast2, @icmp_id, @gre_key}}}, {{@ipv6={@private1, @empty, [], [], 'tunl0\x00', 'veth0_macvtap\x00'}, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0}}, @common=@inet=@tos={{0x28}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@empty, @ipv6=@private0, @port, @gre_key}}}, {{@uncond, 0x0, 0x108, 0x130, 0x0, {}, [@common=@frag={{0x30}}, @common=@frag={{0x30}}]}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x638) 06:37:09 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1, 0x0, &(0x7f0000000040)) 06:37:09 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x1c8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x298, 0xffffffff, 0xffffffff, 0x298, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x8c8cd8d8f0c3be35}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) [ 2894.478280][ T5446] x_tables: duplicate underflow at hook 1 [ 2894.509398][ T5386] bond1394: (slave bridge2348): Enslaving as a backup interface with an up link 06:37:09 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x9, 0x3, 0x2b0, 0x1e0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@empty, @mcast2, [], [], 'ip6gre0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x7}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) [ 2894.570028][ T5388] 8021q: adding VLAN 0 to HW filter on device bond1394 [ 2894.606831][ T5451] x_tables: duplicate underflow at hook 3 [ 2894.696021][ T5388] bond0: (slave bond1394): Enslaving as an active interface with an up link [ 2894.710978][ T5382] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2894.727874][ T5454] x_tables: duplicate underflow at hook 3 [ 2894.969961][ T5386] bond1394: (slave bridge2349): Enslaving as a backup interface with a down link [ 2895.021048][T27433] bond1394: (slave bridge2348): link status definitely down, disabling slave 06:37:10 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x0, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlinkprop={0x20, 0x6c, 0x1}, 0x20}}, 0x0) 06:37:10 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@security={'security\x00', 0xe, 0x4, 0x510, 0xffffffff, 0xf8, 0xf8, 0xf8, 0xffffffff, 0xffffffff, 0x440, 0x440, 0x440, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28}}]}, @common=@inet=@SET1={0x28}}, {{@ipv6={@mcast2, @local, [], [], 'netdevsim0\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x140, 0x0, {}, [@common=@mh={{0x28}, {"48f1"}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "c6b4cacc44bf9dd503b42cc224c553f3ea966515446c41292a91bb146b21fa6fcd667c170ad02392fc150588111eb5f43d92cc6c60d4c77496b1508151308c24"}}}, {{@ipv6={@mcast1, @empty, [], [], 'xfrm0\x00', 'bridge0\x00'}, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@private0, @private0, @remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, @loopback, @mcast2, @dev, @mcast2, @dev, @ipv4={'\x00', '\xff\xff', @multicast2}]}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) 06:37:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5a8, 0x0, 0x0, 0x2c8, 0x1e0, 0x2c8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x6, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'team_slave_1\x00', 'team_slave_0\x00'}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @empty, [], [], 'veth0_to_hsr\x00', 'veth0_macvtap\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@ipv6header={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@ipv6={@local, @mcast2, [], [], 'ip6tnl0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, {{@ipv6={@local, @empty, [], [], 'veth1_macvtap\x00', 'bridge0\x00'}, 0x0, 0x100, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@frag={{0x30}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x608) 06:37:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200060400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x2}, 0x0) 06:37:10 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x14, 0x0, 0xd5be6c8e9935a209}, 0x14}}, 0x0) [ 2895.478956][ T5494] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2895.483990][ T5495] x_tables: duplicate underflow at hook 2 [ 2895.517403][ T5496] x_tables: duplicate underflow at hook 1 06:37:10 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1, 0x4, 0x3}, 0x14}}, 0x0) 06:37:10 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@bridge_delneigh={0x28, 0x1c, 0xf07, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x80}, [@NDA_LLADDR={0xa, 0x2, @random="574e0c03f1d3"}]}, 0x28}, 0x1, 0x64cb0100}, 0x0) 06:37:10 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x320, 0x138, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @private0, [], [], 'ip6gretap0\x00', 'veth1_to_batadv\x00'}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'veth1_macvtap\x00', {}, 'ipvlan0\x00', {}, 0x0, 0x11}}]}, @common=@unspec=@CONNSECMARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@common=@icmp6={{0x28}, {0x0, "9f3b"}}, @common=@mh={{0x28}, {"5a84"}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 06:37:10 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x460, 0x0, 0x318, 0x1b8, 0x1b8, 0x118, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x6, 0x0, {[{{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x0, 0x0, 0x3}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30}}, {{@ip={@private, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) [ 2895.881758][ T5553] x_tables: duplicate underflow at hook 1 [ 2895.889911][ T5554] x_tables: duplicate underflow at hook 3 [ 2895.910509][ T5500] bond1395: (slave bridge2350): Enslaving as a backup interface with an up link 06:37:10 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x408, 0x2c0, 0x130, 0x0, 0x1f0, 0x0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@loopback, @private, 0x0, 0x0, 'ipvlan1\x00', 'vlan1\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TTL={0x28}}, {{@ip={@multicast1, @dev, 0x0, 0x0, 'gre0\x00', 'veth0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@uncond, 0x0, 0x70, 0xb0}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) [ 2895.956533][ T5505] 8021q: adding VLAN 0 to HW filter on device bond1395 [ 2896.011001][ T5505] bond0: (slave bond1395): Enslaving as an active interface with an up link [ 2896.075942][ T3144] bond1395: (slave bridge2350): link status definitely down, disabling slave [ 2896.119219][ T5494] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2896.324386][ T5505] bond1395: (slave bridge2351): Enslaving as a backup interface with a down link 06:37:11 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x0, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:11 executing program 0: bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x38) 06:37:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200070400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0xfffffffffffffe50, &(0x7f0000000180)=[@rights={{0x0, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x0, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}, 0x0) 06:37:11 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x9, 0x3, 0x298, 0xd8, 0xffffffff, 0xffffffff, 0xd8, 0xffffffff, 0x200, 0xffffffff, 0xffffffff, 0x200, 0xffffffff, 0x3, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'ip6erspan0\x00', 'ip_vti0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@addrtype={{0x30}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="9bb7347ebeaa"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) 06:37:11 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x3}, 0x0) 06:37:11 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000005880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 06:37:11 executing program 0: r0 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000180)="a98d5af4b4e0a7add201dbcbb52e138aa577a784c377b37139ec158d65e840c01255aac3d6833709b19ae221", 0x2c}], 0x1}}], 0x1, 0x0) [ 2896.812051][ T5602] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2896.821278][ T5604] xt_check_table_hooks: 1 callbacks suppressed [ 2896.821298][ T5604] x_tables: duplicate underflow at hook 3 06:37:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x12, r0, 0x0) 06:37:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000002640)=@nl=@proc={0x10, 0x0, 0x25dfdbfd}, 0x80, 0x0}}], 0x2, 0x0) [ 2897.019749][ T3265] ieee802154 phy0 wpan0: encryption failed: -22 [ 2897.026136][ T3265] ieee802154 phy1 wpan1: encryption failed: -22 06:37:11 executing program 0: bpf$OBJ_GET_PROG(0x7, &(0x7f0000001600)={&(0x7f00000015c0)='./file0\x00'}, 0x10) 06:37:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0xa9ec5827be66c7ce, &(0x7f0000000000)=ANY=[@ANYBLOB="1c400000000050b501000000020000d56d767ea7a16f84d342567ca39ba7009f37c4fdbb3f5325d89589de9c7de2f622232bbb9c08c64d918a8b0beb1a9e0c4595e1f772fe737858bc0dd591aa2743c2fb3476951472606771a793229ee1e2e3f99a2aba6df99ca42ec6b3fdb1de4fa0071f5262e53e72983c1b799ac8aa8b532f78a1fb589383b585fd34d7154d7bda03ed8a81dbc0be6a3ee93431c124d91f510e6ab2e8bc650a2b", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000010000000000000000100000001000000"], 0x30}, 0x0) [ 2897.280029][ T5607] bond1396: (slave bridge2352): Enslaving as a backup interface with an up link [ 2897.360999][ T5613] 8021q: adding VLAN 0 to HW filter on device bond1396 [ 2897.437874][ T5613] bond0: (slave bond1396): Enslaving as an active interface with an up link [ 2897.502347][ T5607] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2897.675519][ T5607] bond1396: (slave bridge2353): Enslaving as a backup interface with a down link [ 2897.733694][ T3124] bond1396: (slave bridge2352): link status definitely down, disabling slave 06:37:12 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv6_deladdr={0x18, 0x15, 0x526883875b15ba5}, 0x18}}, 0x0) 06:37:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000003a0001"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000003480)=[{{&(0x7f0000000000)=@ethernet={0x0, @remote}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=""/4096, 0x1000}}], 0x1, 0x2042, &(0x7f00000036c0)) 06:37:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200090400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:12 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x0) 06:37:12 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000080)={0x11, 0xf7, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) 06:37:12 executing program 4: r0 = epoll_create(0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000180)) 06:37:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000015640)={0x0, 0x0, &(0x7f0000015600)={&(0x7f0000000400)=@deltfilter={0x24, 0x2d, 0x403}, 0x24}}, 0x0) [ 2898.131946][ T5706] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:12 executing program 0: r0 = socket$inet(0x2, 0xa, 0x0) getsockname(r0, 0x0, &(0x7f0000000080)) 06:37:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000001480)=[{0x0, 0x0, 0x0}], 0x1, 0xc0c0) 06:37:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() r2 = gettid() sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@cred={{0x1c, 0x1, 0x2, {r1}}}, @cred={{0x1c, 0x1, 0x2, {r2}}}], 0x40}, 0x0) 06:37:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010101}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}]}, 0x24}}, 0x0) [ 2898.494127][ T5713] bond1397: (slave bridge2354): Enslaving as a backup interface with an up link [ 2898.575101][ T5720] 8021q: adding VLAN 0 to HW filter on device bond1397 [ 2898.718462][ T5720] bond0: (slave bond1397): Enslaving as an active interface with an up link [ 2898.781739][ T5706] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2898.833873][ T3124] bond1397: (slave bridge2354): link status definitely down, disabling slave 06:37:14 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:14 executing program 2: socketpair(0x10, 0x3, 0x8, 0x0) 06:37:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) 06:37:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000940)={0x2c, 0x2, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_CFG_MASK={0x8}, @NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_FLAGS={0x8}]}, 0x2c}}, 0x0) 06:37:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000c0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x5}, 0x0) 06:37:14 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newroute={0x24, 0x18, 0xbd0b0df1038eaaeb, 0x0, 0x0, {}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x24}}, 0x0) [ 2899.438235][ T5809] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() sendmsg$netlink(r0, &(0x7f0000000300)={0x0, 0xffffffffffffffd3, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r1}}}, @cred={{0x0, 0x1, 0x2, {0x0, 0xee00}}}, @cred={{0x0, 0x1, 0x2, {0xffffffffffffffff}}}, @cred, @cred={{0x0, 0x1, 0x2, {0x0, 0xee00}}}], 0x30}, 0x0) 06:37:14 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x1, 0x4, 0x201, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x5}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x24}}, 0x0) 06:37:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0xe, 0x4, 0x350, 0xffffffff, 0x0, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x280, 0x280, 0x280, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28}}, {{@ipv6={@loopback, @dev, [], [], 'veth0_to_batadv\x00', 'bond0\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) 06:37:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0xfffffffffffffe3a, 0x0, 0x0, &(0x7f00000000c0)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xffb0}, 0x0) [ 2899.797507][ T5815] bond1398: (slave bridge2355): Enslaving as a backup interface with an up link 06:37:14 executing program 4: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001540)={0x4c, 0x13, 0x1}, 0x4c}}, 0x0) [ 2899.940392][ T5827] 8021q: adding VLAN 0 to HW filter on device bond1398 [ 2899.986601][ T5827] bond0: (slave bond1398): Enslaving as an active interface with an up link [ 2900.060974][ T5827] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2900.200969][ T5815] bond1398: (slave bridge2356): Enslaving as a backup interface with a down link [ 2900.306533][T12671] bond1398: (slave bridge2355): link status definitely down, disabling slave 06:37:15 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:15 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001800cbaa00000000000000000a1f"], 0x1c}}, 0x0) 06:37:15 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x9, 0x3, 0x298, 0xd8, 0xffffffff, 0xffffffff, 0xd8, 0xffffffff, 0x200, 0xffffffff, 0xffffffff, 0x200, 0xffffffff, 0x3, 0x0, {[{{@ip={@multicast2, @local, 0x0, 0x0, 'ip6erspan0\x00', 'ip_vti0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1b, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@addrtype={{0x30}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @random="9bb7347ebeaa"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) 06:37:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000e0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:15 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) connect(r0, &(0x7f0000001f80)=@l2tp={0x2, 0x0, @private}, 0x80) 06:37:15 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6}, 0x0) [ 2900.649926][ T5910] x_tables: duplicate underflow at hook 3 06:37:15 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x2b8, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1e8, 0xffffffff, 0xffffffff, 0x1e8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@local, @local, [], [], 'batadv_slave_0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@dev, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], [], 'syzkaller0\x00', 'veth0_to_bridge\x00'}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@dst={{0x48}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x318) [ 2900.691291][ T5912] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:15 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) 06:37:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000f0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:15 executing program 0: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) accept4$packet(r0, 0x0, 0x0, 0x0) 06:37:15 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000004680)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000045c0)=[@rights={{0x10}}], 0x10}], 0x1, 0x41) [ 2900.876497][ T5959] x_tables: duplicate underflow at hook 3 06:37:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth1\x00', &(0x7f0000000240)=@ethtool_eeprom={0x43}}) [ 2901.046439][ T5917] bond1399: (slave bridge2357): Enslaving as a backup interface with an up link [ 2901.121831][ T5912] 8021q: adding VLAN 0 to HW filter on device bond1399 [ 2901.224034][ T5912] bond0: (slave bond1399): Enslaving as an active interface with an up link [ 2901.261664][ T5912] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2901.318426][ T3124] bond1399: (slave bridge2357): link status definitely down, disabling slave 06:37:16 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x0, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x6000, 0x0) 06:37:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000009c0)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x2c0, 0x2c0, 0x2c0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private0, @local, [], [], 'vlan0\x00', 'nr0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], [], 'wg0\x00', 'bond_slave_1\x00'}, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@hl={{0x28}}, @common=@unspec=@pkttype={{0x28}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) 06:37:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202050f0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:16 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = gettid() sendmsg$netlink(r0, &(0x7f000000f380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@cred={{0x1c, 0x1, 0x2, {r1}}}, @cred={{0xfffffffffffffe89}}], 0x40}, 0x0) 06:37:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x7}, 0x0) [ 2902.038936][ T6014] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2902.069529][ T6017] x_tables: duplicate underflow at hook 2 06:37:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001800cbaa00000000000000000a00f8fffff7ffffffff"], 0x1c}}, 0x0) 06:37:16 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000001c0)=@security={'security\x00', 0xe, 0x4, 0x378, 0xffffffff, 0x0, 0xd0, 0xd0, 0xffffffff, 0xffffffff, 0x2e0, 0x2e0, 0x2e0, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @private, 0x0, 0x0, 'wlan1\x00', 'veth0_to_hsr\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @multicast}}}, {{@ip={@loopback, @loopback, 0x0, 0x0, 'vlan0\x00', 'ipvlan0\x00'}, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@socket0={{0x20}}, @common=@unspec=@mac={{}, {@multicast}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "00d2e06f46512055cc1901ffff20955159366324d4bbdefa46ab119d9a90"}}}, {{@ip={@private, @multicast2, 0x0, 0x0, 'bond_slave_1\x00', 'ip6gre0\x00'}, 0x0, 0xb0, 0x110, 0x0, {}, [@common=@socket0={{0x20}}, @common=@socket0={{0x20}}]}, @common=@CLUSTERIP={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x439) 06:37:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)=@mpls_newroute={0x1c, 0x18, 0x601}, 0x1c}}, 0x0) 06:37:17 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001800cbaa00000000000000000a00005300000009"], 0x1c}}, 0x0) [ 2902.404794][ T6021] bond1400: (slave bridge2358): Enslaving as a backup interface with an up link 06:37:17 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x1c8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x298, 0xffffffff, 0xffffffff, 0x298, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0xa9cd, 0x8, 0x0, 'syz0\x00'}}]}, @common=@unspec=@AUDIT={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) [ 2902.458430][ T6014] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:17 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) accept4$alg(r0, 0x0, 0x0, 0x0) [ 2902.638377][ T6078] x_tables: duplicate underflow at hook 3 [ 2902.653103][ T6080] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2902.660351][ T6080] IPv6: NLM_F_CREATE should be set when creating new route 06:37:17 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x0, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:17 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x8}, 0x0) 06:37:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202001f0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:17 executing program 0: r0 = socket$inet(0x2, 0xa, 0x0) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000940)={&(0x7f0000000000), 0xc, &(0x7f0000000900)={0x0, 0x3c}}, 0x0) 06:37:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv6_newroute={0x1c, 0x18, 0xbd0b0df1038eaacb, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8}}, 0x1c}}, 0x0) 06:37:17 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x1c8, 0xffffffff, 0xffffffff, 0x1c8, 0xffffffff, 0x298, 0xffffffff, 0xffffffff, 0x298, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x800, 0x0, 0x8, 0x0, 'syz0\x00'}}]}, @common=@unspec=@AUDIT={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) [ 2903.281463][ T6120] x_tables: duplicate underflow at hook 3 [ 2903.298692][ T6121] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 06:37:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) [ 2903.326020][ T6123] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:18 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @loopback, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'bridge_slave_0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 06:37:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000120001"], 0x5c}}, 0x0) 06:37:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202003f0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:18 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @loopback, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'bridge_slave_0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) [ 2903.569810][ T6158] x_tables: duplicate underflow at hook 3 06:37:18 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000300), 0x4) [ 2903.724046][ T6179] x_tables: duplicate underflow at hook 3 [ 2903.795348][ T6127] bond1401: (slave bridge2359): Enslaving as a backup interface with an up link [ 2903.885553][ T6130] 8021q: adding VLAN 0 to HW filter on device bond1401 [ 2903.940436][ T6130] bond0: (slave bond1401): Enslaving as an active interface with an up link [ 2903.987990][ T6180] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2904.021877][ T6123] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2904.175596][ T6127] bond1401: (slave bridge2360): Enslaving as a backup interface with a down link [ 2904.223794][ T36] bond1401: (slave bridge2359): link status definitely down, disabling slave 06:37:19 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x0, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:19 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @loopback, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'bridge_slave_0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 06:37:19 executing program 4: r0 = socket(0x2, 0xa, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={0x0}}, 0x0) 06:37:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0xc) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000140)={@dev, r2}, 0x14) 06:37:19 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200600400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x9}, 0x0) 06:37:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001200010027bd7000fddbdf250500140003"], 0x5c}}, 0x0) [ 2904.650155][ T6224] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2904.664688][ T6227] x_tables: duplicate underflow at hook 3 06:37:19 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @loopback, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'bridge_slave_0\x00'}}}, {{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) [ 2904.964453][ T6281] x_tables: duplicate underflow at hook 3 06:37:19 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x14, 0x1, 0x3, 0x401}, 0x14}}, 0x0) [ 2905.061006][ T6229] bond1402: (slave bridge2361): Enslaving as a backup interface with an up link 06:37:19 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f00000003c0)={&(0x7f0000000140), 0xc, &(0x7f0000000380)={0x0}}, 0x0) [ 2905.141393][ T6264] 8021q: adding VLAN 0 to HW filter on device bond1402 06:37:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000440)='veth0_virt_wifi\x00') [ 2905.279265][ T6264] bond0: (slave bond1402): Enslaving as an active interface with an up link [ 2905.288544][ T6265] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2905.312558][ T6264] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:20 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x1b, 0x5, 0x470, 0x230, 0x0, 0xffffffff, 0x118, 0x3d8, 0x508, 0x508, 0xffffffff, 0x508, 0x508, 0x5, 0x0, {[{{@ipv6={@local, @mcast1, [], [], 'hsr0\x00', 'vlan0\x00'}, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4=@multicast2}}}, {{@ipv6={@loopback, @loopback, [], [], 'ipvlan0\x00'}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@mcast2, @icmp_id, @gre_key}}}, {{@ipv6={@private1, @empty, [], [], 'tunl0\x00', 'veth0_macvtap\x00'}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@multicast1, @ipv6=@local, @gre_key, @icmp_id}}}, {{@ipv6={@empty, @empty, [], [], 'bond_slave_1\x00', 'batadv_slave_0\x00', {}, {}, 0x0, 0x0, 0x9}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d0) [ 2905.567493][ T6229] bond1402: (slave bridge2362): Enslaving as a backup interface with a down link [ 2905.624982][ T3124] bond1402: (slave bridge2361): link status definitely down, disabling slave 06:37:20 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x0, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020203e70400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@ipv4_delroute={0xe}, 0x2c}}, 0x0) 06:37:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'lo\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='\a']}) 06:37:20 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000009c0)=@filter={'filter\x00', 0xe, 0x4, 0x408, 0xffffffff, 0x268, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x338, 0x338, 0x338, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private0, @private2, [], [], 'vlan0\x00', 'nr0\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@hl={{0x28}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x100, 0x170, 0x0, {}, [@common=@frag={{0x30}}, @common=@mh={{0x28}, {"16f9"}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "e0ebf80552d8a84fd164abd588fe456e20f6fb5d1285a128ae9437b8c27e920dd1a99fcb6e43987d81960f27a51437bfefd29844086d8847fbc9f8766e2998dc"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x468) 06:37:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xa}, 0x0) [ 2906.107726][ T6332] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2906.129435][ T6333] x_tables: duplicate underflow at hook 2 06:37:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x288, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@dev, @local, [], [], 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x1d10}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "1ff6995016a2246b0a7f07e3c2f0a3fd4af53e725a83b5b835516d78c7f2"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e8) 06:37:20 executing program 2: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001540)={0xfffffe5b}, 0x4c}}, 0x0) [ 2906.248341][ T6337] bond1403: (slave bridge2363): Enslaving as a backup interface with an up link 06:37:21 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000003a0001002000000020e2bbac7f"], 0x14}}, 0x0) 06:37:21 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x30}}, 0x0) [ 2906.330567][ T6332] 8021q: adding VLAN 0 to HW filter on device bond1403 [ 2906.450707][ T6388] x_tables: duplicate underflow at hook 3 06:37:21 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000080)={0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlc\x00'}, 0x2c) 06:37:21 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, 0x0, 0x0) [ 2906.519776][ T6332] bond0: (slave bond1403): Enslaving as an active interface with an up link [ 2906.581755][ T6337] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2906.630688][ T6392] IPVS: set_ctl: invalid protocol: 0 172.30.0.3:0 [ 2906.834943][ T6337] bond1403: (slave bridge2364): Enslaving as a backup interface with a down link [ 2906.915383][ T115] bond1403: (slave bridge2363): link status definitely down, disabling slave 06:37:22 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x0, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:22 executing program 0: syz_genetlink_get_family_id$tipc2(&(0x7f0000001300), 0xffffffffffffffff) 06:37:22 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000240)={'mangle\x00'}, &(0x7f00000002c0)=0x54) 06:37:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200f00400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:22 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000001c0)=0x47de, 0x4) 06:37:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xc}, 0x0) 06:37:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$netlink(r0, 0x0, &(0x7f0000000a40)) [ 2907.411063][ T6435] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:22 executing program 2: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x36c, 0x228, 0x228, 0x0, 0x228, 0x228, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x3, 0x0, {[{{@ip={@multicast1, @remote, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x1c8, 0x228, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'ip6tnl0\x00', {0x0, 0x0, 0x60, 0x0, 0x0, 0x7ff, 0x5}}}]}, @common=@SET={0x60}}, {{@ip={@remote, @empty, 0x0, 0x0, '\x00', 'ipvlan0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3c8) 06:37:22 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000006c0)={'filter\x00', 0x7, 0x4, 0x3d4, 0xe4, 0x1f0, 0xe4, 0x2f4, 0x2f4, 0x2f4, 0x4, 0x0, {[{{@arp={@local, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {@mac=@multicast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'ip_vti0\x00', 'veth1\x00'}, 0xbc, 0xe4}, @unspec=@NFQUEUE3={0x28}}, {{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev, @loopback, @remote}}}, {{@uncond, 0xbc, 0x104}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x420) 06:37:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200ff0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_generic(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@loopback}]}, @generic='\'']}, 0x24}}, 0x0) 06:37:22 executing program 0: bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000c40)={0xffffffffffffffff, 0x0, 0x0}, 0x10) [ 2907.856665][ T6440] bond1404: (slave bridge2365): Enslaving as a backup interface with an up link [ 2907.913211][ T6448] 8021q: adding VLAN 0 to HW filter on device bond1404 [ 2907.989376][ T6448] bond0: (slave bond1404): Enslaving as an active interface with an up link [ 2908.070364][ T6435] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2908.287192][ T6448] bond1404: (slave bridge2366): Enslaving as a backup interface with a down link [ 2908.323535][T27433] bond1404: (slave bridge2365): link status definitely down, disabling slave 06:37:23 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x0, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:23 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={&(0x7f0000000780), 0xc, 0x0}, 0x0) 06:37:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_generic(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x24, 0x0, 0x0, 0x0, 0x0, {}, [@nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x3e, 0x0, 0x0, @ipv4=@loopback}]}, @generic='\'']}, 0x24}}, 0x0) 06:37:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000300ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) 06:37:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xe}, 0x0) [ 2908.830668][ T6536] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:23 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0}}, 0x0) 06:37:23 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000140)=0x77f, 0x4) 06:37:23 executing program 4: syz_genetlink_get_family_id$tipc2(&(0x7f00000012c0), 0xffffffffffffffff) [ 2908.966296][ T6538] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2909.010722][ T6543] bond1405: (slave bridge2367): Enslaving as a backup interface with an up link [ 2909.044449][ T6536] 8021q: adding VLAN 0 to HW filter on device bond1405 06:37:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200020400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:23 executing program 2: syz_genetlink_get_family_id$tipc2(&(0x7f00000016c0), 0xffffffffffffffff) 06:37:23 executing program 4: r0 = socket$inet(0x2, 0x3, 0x6) sendmmsg$inet(r0, &(0x7f00000025c0)=[{{&(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10, 0x0}}], 0x1, 0x0) [ 2909.229758][ T6536] bond0: (slave bond1405): Enslaving as an active interface with an up link [ 2909.294441][ T6536] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2909.424702][T12670] bond1405: (slave bridge2367): link status definitely down, disabling slave 06:37:24 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:24 executing program 0: mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x10, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x18}, [@ldst={0x5, 0x3, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0xfffffe4c}, 0x48) 06:37:24 executing program 4: socket$netlink(0x10, 0x3, 0x1) syz_genetlink_get_family_id$devlink(&(0x7f0000001980), 0xffffffffffffffff) 06:37:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200030400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:24 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000980)={{0x2, 0x0, @private}, {0x0, @multicast}, 0x50, {0x2, 0x0, @broadcast}, 'veth0_vlan\x00'}) 06:37:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf}, 0x0) 06:37:24 executing program 2: r0 = gettid() syz_open_procfs$namespace(r0, &(0x7f00000008c0)='ns/pid_for_children\x00') [ 2910.144789][ T6647] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={&(0x7f0000000780), 0xc, &(0x7f0000000800)={0x0}}, 0x0) 06:37:24 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="30000017"], 0x30}}, 0x0) 06:37:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200040400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:25 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0xffffffffffffffef, &(0x7f0000000040)={&(0x7f0000000100)=@bridge_dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2}}, 0x20}}, 0x0) [ 2910.398008][ T6651] bond1406: (slave bridge2368): Enslaving as a backup interface with an up link [ 2910.497958][ T6654] 8021q: adding VLAN 0 to HW filter on device bond1406 06:37:25 executing program 2: syz_emit_ethernet(0x14, &(0x7f00000006c0)={@multicast, @remote, @val={@void, {0x8100, 0x7}}, {@mpls_uc={0x8847, {[], @generic='\vy'}}}}, 0x0) [ 2910.645252][ T6654] bond0: (slave bond1406): Enslaving as an active interface with an up link [ 2910.694811][T12670] bond1406: (slave bridge2368): link status definitely down, disabling slave [ 2910.732591][ T6647] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:26 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:26 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000f40)) 06:37:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x0) 06:37:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000f40)) 06:37:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) 06:37:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200050400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2911.523773][ T6748] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:26 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000980)={{0x2, 0x0, @private}, {0x0, @multicast}, 0x0, {0x2, 0x0, @broadcast}, 'veth0_vlan\x00'}) 06:37:26 executing program 0: sendmsg$OSF_MSG_REMOVE(0xffffffffffffffff, 0x0, 0x0) 06:37:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200060400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:26 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/user\x00') 06:37:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x9, 0x3, 0x1fc, 0xb0, 0xffffffff, 0xffffffff, 0xb0, 0xffffffff, 0x168, 0xffffffff, 0xffffffff, 0x168, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x9}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x258) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000001380)={0x2, 0x4e23, @loopback}, 0x10) 06:37:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_generic(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x0) [ 2911.925693][ T6757] bond1407: (slave bridge2369): Enslaving as a backup interface with an up link [ 2911.990823][ T6760] 8021q: adding VLAN 0 to HW filter on device bond1407 [ 2912.103480][ T6760] bond0: (slave bond1407): Enslaving as an active interface with an up link [ 2912.148568][ T36] bond1407: (slave bridge2369): link status definitely down, disabling slave [ 2912.190995][ T6748] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:27 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:27 executing program 0: syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, 0x0, 0x0) 06:37:27 executing program 2: bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) 06:37:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$netlink(r0, &(0x7f0000000a00), &(0x7f0000000a40)=0xc) 06:37:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200070400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x48}, 0x0) 06:37:27 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='0'], 0x30}}, 0x0) [ 2912.831081][ T6860] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:27 executing program 4: r0 = syz_open_procfs$namespace(0x0, &(0x7f00000008c0)='ns/pid_for_children\x00') ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 06:37:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)=@mpls_getnetconf={0x14}, 0x14}}, 0x0) 06:37:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200080400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2913.011157][ T6863] bond1408: (slave bridge2370): Enslaving as a backup interface with an up link [ 2913.037424][ T6860] 8021q: adding VLAN 0 to HW filter on device bond1408 06:37:27 executing program 2: getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000012c0), 0xffffffffffffffff) 06:37:27 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, 0x0, &(0x7f00000002c0)) [ 2913.240690][ T6860] bond0: (slave bond1408): Enslaving as an active interface with an up link [ 2913.286672][ T6863] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2913.510767][ T6863] bond1408: (slave bridge2371): Enslaving as a backup interface with a down link [ 2913.585467][T11079] bond1408: (slave bridge2370): link status definitely down, disabling slave 06:37:28 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:28 executing program 0: r0 = gettid() socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f00000008c0)='ns/pid_for_children\x00') 06:37:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f00000000c0)=0x47, 0x4) 06:37:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'syztnl2\x00', 0x0}) 06:37:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200090400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c}, 0x0) 06:37:28 executing program 4: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='io_uring_cqring_wait\x00'}, 0xfe74) [ 2914.258411][ T6961] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:29 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, 0x0, &(0x7f0000001080)) 06:37:29 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0xa, &(0x7f0000001200)={0x0, @in, 0xfffffc01, 0x0, 0x2}, 0x98) 06:37:29 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(crct10dif-generic)\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x10}, 0x0) [ 2914.589893][ T6972] bond1409: (slave bridge2372): Enslaving as a backup interface with an up link [ 2914.657872][ T7011] 8021q: adding VLAN 0 to HW filter on device bond1409 [ 2914.731866][ T7011] bond0: (slave bond1409): Enslaving as an active interface with an up link [ 2914.757120][ T3124] bond1409: (slave bridge2372): link status definitely down, disabling slave 06:37:29 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000180)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r4, 0x8912, 0x400308) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x28, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_RSSI_THRESHOLD={0x8}]}]}, 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000000)=ANY=[@ANYBLOB="24020000", @ANYRES16=r2, @ANYBLOB="010000000000000000002100000008000300", @ANYRES32=r5, @ANYBLOB="08009e"], 0x24}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r6, r1, 0x0, 0x100007000) 06:37:29 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001e40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c29184ff7f0000cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cd8e5c39d325ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6b0ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04dcdcc24cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a00000000ff435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0adb02d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4a00fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768ee58969ced595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30fa94ef241875f3b4b6ab7929a57affe7d7fa29822aea69a660e717a04becff09000000724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074ebc37feaf3dd95f6ef2acd1fe582786105c7dfa2e5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca378e676c3e08c1ed43ca8d3d10994c0b58645ac518a75fde7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d34b5457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464b635197351a5ef0a0fb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb25122a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f83100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa370ac891e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5944912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cbe7df000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc13c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e89fc745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb4a541e407cc2dae5e690cd628ab84875f2c50ba891cea599b079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83186c1526af6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af930cd6db49a47613808bad959719c0000000000378a921c7f7f8433c2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205aa00b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569ed7aa287378c697f6cafa86966d7ba19e720413268e4770132618df552c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f9360984b5c2d4523497e4d64f95f0a093564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf596218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5002512bcbf9b24accfecb0f477db103463af2847e6ade5b9e065ec0d0ba58fedae5f08818fea475b169469f9efd131925d98c34b3cb26fe26796dd43b87e1cdee39f5cf21d2e80a64ac97e71cafc29bfb78db090dd12225efeda2e93bf7f6ba7865e9c375a780929dfa5a7036f5858e2a4ff8e8d1e8c9cceed07c6312b734c72510d335acc94f76e7078ce4066f1e0ac9429f8013683301277a11e25b248b61180cb6207a0e26757f3f1bfc6c27f3720d1fb74afb17f3b5239bc2243853d5234afb05edb71e7c706024e94dee34666c5b5522b54cb433efa54b4e9022533e7c89bdee957dfa9ded9f16fdcd1b681e4c72f32fa3334313e334cc140daec7dcb22f463457a1a5ac230bbded86258206046f556589f5627ab2751eb34d940519f009412098398ad822a8509d2d32da656ac5935e4c7f9503ce4daf13300dfd611528049310544d3e8613926fbe2647e258932592c9123f1c74023144442d09ef90c64950176c666da6b658108ac54beb2379aa70501c42bd9c4e4f426ab5ff2a33767b408ed19e399c33b52abc4ac24da0d4cf07d93029583591c33f0f80513c541581977f2e9735e1edb66fdbbe22eb4b0b670ba74fdee2f1a3cf85777af5d8267acaa9d83c23a4b40d0f53dce003c03c5959e405fc4f2c05d3394f014a39caabbeff7c7cadbdc57def7f5f758aa46b6e2fddc779770d7e395c4ac2a136a30e7c0a301dffc5565d7244fb29cd302c36e76221a3c4e21559216c078f06b0b04fb236ea14f9998776a0ae88dfeccc9ad64d2fe3cfdeb9684b7b7e5c00f7323f8214ed0189539e0e3e34c8e542c82ddbd6a75c1adbedef4d5d69b246a5a36ab802b0161908e748ed9891678c228413bf51b18a25bf776b9d1f1fedf97cf5e7de4455ea359e5796bd60cc415066fc271a2bdb7db13e72d1a99b375f96c4b5aef874037faf6a1d1aacf46a57346d000000000000000040c1051e444ea35432e022889fde59f038db4f83ffa3191116c7ba9434a7f758890f27b3acb915a7e5db2149e18c51b6db3edfdeb2ac8fe038f7987c5b38f206084bc5e8243f73e152980c414558a1f9dd35691d7f51f182393a434ba11112d7b3bf20fb62dc263b68149d8c22eb700f1e3b6ada85d949ddba3afae71082931899d138a2865685cb0d7e231838d00d1f1f104ab37b2929017a1d08f60b2cee3a49ea82b54244bec41e289ae1d7d578eed068912e2e72ffb0ccdacb8f459162b1338f91f247a2520e08c880463af6733fb1eecf800b7d074b435f1eaf608f34ddc421dc910fc282cf71114e97e5e4ab11c12c81502fb679666626e0cabdd23e7e29b4070cc18c24cf77fd9cae782eb7956e80abbc7da288a8be5869230fae230de433ef97c499e4f5ed5636b0bd0000000086c970de845572766c4e1d09154cd322f1a8c8ebe5a9492e7d148600"/3567], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r2, &(0x7f00000001c0)=@l2={0x1f, 0x0, @fixed}, 0x80) [ 2914.814424][ T6961] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2915.050498][ T7011] bond1409: (slave bridge2373): Enslaving as a backup interface with a down link [ 2915.060039][ T37] audit: type=1804 audit(1626935849.765:737): pid=7034 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir442492302/syzkaller.2TZq40/6959/cgroup.controllers" dev="sda1" ino=14920 res=1 errno=0 [ 2915.146436][ T7041] netlink: 512 bytes leftover after parsing attributes in process `syz-executor.2'. 06:37:30 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000c0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:30 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001e40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c29184ff7f0000cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cd8e5c39d325ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6b0ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04dcdcc24cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a00000000ff435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0adb02d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4a00fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768ee58969ced595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30fa94ef241875f3b4b6ab7929a57affe7d7fa29822aea69a660e717a04becff09000000724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074ebc37feaf3dd95f6ef2acd1fe582786105c7dfa2e5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca378e676c3e08c1ed43ca8d3d10994c0b58645ac518a75fde7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d34b5457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464b635197351a5ef0a0fb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb25122a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f83100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa370ac891e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5944912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cbe7df000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc13c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e89fc745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb4a541e407cc2dae5e690cd628ab84875f2c50ba891cea599b079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83186c1526af6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af930cd6db49a47613808bad959719c0000000000378a921c7f7f8433c2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205aa00b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569ed7aa287378c697f6cafa86966d7ba19e720413268e4770132618df552c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f9360984b5c2d4523497e4d64f95f0a093564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf596218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5002512bcbf9b24accfecb0f477db103463af2847e6ade5b9e065ec0d0ba58fedae5f08818fea475b169469f9efd131925d98c34b3cb26fe26796dd43b87e1cdee39f5cf21d2e80a64ac97e71cafc29bfb78db090dd12225efeda2e93bf7f6ba7865e9c375a780929dfa5a7036f5858e2a4ff8e8d1e8c9cceed07c6312b734c72510d335acc94f76e7078ce4066f1e0ac9429f8013683301277a11e25b248b61180cb6207a0e26757f3f1bfc6c27f3720d1fb74afb17f3b5239bc2243853d5234afb05edb71e7c706024e94dee34666c5b5522b54cb433efa54b4e9022533e7c89bdee957dfa9ded9f16fdcd1b681e4c72f32fa3334313e334cc140daec7dcb22f463457a1a5ac230bbded86258206046f556589f5627ab2751eb34d940519f009412098398ad822a8509d2d32da656ac5935e4c7f9503ce4daf13300dfd611528049310544d3e8613926fbe2647e258932592c9123f1c74023144442d09ef90c64950176c666da6b658108ac54beb2379aa70501c42bd9c4e4f426ab5ff2a33767b408ed19e399c33b52abc4ac24da0d4cf07d93029583591c33f0f80513c541581977f2e9735e1edb66fdbbe22eb4b0b670ba74fdee2f1a3cf85777af5d8267acaa9d83c23a4b40d0f53dce003c03c5959e405fc4f2c05d3394f014a39caabbeff7c7cadbdc57def7f5f758aa46b6e2fddc779770d7e395c4ac2a136a30e7c0a301dffc5565d7244fb29cd302c36e76221a3c4e21559216c078f06b0b04fb236ea14f9998776a0ae88dfeccc9ad64d2fe3cfdeb9684b7b7e5c00f7323f8214ed0189539e0e3e34c8e542c82ddbd6a75c1adbedef4d5d69b246a5a36ab802b0161908e748ed9891678c228413bf51b18a25bf776b9d1f1fedf97cf5e7de4455ea359e5796bd60cc415066fc271a2bdb7db13e72d1a99b375f96c4b5aef874037faf6a1d1aacf46a57346d000000000000000040c1051e444ea35432e022889fde59f038db4f83ffa3191116c7ba9434a7f758890f27b3acb915a7e5db2149e18c51b6db3edfdeb2ac8fe038f7987c5b38f206084bc5e8243f73e152980c414558a1f9dd35691d7f51f182393a434ba11112d7b3bf20fb62dc263b68149d8c22eb700f1e3b6ada85d949ddba3afae71082931899d138a2865685cb0d7e231838d00d1f1f104ab37b2929017a1d08f60b2cee3a49ea82b54244bec41e289ae1d7d578eed068912e2e72ffb0ccdacb8f459162b1338f91f247a2520e08c880463af6733fb1eecf800b7d074b435f1eaf608f34ddc421dc910fc282cf71114e97e5e4ab11c12c81502fb679666626e0cabdd23e7e29b4070cc18c24cf77fd9cae782eb7956e80abbc7da288a8be5869230fae230de433ef97c499e4f5ed5636b0bd0000000086c970de845572766c4e1d09154cd322f1a8c8ebe5a9492e7d148600"/3567], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r2, &(0x7f00000001c0)=@l2={0x1f, 0x0, @fixed}, 0x80) 06:37:30 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendto$llc(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x7f, 0x0, @remote}, 0x10) 06:37:30 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x60}, 0x0) 06:37:30 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e22, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x25) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x10}}}}}}, 0x0) [ 2915.760351][ T7077] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:30 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x894c, 0x0) 06:37:30 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001e40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c29184ff7f0000cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cd8e5c39d325ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6b0ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04dcdcc24cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a00000000ff435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0adb02d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4a00fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768ee58969ced595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30fa94ef241875f3b4b6ab7929a57affe7d7fa29822aea69a660e717a04becff09000000724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074ebc37feaf3dd95f6ef2acd1fe582786105c7dfa2e5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca378e676c3e08c1ed43ca8d3d10994c0b58645ac518a75fde7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d34b5457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464b635197351a5ef0a0fb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb25122a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f83100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa370ac891e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5944912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cbe7df000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc13c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e89fc745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb4a541e407cc2dae5e690cd628ab84875f2c50ba891cea599b079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83186c1526af6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af930cd6db49a47613808bad959719c0000000000378a921c7f7f8433c2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205aa00b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569ed7aa287378c697f6cafa86966d7ba19e720413268e4770132618df552c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f9360984b5c2d4523497e4d64f95f0a093564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf596218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5002512bcbf9b24accfecb0f477db103463af2847e6ade5b9e065ec0d0ba58fedae5f08818fea475b169469f9efd131925d98c34b3cb26fe26796dd43b87e1cdee39f5cf21d2e80a64ac97e71cafc29bfb78db090dd12225efeda2e93bf7f6ba7865e9c375a780929dfa5a7036f5858e2a4ff8e8d1e8c9cceed07c6312b734c72510d335acc94f76e7078ce4066f1e0ac9429f8013683301277a11e25b248b61180cb6207a0e26757f3f1bfc6c27f3720d1fb74afb17f3b5239bc2243853d5234afb05edb71e7c706024e94dee34666c5b5522b54cb433efa54b4e9022533e7c89bdee957dfa9ded9f16fdcd1b681e4c72f32fa3334313e334cc140daec7dcb22f463457a1a5ac230bbded86258206046f556589f5627ab2751eb34d940519f009412098398ad822a8509d2d32da656ac5935e4c7f9503ce4daf13300dfd611528049310544d3e8613926fbe2647e258932592c9123f1c74023144442d09ef90c64950176c666da6b658108ac54beb2379aa70501c42bd9c4e4f426ab5ff2a33767b408ed19e399c33b52abc4ac24da0d4cf07d93029583591c33f0f80513c541581977f2e9735e1edb66fdbbe22eb4b0b670ba74fdee2f1a3cf85777af5d8267acaa9d83c23a4b40d0f53dce003c03c5959e405fc4f2c05d3394f014a39caabbeff7c7cadbdc57def7f5f758aa46b6e2fddc779770d7e395c4ac2a136a30e7c0a301dffc5565d7244fb29cd302c36e76221a3c4e21559216c078f06b0b04fb236ea14f9998776a0ae88dfeccc9ad64d2fe3cfdeb9684b7b7e5c00f7323f8214ed0189539e0e3e34c8e542c82ddbd6a75c1adbedef4d5d69b246a5a36ab802b0161908e748ed9891678c228413bf51b18a25bf776b9d1f1fedf97cf5e7de4455ea359e5796bd60cc415066fc271a2bdb7db13e72d1a99b375f96c4b5aef874037faf6a1d1aacf46a57346d000000000000000040c1051e444ea35432e022889fde59f038db4f83ffa3191116c7ba9434a7f758890f27b3acb915a7e5db2149e18c51b6db3edfdeb2ac8fe038f7987c5b38f206084bc5e8243f73e152980c414558a1f9dd35691d7f51f182393a434ba11112d7b3bf20fb62dc263b68149d8c22eb700f1e3b6ada85d949ddba3afae71082931899d138a2865685cb0d7e231838d00d1f1f104ab37b2929017a1d08f60b2cee3a49ea82b54244bec41e289ae1d7d578eed068912e2e72ffb0ccdacb8f459162b1338f91f247a2520e08c880463af6733fb1eecf800b7d074b435f1eaf608f34ddc421dc910fc282cf71114e97e5e4ab11c12c81502fb679666626e0cabdd23e7e29b4070cc18c24cf77fd9cae782eb7956e80abbc7da288a8be5869230fae230de433ef97c499e4f5ed5636b0bd0000000086c970de845572766c4e1d09154cd322f1a8c8ebe5a9492e7d148600"/3567], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r2, &(0x7f00000001c0)=@l2={0x1f, 0x0, @fixed}, 0x80) [ 2916.092049][ T7077] bond1410: (slave bridge2374): Enslaving as a backup interface with an up link [ 2916.152164][ T7083] 8021q: adding VLAN 0 to HW filter on device bond1410 [ 2916.266022][ T7083] bond0: (slave bond1410): Enslaving as an active interface with an up link [ 2916.298044][ T3124] bond1410: (slave bridge2374): link status definitely down, disabling slave 06:37:31 executing program 0: socketpair(0x2b, 0x1, 0xfffffffd, &(0x7f0000000040)) 06:37:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000e0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:31 executing program 4: r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0x101, &(0x7f00000000c0), &(0x7f0000000040)=0x98) [ 2916.419968][ T7083] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:31 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r0, 0x0, 0x0, 0x8000, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000100)="e8", 0xfdbe, 0x4004084, 0x0, 0x11000a00) [ 2916.733042][ T7083] bond1410: (slave bridge2375): Enslaving as a backup interface with a down link [ 2916.790445][ T3124] bond1410: (slave bridge2374): link status definitely down, disabling slave 06:37:32 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:32 executing program 4: r0 = socket$kcm(0x10, 0x100000000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1600000016008105e00f80e045e4b37c4cb33fab463c", 0x16}], 0x1, 0x0, 0x0, 0xa00}, 0x0) recvmsg(r0, &(0x7f0000000f80)={0x0, 0x0, 0x0}, 0x0) 06:37:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001580)=ANY=[@ANYBLOB="8800000024000b0f0000001e00000000001f4b00", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000b0001006d717072696f00005800020001000000000000000000000000000000000010"], 0x88}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x400300, &(0x7f0000000240)={&(0x7f0000000800)=@newtfilter={0x24, 0x2a, 0xd27, 0x0, 0x0, {0xe, 0x0, 0x0, r3}}, 0x24}}, 0x0) 06:37:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000f0400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:32 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {}]}]}}, &(0x7f0000003680)=""/212, 0x36, 0xd4, 0x1}, 0x20) 06:37:32 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x68}, 0x0) 06:37:32 executing program 4: socketpair(0x0, 0x8080d, 0x0, &(0x7f0000000000)) [ 2917.390183][ T7192] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 06:37:32 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, 0x0) [ 2917.607593][ T7192] device bond39 entered promiscuous mode [ 2917.613715][ T7192] 8021q: adding VLAN 0 to HW filter on device bond39 [ 2917.633910][ T7194] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x4020940d, &(0x7f0000000100)={'bridge_slave_0\x00'}) [ 2917.808165][ T7221] 8021q: adding VLAN 0 to HW filter on device bond1411 [ 2917.922426][ T7221] bond0: (slave bond1411): Enslaving as an active interface with an up link 06:37:32 executing program 0: socketpair(0x2b, 0x801, 0x0, &(0x7f0000000040)) 06:37:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200600400ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2917.974130][ T7195] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. 06:37:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x401c5820, &(0x7f0000000100)) [ 2918.053454][ T7194] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:33 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x0, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:33 executing program 2: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000005b80)={&(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10, 0x0}, 0x0) 06:37:33 executing program 4: socketpair(0x21, 0x0, 0x0, &(0x7f0000001840)) 06:37:33 executing program 0: openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x101802, 0x0) 06:37:33 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6c}, 0x0) 06:37:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000500ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:33 executing program 2: socketpair(0x22, 0x0, 0xa42b, &(0x7f0000000540)) [ 2918.776151][ T7338] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:33 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40086602, 0x0) 06:37:33 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000000a2c0)={0x11, 0x4, &(0x7f0000000080)=@framed={{}, [@jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x22c}]}, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xa1, &(0x7f0000000140)=""/161, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000e00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:33 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000038c0)={0xffffffffffffffff}) recvmsg(r0, &(0x7f0000003e80)={0x0, 0x0, 0x0}, 0x100) 06:37:33 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b80)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="63598ef3cb20"}, 0x80, 0x0, 0x0, &(0x7f0000000340)=[{0x10, 0x1}], 0x10}, 0x0) [ 2919.046962][ T7343] bond1412: (slave bridge2378): Enslaving as a backup interface with an up link [ 2919.111305][ T7347] 8021q: adding VLAN 0 to HW filter on device bond1412 [ 2919.182165][ T7347] bond0: (slave bond1412): Enslaving as an active interface with an up link [ 2919.246578][T11079] bond1412: (slave bridge2378): link status definitely down, disabling slave [ 2919.285156][ T7338] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:34 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x0, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:34 executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x1, &(0x7f0000000040)=@raw=[@func], &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:34 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0xb}, {0x5, 0x5}]}, @volatile]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000003680)=""/212, 0x46, 0xd4, 0x1}, 0x20) 06:37:34 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x74}, 0x0) 06:37:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200001c00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:34 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x288042, 0x0) close(r0) 06:37:35 executing program 2: socketpair(0x26, 0x5, 0x4, &(0x7f0000000080)) 06:37:35 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x5}]}]}}, &(0x7f0000003680)=""/212, 0x36, 0xd4, 0x1}, 0x20) [ 2920.268986][ T7444] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:35 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x6, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0xb}, {}, {0x5, 0x5}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000003680)=""/212, 0x42, 0xd4, 0x1}, 0x20) 06:37:35 executing program 2: socketpair(0x25, 0x5, 0x4, &(0x7f0000000000)) 06:37:35 executing program 4: socketpair$unix(0x2, 0x2, 0x0, &(0x7f0000000040)) 06:37:35 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000080)=@raw=[@btf_id], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2920.573866][ T7448] bond1413: (slave bridge2379): Enslaving as a backup interface with an up link [ 2920.609622][ T7453] 8021q: adding VLAN 0 to HW filter on device bond1413 [ 2920.724552][ T7453] bond0: (slave bond1413): Enslaving as an active interface with an up link [ 2920.795188][ T7444] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2920.826832][ T115] bond1413: (slave bridge2379): link status definitely down, disabling slave 06:37:36 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x0, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:36 executing program 0: bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='\x00'}, 0x10) 06:37:36 executing program 2: socketpair$unix(0x2, 0x2, 0xd0, &(0x7f0000000040)) 06:37:36 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40086602, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:36 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a}, 0x0) 06:37:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200003f00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2921.398261][ T7540] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:36 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x0, 0x3}]}]}}, &(0x7f0000003680)=""/212, 0x36, 0xd4, 0x1}, 0x20) 06:37:36 executing program 2: socketpair$unix(0xa, 0x2, 0x0, &(0x7f0000000040)) [ 2921.629860][ T7594] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:36 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmsg(r0, &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003100)=ANY=[], 0x15c0}, 0x0) 06:37:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x80086601, 0x0) 06:37:36 executing program 0: socketpair(0x23, 0x0, 0x0, &(0x7f00000009c0)) [ 2921.886473][ T7547] bond1414: (slave bridge2380): Enslaving as a backup interface with an up link 06:37:36 executing program 0: socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') [ 2921.930433][ T7556] 8021q: adding VLAN 0 to HW filter on device bond1414 [ 2922.024447][ T7556] bond0: (slave bond1414): Enslaving as an active interface with an up link [ 2922.094588][ T7540] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2922.163187][ T115] bond1414: (slave bridge2380): link status definitely down, disabling slave 06:37:37 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:37 executing program 2: socketpair$unix(0xa, 0x3, 0x0, &(0x7f0000000040)) 06:37:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200006900ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:37 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5421, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:37 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 06:37:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b80)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="63598ef3cb20"}, 0x80, 0x0}, 0x0) [ 2922.779970][ T7653] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000e8c00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000001140)={0x19}, 0x40) 06:37:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5421, 0x0) 06:37:37 executing program 4: socketpair(0xa, 0x0, 0xffffff01, &(0x7f0000000000)) [ 2923.186546][ T7712] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:38 executing program 4: bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={0x0, 0x0, 0x10}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x10) [ 2923.320488][ T7661] bond1415: (slave bridge2381): Enslaving as a backup interface with an up link [ 2923.378808][ T7664] 8021q: adding VLAN 0 to HW filter on device bond1415 [ 2923.455098][ T7664] bond0: (slave bond1415): Enslaving as an active interface with an up link 06:37:38 executing program 4: socketpair(0x2c, 0x0, 0x0, &(0x7f0000001840)) [ 2923.522972][T27433] bond1415: (slave bridge2381): link status definitely down, disabling slave [ 2923.564046][ T7661] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2923.800437][ T7664] bond1415: (slave bridge2382): Enslaving as a backup interface with a down link 06:37:38 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:38 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000480)={r1, r0, 0x0, 0x0, 0x0}, 0x30) 06:37:38 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000005c0)={0x12, 0x0, 0x0, 0x7}, 0x40) 06:37:38 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000001a0c0)={0x11, 0x20ef, &(0x7f0000019fc0)=@raw=[@generic], &(0x7f000001a000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f000001a040), 0x8, 0x10, &(0x7f000001a080), 0x1}, 0x78) 06:37:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000e9000ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:38 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x300}, 0x0) 06:37:39 executing program 4: socketpair(0x28, 0x0, 0x4, &(0x7f0000001840)) [ 2924.277510][ T7761] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000ff00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:39 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x401c5820, 0x0) [ 2924.428837][ T7769] bond1416: (slave bridge2383): Enslaving as a backup interface with an up link 06:37:39 executing program 0: socketpair(0x2, 0x0, 0xfff, &(0x7f0000001640)) [ 2924.530488][ T7761] 8021q: adding VLAN 0 to HW filter on device bond1416 06:37:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5450, 0x0) [ 2924.605379][ T7819] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2924.651321][ T7761] bond0: (slave bond1416): Enslaving as an active interface with an up link 06:37:39 executing program 0: socketpair(0x1d, 0x800, 0x4, &(0x7f0000000000)) openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) [ 2924.706382][T27433] bond1416: (slave bridge2383): link status definitely down, disabling slave [ 2924.779915][ T7769] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2924.956982][ T7831] can: request_module (can-proto-4) failed. [ 2924.983960][ T7831] can: request_module (can-proto-4) failed. 06:37:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000200ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:40 executing program 2: socketpair$unix(0xa, 0x5, 0x0, &(0x7f0000000040)) 06:37:40 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5452, &(0x7f0000000100)) 06:37:40 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x500}, 0x0) 06:37:40 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:40 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x8, &(0x7f0000000040)=@raw=[@btf_id, @jmp, @ldst, @ldst, @map_val={0x18, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}], &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:40 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000001300)={0x17, 0x8, 0x0, 0x1ff}, 0x40) 06:37:40 executing program 4: openat$tun(0xffffffffffffff9c, 0x0, 0x498000, 0x0) [ 2925.656835][ T7876] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:40 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0x40) 06:37:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000300ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:40 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000001300)={0x17, 0x0, 0x4, 0x1ff, 0x10a0}, 0x40) 06:37:40 executing program 4: socketpair(0x1, 0x0, 0x20, &(0x7f0000001280)) [ 2926.010276][ T7932] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:40 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000001300)={0x17, 0x0, 0x4, 0x1ff}, 0x40) 06:37:40 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0xc0189436, 0x0) [ 2926.124758][ T7880] bond1417: (slave bridge2384): Enslaving as a backup interface with an up link 06:37:40 executing program 4: socketpair$unix(0xa, 0x801, 0x0, &(0x7f0000000040)) [ 2926.203878][ T7902] 8021q: adding VLAN 0 to HW filter on device bond1417 [ 2926.324221][ T7902] bond0: (slave bond1417): Enslaving as an active interface with an up link [ 2926.377875][T27433] bond1417: (slave bridge2384): link status definitely down, disabling slave [ 2926.424042][ T7876] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x600}, 0x0) [ 2926.535264][T12670] bond1417: (slave bridge2384): link status definitely down, disabling slave [ 2926.615468][ T7953] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2926.747262][ T7953] bond1418: (slave bridge2385): Enslaving as a backup interface with an up link [ 2926.807291][ T7953] 8021q: adding VLAN 0 to HW filter on device bond1418 [ 2926.931524][ T7953] bond0: (slave bond1418): Enslaving as an active interface with an up link [ 2926.980149][ T7953] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2927.071147][ T8000] bond1418: (slave bridge2386): Enslaving as a backup interface with a down link 06:37:41 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:41 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40049409, 0x0) 06:37:41 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x8933, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:41 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)) 06:37:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000500ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:41 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x700}, 0x0) [ 2927.187073][T27433] bond1418: (slave bridge2385): link status definitely down, disabling slave 06:37:42 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5460, 0x0) 06:37:42 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, &(0x7f0000003680)=""/212, 0x26, 0xd4, 0x1}, 0x20) [ 2927.268569][ T8028] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:42 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000e00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:42 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x4020940d, 0x0) 06:37:42 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x1, &(0x7f00000001c0)=@raw=[@exit], &(0x7f0000000100)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:42 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2}, 0x40) [ 2927.634536][ T8035] bond1419: (slave bridge2387): Enslaving as a backup interface with an up link [ 2927.693068][ T8040] 8021q: adding VLAN 0 to HW filter on device bond1419 [ 2927.774278][ T8040] bond0: (slave bond1419): Enslaving as an active interface with an up link [ 2927.836372][T12670] bond1419: (slave bridge2387): link status definitely down, disabling slave [ 2927.855491][ T8028] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:43 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:43 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r1, &(0x7f0000000400)={&(0x7f0000000140)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000000080)=[{&(0x7f00000000c0)="b9", 0x1}], 0x1}, 0xe1) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f0000000080), 0x2cb) close(r0) 06:37:43 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'wg1\x00'}) 06:37:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200001c00ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:43 executing program 2: openat$tun(0xffffffffffffff9c, 0x0, 0x490c00, 0x0) 06:37:43 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x900}, 0x0) 06:37:43 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000001c0), 0x40) bpf$BPF_PROG_GET_FD_BY_ID(0x14, &(0x7f0000000180)={0xffffffffffffffff}, 0x9a) [ 2928.480460][ T8134] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:43 executing program 2: socketpair(0x21, 0x0, 0x2, &(0x7f0000001840)) 06:37:43 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000001300)={0x17}, 0x40) 06:37:43 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x5, 0x5}]}, @volatile]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000003680)=""/212, 0x46, 0xd4, 0x1}, 0x20) 06:37:43 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r0, &(0x7f00000015c0)={0x0, 0x0, 0x0}, 0x0) [ 2928.757962][ T8139] bond1420: (slave bridge2388): Enslaving as a backup interface with an up link [ 2928.829801][ T8134] 8021q: adding VLAN 0 to HW filter on device bond1420 06:37:43 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000000c400)={0x18, 0x1, &(0x7f0000000140)=@raw=[@func], &(0x7f0000000180)='GPL\x00', 0x5, 0xe9, &(0x7f00000001c0)=""/233, 0x0, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2928.950179][ T8134] bond0: (slave bond1420): Enslaving as an active interface with an up link [ 2929.029226][T12671] bond1420: (slave bridge2388): link status definitely down, disabling slave [ 2929.059385][ T8210] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2929.196412][ T8139] bond1420: (slave bridge2389): Enslaving as a backup interface with a down link 06:37:44 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:44 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) recvmsg$kcm(r0, 0x0, 0x0) 06:37:44 executing program 2: bpf$MAP_DELETE_BATCH(0x1b, 0xfffffffffffffffc, 0x0) 06:37:44 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) openat$cgroup_freezer_state(r0, &(0x7f0000000100), 0x2, 0x0) 06:37:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200006900ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:44 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 06:37:44 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x5, 0x5}]}, @volatile]}}, &(0x7f0000003680)=""/212, 0x42, 0xd4, 0x1}, 0x20) [ 2929.920239][ T8249] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:44 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x6, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x5, 0x5}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000003680)=""/212, 0x32, 0xd4, 0x1}, 0x20) [ 2930.033141][ T8254] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) close(r0) 06:37:44 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x5, 0x5}]}, @volatile]}}, &(0x7f0000003680)=""/212, 0x42, 0xd4, 0x1}, 0x20) [ 2930.241595][ T8257] bond1421: (slave bridge2390): Enslaving as a backup interface with an up link 06:37:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) 06:37:45 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) [ 2930.308507][ T8249] 8021q: adding VLAN 0 to HW filter on device bond1421 [ 2930.487049][ T8249] bond0: (slave bond1421): Enslaving as an active interface with an up link [ 2930.571789][ T8249] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2930.602826][ T115] bond1421: (slave bridge2390): link status definitely down, disabling slave [ 2930.824412][ T8257] bond1421: (slave bridge2391): Enslaving as a backup interface with a down link 06:37:45 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:45 executing program 2: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000001ac0)={0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001b00)='!', 0x1}], 0x1}, 0x0) 06:37:45 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_devices(r0, 0x0, 0xc03e) 06:37:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200008c0eec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:45 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000008000000000000007b0000008510000003f6"], &(0x7f0000000240)='syzkaller\x00', 0x5, 0xb2, &(0x7f00000005c0)=""/178, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 06:37:45 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000001300)={0x17, 0x0, 0x4, 0x1ff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x40) 06:37:46 executing program 4: socketpair(0x26, 0x5, 0x0, &(0x7f0000000080)) 06:37:46 executing program 2: socketpair(0x28, 0x0, 0x0, &(0x7f0000001840)) [ 2931.271118][ T8352] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2931.342774][ T8364] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:46 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) [ 2931.473056][ T8359] bond1422: (slave bridge2392): Enslaving as a backup interface with an up link [ 2931.506111][ T8352] 8021q: adding VLAN 0 to HW filter on device bond1422 06:37:46 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b80)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="63598ef3cb20"}, 0x80, 0x0, 0x0, &(0x7f0000000340)=[{0x10}], 0x10}, 0x0) 06:37:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x801c581f, 0x0) [ 2931.606385][ T8352] bond0: (slave bond1422): Enslaving as an active interface with an up link [ 2931.676444][ T8366] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2931.703534][ T3124] bond1422: (slave bridge2392): link status definitely down, disabling slave 06:37:47 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:47 executing program 0: bpf$BPF_PROG_GET_FD_BY_ID(0x14, &(0x7f00000001c0)={0xffffffffffffffff}, 0x4) 06:37:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000900eec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:47 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000013c0)={&(0x7f0000000040)=@ipx, 0x80, &(0x7f0000001280)=[{&(0x7f00000000c0)=""/4096, 0x1000}, {&(0x7f00000010c0)=""/96, 0x60}, {&(0x7f0000001140), 0xffffff13}, {&(0x7f0000001180)=""/214, 0xd6}], 0x4, &(0x7f00000012c0)=""/231, 0xe7}, 0x0) 06:37:47 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xe00}, 0x0) 06:37:47 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0xc0045878, 0x0) 06:37:47 executing program 4: openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x470e02, 0x0) [ 2932.679144][ T8477] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:47 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001340)={0x11, 0x5, &(0x7f0000001140)=@raw=[@initr0, @map, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}], &(0x7f00000011c0)='syzkaller\x00', 0x5, 0xbf, &(0x7f0000001200)=""/191, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000040117000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:47 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb01001800000000000000880000008800000007000000010000000a00000604"], &(0x7f0000000240)=""/237, 0xa7, 0xed, 0x1}, 0x20) [ 2932.923018][ T8482] bond1423: (slave bridge2393): Enslaving as a backup interface with an up link 06:37:47 executing program 0: socketpair$unix(0x2, 0x2, 0x88, &(0x7f0000000040)) [ 2932.966807][ T8486] 8021q: adding VLAN 0 to HW filter on device bond1423 06:37:47 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000008000000000000007b0000008510"], &(0x7f0000000240)='syzkaller\x00', 0x5, 0xb2, &(0x7f00000005c0)=""/178, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2933.120425][ T8486] bond0: (slave bond1423): Enslaving as an active interface with an up link [ 2933.132725][ T8538] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2933.183277][ T3124] bond1423: (slave bridge2393): link status definitely down, disabling slave [ 2933.232829][ T8477] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2933.436093][ T8486] bond1423: (slave bridge2394): Enslaving as a backup interface with a down link 06:37:48 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x0, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:48 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x2, &(0x7f00000001c0)=@raw=[@exit, @exit], &(0x7f0000000100)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:48 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000004012d000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:48 executing program 4: socketpair(0xa, 0x5, 0x0, &(0x7f0000000000)) 06:37:48 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf00}, 0x0) 06:37:48 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000b40)={0x0, 0x0, 0x0}, 0x0) 06:37:48 executing program 4: socketpair$unix(0xa, 0x0, 0x0, &(0x7f0000000040)) [ 2933.949218][ T8585] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:48 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x1, &(0x7f0000000040)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}], &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:48 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x10, 0x0) [ 2934.076277][ T8583] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:48 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @volatile]}}, &(0x7f0000003680)=""/212, 0x3a, 0xd4, 0x1}, 0x20) [ 2934.312568][ T8589] bond1424: (slave bridge2395): Enslaving as a backup interface with an up link [ 2934.346590][ T8585] 8021q: adding VLAN 0 to HW filter on device bond1424 06:37:49 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x541b, 0x0) [ 2934.434364][ T8585] bond0: (slave bond1424): Enslaving as an active interface with an up link [ 2934.488459][ T8629] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:49 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x2, &(0x7f0000000000)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0x1}], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2934.779916][ T8589] bond1424: (slave bridge2396): Enslaving as a backup interface with a down link [ 2934.834626][T12671] bond1424: (slave bridge2395): link status definitely down, disabling slave 06:37:49 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000402ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:49 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x786c3, 0x0) 06:37:49 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x80000, 0x0) ioctl$TUNSETIFF(r0, 0x5450, 0x0) 06:37:49 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x16a9}, 0x0) 06:37:49 executing program 4: socketpair$unix(0x2, 0x2, 0x73, &(0x7f0000000040)) 06:37:50 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003780)={&(0x7f0000003600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x6, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0xb}, {}, {0x5, 0x5}]}, @volatile]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000003680)=""/212, 0x4e, 0xd4, 0x1}, 0x20) 06:37:50 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018"], &(0x7f0000000240)=""/237, 0xa7, 0xed, 0x1}, 0x20) [ 2935.373517][ T8698] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:50 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0xc020660b, 0x0) 06:37:50 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000403ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:50 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1a7200, 0x0) 06:37:50 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5452, 0x0) [ 2935.738708][ T8758] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2935.842077][ T8703] bond1425: (slave bridge2397): Enslaving as a backup interface with an up link [ 2935.926199][ T8707] 8021q: adding VLAN 0 to HW filter on device bond1425 [ 2935.993345][ T8707] bond0: (slave bond1425): Enslaving as an active interface with an up link [ 2936.035627][ T8698] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2936.061655][T12670] bond1425: (slave bridge2397): link status definitely down, disabling slave [ 2936.246601][ T8703] bond1425: (slave bridge2398): Enslaving as a backup interface with a down link 06:37:51 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:51 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x401c5820, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:51 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x22, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:51 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r0, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) 06:37:51 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000404ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:51 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1f00}, 0x0) 06:37:51 executing program 0: socketpair(0x6, 0x0, 0x0, &(0x7f00000000c0)) 06:37:51 executing program 2: socketpair(0x22, 0x0, 0x0, &(0x7f0000000540)) [ 2936.763101][ T8805] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2936.887670][ T8852] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:51 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000001140)={0x19, 0x0, 0x0, 0x4}, 0x40) 06:37:51 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5452, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:51 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000001ac0)={0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000001e00)={0x0, 0x0, 0x0}, 0x0) [ 2937.085513][ T8825] bond1426: (slave bridge2399): Enslaving as a backup interface with an up link 06:37:51 executing program 4: socketpair$unix(0xa, 0x6, 0x0, &(0x7f0000000040)) [ 2937.175490][ T8805] 8021q: adding VLAN 0 to HW filter on device bond1426 [ 2937.261146][ T8805] bond0: (slave bond1426): Enslaving as an active interface with an up link [ 2937.337492][ T8805] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2937.523220][ T8851] bond1426: (slave bridge2400): Enslaving as a backup interface with a down link [ 2937.583747][T27433] bond1426: (slave bridge2399): link status definitely down, disabling slave 06:37:52 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x0, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:52 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000005c0)={0x12, 0x80000001, 0x0, 0x7}, 0x40) 06:37:52 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x10, 0x4, 0x0, 0x4}, 0x40) 06:37:52 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000405ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:52 executing program 2: socketpair(0xa, 0x5, 0x101, &(0x7f0000000000)) 06:37:52 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1ff1}, 0x0) 06:37:52 executing program 4: socketpair(0x8, 0x0, 0x0, &(0x7f0000000480)) [ 2937.967953][ T8916] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:52 executing program 0: socketpair$unix(0xa, 0x0, 0x110, &(0x7f0000000040)) 06:37:52 executing program 4: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xa91bff5bc5c3b6b1, 0x0, 0x0}, 0x20) 06:37:52 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) close(r0) ioctl$TUNGETSNDBUF(r0, 0x800454d3, 0x0) [ 2938.109542][ T8917] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:52 executing program 4: socketpair(0x18, 0x0, 0x0, &(0x7f0000001840)) [ 2938.219664][ T8923] bond1427: (slave bridge2401): Enslaving as a backup interface with an up link 06:37:53 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x1291c0, 0x0) [ 2938.312673][ T8923] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2938.517942][ T8923] bond1427: (slave bridge2402): Enslaving as a backup interface with a down link [ 2938.563643][ T8962] 8021q: adding VLAN 0 to HW filter on device bond1427 [ 2938.623367][ T8962] bond0: (slave bond1427): Enslaving as an active interface with an up link [ 2938.705840][T12670] bond1427: (slave bridge2401): link status definitely down, disabling slave 06:37:53 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:53 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) 06:37:53 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x2, 0x0) 06:37:53 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000406ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:53 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5451, 0x0) 06:37:53 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1ff2}, 0x0) 06:37:54 executing program 4: socketpair(0x28, 0x2, 0x0, &(0x7f0000000040)) [ 2939.297265][ T9026] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40086602, &(0x7f0000000100)) 06:37:54 executing program 2: bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={@map=0x1, 0xffffffffffffffff, 0x4}, 0x10) 06:37:54 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000407ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:54 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)="a6", 0x1}], 0x1}, 0x0) 06:37:54 executing program 2: socketpair(0x1d, 0x0, 0x87f, &(0x7f00000000c0)) [ 2939.645915][ T9086] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2939.725423][ T9031] bond1428: (slave bridge2403): Enslaving as a backup interface with an up link [ 2939.784836][ T9037] 8021q: adding VLAN 0 to HW filter on device bond1428 [ 2939.839217][ T9037] bond0: (slave bond1428): Enslaving as an active interface with an up link [ 2939.866750][T27433] bond1428: (slave bridge2403): link status definitely down, disabling slave [ 2939.904245][ T9031] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2940.049358][ T9031] bond1428: (slave bridge2404): Enslaving as a backup interface with a down link [ 2940.073918][T12671] bond1428: (slave bridge2403): link status definitely down, disabling slave 06:37:55 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b80)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) 06:37:55 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x74e}, 0x40) 06:37:55 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0x80000000}, 0x40) 06:37:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000408ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:55 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) 06:37:55 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000038c0)={0xffffffffffffffff}) recvmsg(r0, &(0x7f0000003e80)={0x0, 0x0, 0x0}, 0x0) [ 2940.627667][ T9133] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000409ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:55 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x1, &(0x7f0000000080)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x6, 0xa6, &(0x7f0000000140)=""/166, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 06:37:55 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c80)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, &(0x7f0000000d40)=""/31, 0x1f}, 0x42) [ 2940.789590][ T9140] bond1429: (slave bridge2405): Enslaving as a backup interface with an up link [ 2940.836812][ T9140] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2940.879271][ T9140] bond1429: (slave bridge2406): Enslaving as a backup interface with a down link 06:37:55 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000040cec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x5421, &(0x7f0000000100)) [ 2940.921834][ T9140] 8021q: adding VLAN 0 to HW filter on device bond1429 [ 2941.064414][ T9140] bond0: (slave bond1429): Enslaving as an active interface with an up link [ 2941.116229][T12670] bond1429: (slave bridge2405): link status definitely down, disabling slave 06:37:56 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x0, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:56 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0xe03, 0x0) 06:37:56 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) close(r0) 06:37:56 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x3f00}, 0x0) 06:37:56 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000040eec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:56 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[], &(0x7f0000000240)=""/237, 0xa7, 0xed, 0x1}, 0x20) [ 2942.007487][ T9236] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:56 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={0x0, &(0x7f0000000240)=""/237, 0xa7, 0xed, 0x1}, 0x20) 06:37:56 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x8, &(0x7f0000000040)=@raw=[@btf_id, @jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x6}, @ldst, @ldst, @map_val={0x18, 0x0, 0x2, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}], &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2942.218657][ T9291] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:57 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x2, &(0x7f0000000100)={'bridge_slave_0\x00'}) 06:37:57 executing program 4: socketpair(0x2a, 0x0, 0x0, &(0x7f0000000100)) [ 2942.448111][ T9242] bond1430: (slave bridge2407): Enslaving as a backup interface with an up link [ 2942.516011][ T9284] 8021q: adding VLAN 0 to HW filter on device bond1430 06:37:57 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x100) [ 2942.603965][ T9284] bond0: (slave bond1430): Enslaving as an active interface with an up link 06:37:57 executing program 0: socketpair(0x18, 0x0, 0x1000, &(0x7f0000001840)) [ 2942.671544][ T3124] bond1430: (slave bridge2407): link status definitely down, disabling slave [ 2942.729476][ T9242] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2942.961409][ T9284] bond1430: (slave bridge2408): Enslaving as a backup interface with a down link 06:37:58 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:58 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$sock(r0, &(0x7f00000002c0)={&(0x7f0000000080)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "7b3bd0fc7bdfab00e4573ef920cabc05fd65ab8ef9a5236226a3623d838044e8781d6182c383fc56a29a0da4880124f0433c2e3615145fe001246d54bc2915"}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000100)="9945d8a872d55e4bb80bfcd64273c5f04a31d5d88355eb12550e39613237804da928c9ee0f8a57cd3b7caf2899256edfcaf5a4f0297a43c727b842332539e69d5c1e78f49cdd11bdc622b7ad038ba7c8e001db865050336527c12f80dd966446b6f34aea1e46feda4b731c06fe16c8d9ef8e927b5835bc3950d65ea166dc73b0552f24896070265c25e423a1ff8df8c5d8972f7ffe7710bd36112e258b03f2a88bd928d6a2b08199786b2ded6fb234805fc5e4aea04b6c377adcf2f6841da7b19da6", 0xc2}], 0x1cb, &(0x7f0000000240)=[@txtime={{0x18}}, @mark={{0x14}}, @mark={{0x14}}], 0x48}, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) sendmsg(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000300)='&', 0x1}], 0x1}, 0x0) 06:37:58 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(r0, &(0x7f0000000080)='cgroup.events\x00', 0x0, 0x0) 06:37:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000040fec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:58 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x4800}, 0x0) 06:37:58 executing program 2: getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000100)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 06:37:58 executing program 0: r0 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_SIOCADDRT(r0, 0x890b, 0x0) 06:37:58 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000460ec000a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2943.469433][ T9351] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:58 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFCONF(r0, 0x8912, 0x0) 06:37:58 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000300)=@buf) 06:37:58 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) sendmsg(r0, &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003100)=ANY=[@ANYBLOB="70000000000000000501000040000000b9c4c82c0f918cf70aa41d1be7a67793e9d1eebea92c0f3e6aa02b64ff3fa760bd429b6d39ee1663d634073fa7752ec6254dcb1217a012a322307952ab21d260866d27e99512b6af2bf808359c0ed3dcc149e5dff8d25148c10000000000000008010000000000003a00000000000000b9fd3c7332834006c86297eefb098a75bc98b831e29a88751a6fd915e633a231eec3fb6b55f2622aa30bfe0ff85f8944332f92151195e653fdc8e689b6e45dfa55cb7b3a5f472d0699f6abd2e2d4083f64f4df1197a0fe3ccf62e11fa57f5afcc2a212988551a9b82a1cd748f975e48eccb4006e9b6cd362fd98b711473e490a4fb03556ee4c9b1be58f05e2cafea09652d0026dbe63120078edce418c5f328003010cddcece8a8d86fb23a3122ec09d0d62a2b4fe6307a0c414215b1bc106f46daa97f773296d3540baaf94d8bdb985dfc5a759ef3a18dc0c033c9a770af958bc2bc4d75c1b78f3c1266f90ad36de525b5b965486248c99c600000000000030"], 0x15c0}, 0x0) [ 2943.767464][ T9355] bond1431: (slave bridge2409): Enslaving as a backup interface with an up link [ 2943.797120][ T9409] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 06:37:58 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0xc0189436, &(0x7f0000000100)={'bridge_slave_0\x00'}) [ 2943.877912][ T9351] 8021q: adding VLAN 0 to HW filter on device bond1431 [ 2943.977234][ T9351] bond0: (slave bond1431): Enslaving as an active interface with an up link [ 2944.021985][T11079] bond1431: (slave bridge2409): link status definitely down, disabling slave [ 2944.050996][ T9382] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2944.231941][ T9355] bond1431: (slave bridge2410): Enslaving as a backup interface with a down link 06:37:59 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:37:59 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) 06:37:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a0001000202020202020000040017010a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:37:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x11dc4e41093ccb22, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, 0x0) 06:37:59 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000000, 0x0) 06:37:59 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c00}, 0x0) 06:37:59 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)) [ 2944.885571][ T9464] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:37:59 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000300)=@buf={0x28, &(0x7f0000000280)="9793af4a3ce0675d1feb3e899b80dbf8fd41d8f95409e7874c5babc930b8c1c0129f182dc32e91dd"}) 06:37:59 executing program 2: recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x40002100, 0x0, 0x0) 06:38:00 executing program 2: ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8982, 0xfffffffffffffffc) [ 2945.354421][ T9468] bond1432: (slave bridge2411): Enslaving as a backup interface with an up link 06:38:00 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0), 0x0, 0x40000000, 0x0) [ 2945.426540][ T9488] 8021q: adding VLAN 0 to HW filter on device bond1432 [ 2945.468613][ T9488] bond0: (slave bond1432): Enslaving as an active interface with an up link 06:38:00 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000080)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x14) [ 2945.524042][ T9464] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2945.601165][ T3124] bond1432: (slave bridge2411): link status definitely down, disabling slave 06:38:00 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:00 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0), 0x0, 0x0, 0x0) 06:38:00 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a000100020202020202000004002d010a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:00 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x5865}, 0x0) 06:38:00 executing program 4: pselect6(0x40, &(0x7f0000000000), 0x0, &(0x7f0000000080)={0x800}, 0x0, 0x0) 06:38:00 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0), 0x0, 0x0, &(0x7f0000000780)={0x77359400}) [ 2946.302666][ T9569] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:01 executing program 2: socket$inet(0x2, 0x1, 0xadb) 06:38:01 executing program 4: socketpair(0x1, 0x0, 0x800000, 0x0) 06:38:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_int(r0, 0x0, 0x31, 0x0, &(0x7f0000000180)) 06:38:01 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r0, 0x0, 0x0) 06:38:01 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, 0x0, &(0x7f0000000100)) 06:38:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, 0x0, 0x0) [ 2946.763114][ T9574] bond1433: (slave bridge2412): Enslaving as a backup interface with an up link [ 2946.827516][ T9569] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2946.895164][ T9599] 8021q: adding VLAN 0 to HW filter on device bond1433 [ 2946.989903][ T9599] bond0: (slave bond1433): Enslaving as an active interface with an up link [ 2947.047145][ T3124] bond1433: (slave bridge2412): link status definitely down, disabling slave 06:38:02 executing program 4: openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x8000, 0x0) 06:38:02 executing program 2: setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) 06:38:02 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, 0x0) 06:38:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000300f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:02 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:02 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 06:38:02 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) bind(r0, &(0x7f0000001700)=@x25, 0x80) 06:38:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec020a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:02 executing program 0: syz_emit_ethernet(0xe, &(0x7f0000000000)={@dev, @dev, @void}, 0x0) [ 2947.781299][ T9678] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:02 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000000, &(0x7f0000000780)={0x77359400}) 06:38:02 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername(r0, 0x0, &(0x7f00000001c0)) [ 2948.175925][ T9683] bond1434: (slave bridge2413): Enslaving as a backup interface with an up link 06:38:02 executing program 0: socketpair(0x0, 0x5f3a068f3540abab, 0x0, 0x0) [ 2948.266093][ T9718] 8021q: adding VLAN 0 to HW filter on device bond1434 [ 2948.376257][ T9718] bond0: (slave bond1434): Enslaving as an active interface with an up link 06:38:03 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, 0x0, 0x0) 06:38:03 executing program 0: accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x40800) [ 2948.442918][ T3144] bond1434: (slave bridge2413): link status definitely down, disabling slave 06:38:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec030a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2948.497659][ T9683] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:03 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)=""/18, 0x12}], 0x1}}], 0x1, 0x0, 0x0) [ 2948.806731][ T9678] bond1434: (slave bridge2414): Enslaving as a backup interface with a down link 06:38:03 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:03 executing program 4: openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='memory.high\x00', 0x2, 0x0) 06:38:03 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec040a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:03 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6558}, 0x0) 06:38:03 executing program 2: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2010, 0x0) 06:38:04 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, 0x0, 0x0, 0x40000000, 0x0) 06:38:04 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, 0x0, 0x0, 0x0, &(0x7f0000000780)={0x77359400}) [ 2949.361575][ T9801] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:04 executing program 4: r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f0000000000)={0x0, {{0x2, 0x0, @remote}}, {{0x2, 0x0, @empty}}}, 0x108) 06:38:04 executing program 2: socket(0x0, 0x9f6145a036099ecf, 0x0) 06:38:04 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, 0x0, &(0x7f00000062c0)) 06:38:04 executing program 4: openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) [ 2949.785883][ T9806] bond1435: (slave bridge2415): Enslaving as a backup interface with an up link 06:38:04 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2949.868089][ T9825] 8021q: adding VLAN 0 to HW filter on device bond1435 [ 2949.935937][ T9825] bond0: (slave bond1435): Enslaving as an active interface with an up link [ 2950.024847][ T9825] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2950.231489][ T9806] bond1435: (slave bridge2416): Enslaving as a backup interface with a down link [ 2950.291186][ T3124] bond1435: (slave bridge2415): link status definitely down, disabling slave 06:38:05 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:05 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0), 0x0, 0x40000000, &(0x7f0000000780)={0x77359400}) 06:38:05 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) 06:38:05 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec050a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:05 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6800}, 0x0) 06:38:05 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, 0x0, 0x0, 0x40000000, &(0x7f0000000780)={0x77359400}) 06:38:05 executing program 0: setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 2950.800880][ T9907] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:05 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, 0x1c) 06:38:05 executing program 0: r0 = socket$inet(0x2, 0x3, 0x3) close(r0) 06:38:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x40002002, 0x0, 0x0) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) 06:38:05 executing program 2: r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f00000005c0)={0x0, @rc={0x1f, @fixed}, @llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, @llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}}) 06:38:05 executing program 0: sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000980)={0x1680, 0xd, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x166c, 0x3, 0x0, 0x1, [{0x1668, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x104, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xfd, 0x1, "b1706722ef9ab6c9d85d543c4170c3b2c346ac060f19e4bca6e16f88045959a24bcda848957f50712c975069546e53db2fed04e5c33d1f28fdc3b413f7ebbb4bae87dd6f80f04a239b5d0ca45e1d6a9ab20d265d67c2cb9ea4e493072f09465bd5bb5ce30507c7dbc0d8513ad8793fcceb41c22626cfe784d1f1a6de9ce2eb10c6281bf588fd0c9cc0bf6f081ec9e9c8f9103c16090a761b57b5ca2b1b34da5739f5fd3adae88b78f0982c9bd11d214cf89baacd81f1204fe2c5b7d0ae350e4610db6afd54c29072095bf06ffe84d0232c82b3afa1b5fe8a02c1740464b351ab6c77b2d78a2dcb0afa74ba76e1a7b0b1d8d292aae102c37e70"}]}, @NFTA_SET_ELEM_DATA={0x11e0, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb9, 0x1, "21ed86ad0fb1fecef0b00769650391a989d2b70e8d27e3ae8dde2e975f124caad4cc5191c180da9b096330503ae4e9bacaf4001ef9f722596ac78a9b1c05c5d5d729ac511154a02e716ea2387a1ef903f6126ae09b96b8f246118a6b39c529c772c063c43e4aeab04dc1b4be0f380bc098b99c9ca8c5de9b7de0591d9c7705587f33a79dbdc1bf032df1b0aef18681b1a09d7647bd2fe144ef0d057967888ae6dded65375724b23bd2ef445b8125e85671649e711a"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x1001, 0x1, "81af411b210ef936aa712b0a0abe44a1e49cb19ef8e7542161652bc0b3578af9ea54201ca893e3f65d0e5873e0c6436db9456190b9bf2a18cd16855610d93eee30b31b90915082797ccb16212d3b2a846233518c46549300a13d65696b95e69a01cfe5cf059b3874bb159b6aeaa77c5e3ae063eefdd22f3e3e3915ce0ad67d26d752e1c342c902287828935427a64d8fa43c45356854a9e141e99eacdb433ef0d3f96209c34db2e6cb38e0567c0aa5add3ee0aa663ff8cb780a03fe82bc834f92f3209d1bc890aa15cc9969e5ba56171d5b7efe93c5e35cef601a2eac012a4cad33f6259a7b7878de5f2a8a98b0a1cea2be244184a1a16dd09ed5d39405e4a6c617a05b5ec7b22b2de2ee815e6b4f5a2791e922d2ce737152b326e37a6cb7db4a902669b67f2f890386b6fa2dc0a0d54250588fa73e189e13038f6e3ecd05f70088a6282ddb15bd5e54f07a6a6f29ff6bedfe82ad7a12bec76d18da79337971af360b822b072d747af43f263f46d575b9e6683367a7112eb4b45436674e51c37d41c8814a0d5a5c1e8203cd94d7a1af9b2cf6d1bed0e6377dd99151a0236574b5e95ec4d9fcd573a8bcabb55bb686a219f60d891a12260fe919f0432e83d8a8049dc523af79ee476724b95400724bf565299fa946cd88ed07634f242f06cf901a047269121b67d2fd2ec130dcb5ba85dbc1951ecc4e17cb05457b20c6dca54069b79a4f9d65952229da2a7fad5e8242807df5b5fd389f3280b5d6290b2a376b5a6a60f42db1d6eb8c6ccd0e57f64fa5ff898106b14cf7a82761658d5d9332ec090f7f4cc56f4077137a19c945506f801fc7eaaf363cd6a63ee13b1eaaaa38d20a5fffb0a38d0d8d65ea1dc9866d8d87cb7a5ffb00a049438acdb04a5bb7e6642afbf822bca5d6870f9a4b9232cb853d57d36ad41d3cbed73d76e774cb28b694badce60fe6b6f88e042f4bb43562cbbb97fb02233a232cef977f03427eba2036cf1842fdd2dd9971c142c0aefd9649cc461accb4f0d26dd22b087199f16844a96a9345d3d5d6f0007f80a8819e83dfc9e3ee57d8ee5cb98bf187099ef50094c7b561f23153a77c747e835ae2e16137728f5a52008f86311d2c2dd8ad2c20ae1535b11b017e8dd2a50f1a1fcbd3613154c6d95904ca111ec64b968b690f7242fce9f5bf2b7239b5c60751fbfe3dff51d5aa2d50f3fe76dd1115e95daddf39f725a7b0234976f85804992d628979ea046063e372d27f270e50409cdd98363e38c827f1e4066a20294cca31c7de0afc8d38c4837baf60d533e99a9f088a5f48b295b60dfb88af32fa0d3c2df151d3e5181272a96f8379f975cffb2d09c4f7aed47af1a38d2d2a5797a7e3c6a53289443fda2d374bbaa4f3fc4e26157927fd5f59c70e0e9c16c24b2e7c543ec60671a317efc66164f4a4cc1e6dea00e248a5040895b342b321c5c3d052389d4c65458ba2aebdc2fb1c4379b7558e7ed67966ca093c00447e017a6ddd9831d581d92f6826134ec55a61cef77aea084e4e3ec2a3014b5939327b1031f40be51cd7581eca081ebe8f047b7999f4cb1b7272b2dad34fbb8d346cee698398f6fb3068fb0c517c77a39d661072162ad8ba7f467da3b1456ecad4e7a08446028acd0d9b258e85e43851a8f8a54351d850be3fbf25713de8863833c0410ea14c4763a4685ddabec8c26da0bd31c585e928ee673c9bfc0cb72272726a03108786dbba08f690227526afe5419e8dcd63ab2265940100fa7fb85ad6155a08507b8b0be871a7bbf3828cb19a68e2b94371226bf34ba3813f2837d2bcac614bbbad4a229d35c527ab70bfa080b565ed44f2b367d13befbb1f75b271b700c0dde9ecfb78a84f2dc41fb0865f46dd097ed3e8400890b37f7341741190a684a93048cf07ea7aa0cfecc2a27cf539b10220c7d9bde592eebbcc68a381bd80b0b05822e60e735e666564141255cf15ef44ec749aa0c514d3ed852bba76a238ce9ee4ae54bb39f2da4b29eed5060c3823d9a1b1a31c5e215866aaa7c172ce2e00c47adf0927dfa2ba3dfd24c31382b39937ceb7dbc26230c1523787c1e4708280ea242a1d9a725650f0b676006d2b15f544d92a1ee7c77887a12cce6b3d4e91d947f8bde6b075642d720c0d87a87cde41b4cadd8465159ae0fbf704b61842bf95f181fc4d8e5e89f49d7776574aba7c1c3feb45317d354fa6fabcc68feba1440dd28034ec9a973e767e78ff4f5fdfa902bb65c1e62b119e21772b137987946de2e3cbca0264943756c9e1266953d7f20b894dfc572cf1fb6cf974e0cb382037ece2d7f4982be672ef43f1480b524f807bcd03d1ea4b9cf224efcc2e2d4e661393e0bf5a4232e29aa6bd0cfd41cdb57793206ddc193ec37831091dcce0205f357a9ef9d3a5bef17af8b08564afd0315d328c4e04d3c43352256d08d0648e90b72077914250c2cd9299bc6e890449880df8a15c3a54f644e19cde9467cb6f37fffd95d92f3c99a4c503bd2fa2a2939ef78a7e9b5a86477ea52352e349e61de0a0ae92c36c29dbd8c9f33ec6b5cd7885e36cc7b717d5667cc5c68099842d89bd2cd62f4062cc0d274e36372d21fd2fd0f2d29bafe3e01f002b3f7778f8b7aa25f5030b0be14cf2139345dd6aada02b120d409c374cec7e57efdae809195e3c1084635744fb4689ca27b08494e5a06bc8d59dca37caa80ffd2262aa63770a8d19404149b6e0cd52e3ec1ff90f8cb47c95331d02c4a79a5ac3961a19fe710ed2644a10c3692cd403a974481ddbb049d55a1047ab66c3818b41e026c51938f66d50e20d9aaf24134712a9b789811b2633a4800c0cfc2bf315e791802ee8190fa67246acdd4fb0f58ef92f2cb6bd796dc7a75bc99f477c3b9acb0d3bbe54e11570c19fcc054d947265ea28d31077b65d68c179d86d5aaf3e8c1c9a2c2ac6889a4e0b06dd90f1d4a257bccdb67d0699f1489fb271bf595f4a8385beef6305986f4bb1aa3adb49969455732dad4b74f091247877b9cdd89056628cf48f4ce210c5e2eab80ed28874cb3af84c7d525e506408b83cb45eac76688bc971226d5b24d151bfd6b82e0f14653f3e63a0eba9b2c6ea361c0bb71bad1beef105533b1c790458da7826e8ccc70c3e822a500b4057d4e6d47fc36ebfb059c60f166dbd0ea6e86a1d36f31f900eef780e3134281d248b35fddcbf016c996fa039479983b7ae698c573860cb674e6ed5b09e4e8d1c29d6b52e05670aa968efb9072a383a83ada9cd0d11fab362ed2b3d15c3bdb11304c146ce041c0a0a1168b5c80f95ebf0dc44fe2fe1f179bfab71fc2ea6568ab3cad2224bf3b839db56daf74959ac5ae4c20929488d484ade95f8ff58996c1f05b82bfe434c18c625dfde030a967090956b0e71c5170a7d39f27c2f2c803345f2af994bd6478fc5fa5deb3800cedd16e68bda21358e6bf4b168839fda0fa85f9f5844a24482626801ef33656a7deb19d4515cfcdf39171798689f2f7236e2cde8bca426562b045e25a945642e6d1259149e83f56b37c7086a063a23fdbf9b02a2bf12a14fbb012aea480eec9a60db979f17b194863f1665e239fc538c593099107c2b0ecf743b25630199226bcaa84d0e2b0c4aff4ed8d0378d7c993d4f4803facd82f3ed44bd5186f4787d1d3c98d6fa19721238db9ecb3e1d588b5f7f991707171fe97e2bfeeda5a2b1599daed53ea3b3714468e8c0f7ead0e5c426761069c44299a085021c8fc71a20c40c8447c0f02b38fd9e1f41566aa845c83bedb6f856e2c3dffbad84551c688e88b948baf9de9cfd9452a3e8719aaca5a805b74bd3b0d7c469d3b74db5540bfc094ec972bde7fe94064c8f5dbbfea644a69317c9601a6575d5648906ffa7eecb2c140183c4deae9f8ede54fd8cd2f0e43db0abcf60b988a73c322f86638ec2820395102cf6377400c27807d9004f4f874d404b4c755a65f1e7a081e62212fe28ed68ef944d0214c50576e65d07fc6f401b5ccbd5e894d301d0bac2bd988091537baf9b0c56aad337903ad0645d50666c76be4154a60b754f6feee7ed0b64adcd91c2e90350c570a37711eee7562c047871e7dc3be1588a789f59dff37a60da89ecfe5eb0a4076e1f96c27fc58f7cf2473687ca455ac5c171f6f1ba295b67c35e0dd7c1c9a7d49be0e3b1ed2733f09e64ad3f1fd37ec4a0bf39880aedc3d87593fef1b21220a5ca011cf71bf21c4b5d0b4492bad8886613fce7525545839bdcb94f4d13b85ecb18e74afc6f0630e2241de7bc5747867477fa65d65e1af7eabe38f50c8db2a5ec93a9ecca9e2447dc02625c134d7fbc4e7c265544ea6feaff72a4f1bb3b5520c6a752d110c7a98e9aa22dab244bad7cf9a64b1b208b4482b131c36e886f14fa8728d87d0881db179ecab5412b4aadbf05bd84774b3bfb5ea56f4306e789e8f3cdbd19d59f055dcf4550f159fb038213ccf07f72eb5d044a67b536e44c90193a1c54d577ee22a03af7dd63c73c4652ab718a61fceb8fd14c73f57f547310913f6447d3bad280855778c04ebd8d60e8d0cee4755f1fa0cacce6b1f7f25c044e773235f528225902c894be49ba65121bd6733f6a861f13abc9267c1107d8da7bd8a39f019b06a3bbb02bd194e52d040c0f419ef8d2f870c422a960acd72067412613620c5d19bedfb59490563eac4861638db10d7d9408538853c80bb11585fb57bae28262d4a2966e8134194819849b6f864c8cb75a27b7517d55de31acb8107c2b992529702e181783a57f740a47dfde733e550a9c9ef559ea10de4a615830d52306800c7f144c4a9e2cac9342340f3369cf94ba67853760cd6e4e5a398f4084388205f669486500b9a7d083a01288be1d1e25803a9bbb30cc4b491362389d0d8ea91aacdd5fdd31b2e06c2da5d7c69cb4b3a7c292bf9be9f53662119680c1be41726b973e0706f6c15f23dfce97f5a701aad54f0815c373932e9b381915b6134482d63d05e4a328cb7db2a8c22e35419a259603452fff237379ef6cb6e6bbd09b2282aac01fb4c4b10e1debe6f3d615d6d2ab9457f772a82b288f57f0ce69172d9ecdf49996249ed56f1cae6bfe1e616bb7c9e4c82a26223b4a73665bc1d366887d877926505899758b4d8a98f43e84e4260f0b878b1602c5bc9a7c01bcfdcc622d1b2f98b0d6c15c4c7cf187d1047f51495bc4f6eeff4bbd432e67dea754c5eabc90a5820113c212eb0962a5d6fc4a3a83ad2671adcb16428d0658f2c50d1fd6e58b3e1215b34a0b718c745e0fe792cb132065e8c8ae8290f5f753a78ecb8449ce9946d7f08ed13af6805d1518a48eaeb0f546f442516ebbf843607fe7c201fbd712b371b840bb4106e5d78e6bb127adb68fb1bcd721271e3ad225b9636da9897dd06893ca7767f3c2276cddafc77ac51081925b8adc9b76a8f079f0257b184bdbfacdfd6ac0175674e2e46a0c94dc469814ed18356f5b1af676f578d7c6c1f06d42c08883da5203c03f906a57c124f581507fe9ea73020a22626de1ea2a41f6f07318ba5740aa931bfb46b463208b8d6faabf37ec393a9967fd92878328cf51e3bc30779d4d807fd68b37ec7a16eb026773eacd39528127e12cb61ac65317e36fad1d5499b54ebbc1f100a0d293704e3be017dd076f9d6ae9bbfdcc8ee51aa94b1faf8a25134cbf4d994987b6b23543ee88f0dc0f614c3f7950c9dc55acdd10a4a75e8f59530b168c8be3830895ef2021675d5f2ce90d069a1a48001b793fd0c8535d118a08d4077a58780d7000226d214073182fa47cae55d3cdfd9f5e08fd20b"}, @NFTA_DATA_VALUE={0x8d, 0x1, "f01e5cc7cb3112af2e3b0de6335f1acfbfa201fe95f2cc51ac1bb6e2ac8dd9f3923be1950e7967087f087a74dcbe33ce68716286c57782c109faebf2400280e4961c7fff1149294db103d0f7bd32273ec052d7a5e1a4b6434555c8b1e99a606598095e484772bc8845a9dbf78daf34cd6f9cfd0af5899d0aa4b25d2c81c656bc5ba594b473de26b24a"}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY_END={0x370, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x70, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0xc1, 0x1, "9e0a71b1581d1f7c78f0465cf514454710955640f06cce3f083470deb3fb2b1a93b67892d96515c0066a8c4c33c70d2afd1de4a80db073d12679f62a0a861390ccbd7733865b6b8fe482879e74427d4e32068c3f89f4e837f4eb17140f71554f5e7ca12219e014cb317f9bb1323c9943172b98463d956e0fb2885e33bf01bfad6d9e6be1300d8aca3b4c41f3b1723f6e49df0e3b14d99e4579e0e3498b3ea2d0a24d055cf93e44b69935cf812343314438a579dc200fe088358edcb49f"}, @NFTA_DATA_VALUE={0xf5, 0x1, "d4ab83f7b6231ecd8bf72bba675f11acd57273c5e5cc9a96943f23804f8c845259fd5bfd4dc8c1b528b5508521ad2922fe05c4467d97c7deff02088083a410af8bb7c079be2a490256354e4e3e3f20f51b2a72018d5000a87172c8d6ec129b950082b3e65a23283ba4f3ca481a58bfb34e051add0044dabe0399e89c9a98e4fac0563767caf793f21d2098c998ceb29423355e02cbc84f92409492a7944ca9967ee6ad00c9c9a4d5184fa8df4bf90da2e29b997d3692476363088b015c7fcbbc105253e29b42f61b02884a0d8b4ce19c9dcf694ab3c37aeae14e657ccb3cc97dfc7e1118075e09aaebb6a9062fb5e6677d"}, @NFTA_DATA_VALUE={0x89, 0x1, "f33bda620c929cc45c61337dc4d3bfcfa44251b770ce64084ed87077a768454c85a82aef67087696e44b41568d47505a379cf38a6f73721f5dba2df355ec1fba6e135ce68f8cb3c19b142739045f62297a62598a3b9726240a07db18843bcc515269def778b20da4688c7e932af94d8bef4170c421ed98dfb5a62ef60c7be7cdf7ed3ab0ea"}, @NFTA_DATA_VERDICT={0x4}]}]}]}]}, 0x1680}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) [ 2951.208587][ T9911] bond1436: (slave bridge2417): Enslaving as a backup interface with an up link [ 2951.274145][ T9907] 8021q: adding VLAN 0 to HW filter on device bond1436 [ 2951.400125][ T9907] bond0: (slave bond1436): Enslaving as an active interface with an up link [ 2951.458170][T16224] bond1436: (slave bridge2417): link status definitely down, disabling slave [ 2951.502933][ T9911] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2951.700849][ T9977] bond1436: (slave bridge2418): Enslaving as a backup interface with a down link [ 2951.761552][ T36] bond1436: (slave bridge2417): link status definitely down, disabling slave 06:38:06 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$netlink(r0, 0x10e, 0x3, &(0x7f00000001c0)=""/227, &(0x7f00000002c0)=0xe3) 06:38:06 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec060a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:06 executing program 2: r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_SIOCDELRT(r0, 0x890c, 0x0) 06:38:06 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x6c00}, 0x0) 06:38:06 executing program 4: r0 = socket(0x11, 0x2, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) 06:38:06 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) [ 2952.199350][T10011] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:07 executing program 2: r0 = socket(0x18, 0x0, 0x3) close(r0) 06:38:07 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec070a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:07 executing program 4: r0 = socket(0x11, 0x2, 0x0) getpeername$unix(r0, 0x0, 0x0) [ 2952.433586][T10016] bond1437: (slave bridge2419): Enslaving as a backup interface with an up link [ 2952.457446][T10022] 8021q: adding VLAN 0 to HW filter on device bond1437 [ 2952.522727][T10022] bond0: (slave bond1437): Enslaving as an active interface with an up link [ 2952.556610][T10011] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2952.599020][T12670] bond1437: (slave bridge2419): link status definitely down, disabling slave 06:38:07 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) 06:38:07 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000180)={&(0x7f0000000000)=@l2, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/148, 0xffffffa3}], 0x1}, 0x0) 06:38:08 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec080a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:08 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x7) bind$inet6(r0, 0x0, 0x0) 06:38:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x7400}, 0x0) 06:38:08 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom$unix(r1, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) 06:38:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r0, 0x0, 0x0, 0x40002002, 0x0, 0x0) recvfrom$unix(r0, 0x0, 0x0, 0x10122, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) [ 2953.564450][T10119] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec090a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:08 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={{0x14}, [], {0x14}}, 0x28}}, 0x0) [ 2953.956048][T10127] bond1438: (slave bridge2420): Enslaving as a backup interface with an up link [ 2953.998643][T10131] 8021q: adding VLAN 0 to HW filter on device bond1438 [ 2954.056479][T10131] bond0: (slave bond1438): Enslaving as an active interface with an up link [ 2954.094950][T10119] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:08 executing program 2: r0 = socket(0x11, 0x2, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x2122) 06:38:08 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x7a00}, 0x0) 06:38:08 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec0c0a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2954.185196][T11079] bond1438: (slave bridge2420): link status definitely down, disabling slave 06:38:09 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) sendto$unix(r0, 0x0, 0x0, 0x1, 0x0, 0x0) [ 2954.327477][T10194] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2954.718483][T10196] bond1439: (slave bridge2421): Enslaving as a backup interface with an up link [ 2954.766706][T10219] 8021q: adding VLAN 0 to HW filter on device bond1439 [ 2954.837347][T10219] bond0: (slave bond1439): Enslaving as an active interface with an up link [ 2954.887901][T10194] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2954.976168][ T36] bond1439: (slave bridge2421): link status definitely down, disabling slave 06:38:10 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:10 executing program 0: r0 = socket(0x11, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, 0x0, 0x0) 06:38:10 executing program 2: socket$inet(0x2, 0x5, 0xfffffffd) r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r0, &(0x7f0000000280)={&(0x7f0000000080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)=""/243, 0xf3}], 0x1}, 0x100) syz_genetlink_get_family_id$SEG6(&(0x7f00000002c0), r0) 06:38:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl(r0, 0x2, &(0x7f0000000040)) 06:38:10 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x8089}, 0x0) 06:38:10 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec0e0a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2955.703413][T10257] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:10 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) connect$unix(r0, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x70) 06:38:10 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x102}, 0xc) 06:38:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) setsockopt$sock_cred(r0, 0xffff, 0x1022, 0x0, 0x71057e02e47de5d2) 06:38:10 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x10, 0x0, 0x0) 06:38:10 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) read(r0, &(0x7f0000000000)=""/136, 0x88) 06:38:10 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1002, 0x0, 0x0) [ 2956.066281][T10266] bond1440: (slave bridge2422): Enslaving as a backup interface with an up link [ 2956.174788][T10257] 8021q: adding VLAN 0 to HW filter on device bond1440 [ 2956.309944][T10257] bond0: (slave bond1440): Enslaving as an active interface with an up link [ 2956.367794][ T3124] bond1440: (slave bridge2422): link status definitely down, disabling slave [ 2956.406079][T10266] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2956.630852][T10301] bond1440: (slave bridge2423): Enslaving as a backup interface with a down link 06:38:11 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:11 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f00000013c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)={0xec4, 0x0, 0x0, 0x0, 0x0, {{}, {@void, @val={0xc}}}, [@NL80211_ATTR_TID_CONFIG={0x97c, 0x11d, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5}]}, {0x8f4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x100, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x30, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x0]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, @NL80211_BAND_2GHZ={0x4}, @NL80211_BAND_5GHZ={0x8c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x21, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x3c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xd, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}]}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x1ec, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x9, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x80, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x11, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_2GHZ={0x80, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2d, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x39, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_60GHZ={0x54, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x21, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x58, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x160, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x20, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x30, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x4}, @NL80211_BAND_5GHZ={0x9c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x9, 0x2, [{}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x25, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_6GHZ={0x60, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_VHT={0x14}]}]}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x470, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x1c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0xd, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x110, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0xd, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x45, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x2d, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}]}, @NL80211_BAND_2GHZ={0x70, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x41, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_VHT={0x14}]}, @NL80211_BAND_2GHZ={0xb4, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x49, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_60GHZ={0xfc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x0]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x45, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_HT={0x9, 0x2, [{}, {}, {}, {}, {}]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x41, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_2GHZ={0x58, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x19, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_HT={0x9, 0x2, [{}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x68, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, @NL80211_BAND_2GHZ={0x60, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x29, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}]}]}]}, @NL80211_ATTR_TID_CONFIG={0x528, 0x11d, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5}]}, {0xc4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x7c, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x78, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x31, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x2c0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x284, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x9c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x9, 0x2, [{}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x2d, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{}]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x25, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}]}, @NL80211_BAND_5GHZ={0x78, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x10c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_HT={0x25, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_LEGACY={0xd, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x35, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_HT={0x2d, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_VHT={0x14}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}]}, {0x15c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x144, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x34, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x15, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0xbc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_LEGACY={0xd, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_HT={0x21, 0x2, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, @NL80211_BAND_2GHZ={0x50, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @NL80211_TXRATE_VHT={0x14}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x0]}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}]}]}]}, 0xec4}}, 0x0) 06:38:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec0f0a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:11 executing program 4: socket$inet(0x2, 0x80003, 0x0) 06:38:11 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) poll(&(0x7f0000000880)=[{r0, 0x4}], 0x1, 0x0) 06:38:11 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 06:38:11 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec600a00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2957.112408][T10386] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:11 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1023, 0x0, 0x0) 06:38:11 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1005, 0x0, 0x0) 06:38:11 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0xa) 06:38:12 executing program 0: r0 = socket$inet6(0x18, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0x18}, 0xc) 06:38:12 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) getsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) [ 2957.646090][T10389] bond1441: (slave bridge2424): Enslaving as a backup interface with an up link [ 2957.767981][T10392] 8021q: adding VLAN 0 to HW filter on device bond1441 [ 2957.917151][T10392] bond0: (slave bond1441): Enslaving as an active interface with an up link [ 2957.961480][T10389] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2958.190570][T10392] bond1441: (slave bridge2425): Enslaving as a backup interface with a down link [ 2958.451414][ T3124] bond1441: (slave bridge2424): link status definitely down, disabling slave [ 2958.451491][ T3265] ieee802154 phy0 wpan0: encryption failed: -22 [ 2958.479197][ T3265] ieee802154 phy1 wpan1: encryption failed: -22 06:38:13 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:13 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000000), 0x0) 06:38:13 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000080)="9196d29a9001437be7da0c8d05b308d89d18ef5ab64ee01e9d", 0x19}, {&(0x7f00000000c0)="1b41d9cf68fd3454ed586679ecf0094d764792eb5ce4d5afed32bf507dcb8efe93cc9a09a1923f4d052c9eafa538544c4b1c0087767021aad050ab297dd6ba9d9a95fabf255178e5733d3ea50d9edc5f569fae3e751e8cbf140e454a32bb98111996f5f37b026d69939bd6ad3979bc7339c63506bdc13612d6cb9ff7e521bacf1fbbbcd53cbeee609ecf8b26872c225792a0a0186ab4d921031948c67850188b2fd9bba8a4129e2f30c2aeb13fb65bafe476cfe40cf979526dcd266418", 0xbd}, {&(0x7f0000000180)="35b8ff3466fe56e25b79068da13ffb44334f04f3efb40c831eefb49c29609423e425c30ca654e2e30dea218140e050be4324dc7a11a03aab353e136e4bcb10a5a3dcd49c09c4baf46534f7b21574fe65111120cbc0f614150224f561c3eda303d099592062fd0c0fcda101f99157583e84c2b34732476aa50cb8c4be1c8a2cb58117ab87bd6a01213a3e3b410b29f45f794aaba3a58de6ba11a81c7d8a2d032adc4dbdcb475bc6bc4bf4a1187f58b66b351eeed9da271954a86be94195675116841266d897093488d318f6d231fdd688853bc1062fbe5ec0981fb13b7c93d24f860163b876cdd618fc2c6b37bb9730bec6529b0953a0ddd5b4a5c294101b27", 0xff}, {&(0x7f0000000280)="fe4b10ed7bda0f0b5c8e0142f938f090eda453b96d59c4d9aad0f18aaf0592a8de182c9e0a6235dea1122be0f3432d6f1b5e2822a2ac13d50df7766bf89df8d620a15a0d2a06bbbfac57dc54fdca8986fd27595acf182ae7acadd7bdb067881ae7df095f227944733d489d1f0560", 0x6e}, {&(0x7f0000000300)="e5160005cdab6eb61270ecb462ae74dc44de05e2faa74f33ac99281731688aef48a0adc4b7701b5cd891d9e610a1521a13a0dae2d4127821086d947b7a726e391aaf1d0bb4ee0a441ee40d564a37cf28906b19751f81471b8e7aeab49d33849add49b9b404d97f4174a8ec9b711d80fbe758a7a3d2fdd6c5bfda58f329ee343fd9d7028ceb2741779df253a84955bb46160bc10971708b53fb0dcd8f6122d175bc0c470052a6ae0341b0bc1219f3ad652a63421a0b29500031fd14e141a532c148cc05bf0d7b7ea41a63446c221de918c071c651d36ec2864cadd11add13c8ba2c9bd36097d4e123c43e3b53328288bb6325b03c2a9230744eecd301e3b68c0ed69315e24068f81067a83242e985e7c91939f9e312b7ccf0f7f2c0aaf7868aefede418b01839babe7f78aacdba0e3c26f90c5aa229ec68cd724d8f3ff821c11dda0ab4f0e4f807d9e4f510974b14cb8f9b17bc2cd956f003d6763c4bdb0dea165ad8d6bf81d745063718a6a035b4de0c57484adaee4314c04c9d9d4b14bcc823a1753e61b47a1a534fedde83cf76ac0087349ebed8dfc95af6f6a9bfdd684395203e2516b2dd59cce9635fe3137389a90cc541d0d46a9c80343f86449755b5b495e8c202b22bda8b7cc5d063674308eb3816a31ebc3ae7b660b193023275b8f26b604e9b067831579768d52cb64c1213cb1a17ae6fa331702407387444c36f2d0f1d930a01043c0166d89bd8938c95a43a759e77171f090b3c479c767058a146f13bdca5f7e8c4c46662eb5da3cea62c49fb0f1f6bd7e5119bd3757457410b648054dc73cd109915a530fdf6c71308a0263a2d2d345835507703fa71bb0886b0a69b1c89d7470c0274c22a9efa4fe92ff460bad166d10bf29f602fd808bfa427ac050c024b0aa0ed512683aeec67d6dcc37b5712742d9c22c1e36859f53eafc7afa44052ade224e83e044df4f6ad90d4003ab34497f9f8e747d318fc16980e66f3c67946a953ac102920daf76218509d0c3c8c940089f09a66d5b8f9529c83e1c23aa38e46feb285a8b459dd58eebbcffe2d69c00c91cb2c6564f7364e87c1ce1f121b69541da67320e1195268f229999051379f3351046eff7abadd7ec64ede714035abf396c4236f80b3bf93597161b7b88caf14ba6f1171377dc8706b89d3c71c5ba6f34dfaaa50d727a8f6dffd6e8a30910705fe85e8027832e1ad5421df343c1c6e962d689cf9a945e4f7a3d2a0eaa07f2f40a43804f5346d2224843fd7130d10d30a208f8a6a4a2eeae645e69d3407a736eeb3d7133ae1657ccfad85b1e7786b3c0b7c068018d17ab36dc0cd4ade6bd119a89de6fa5e7a502801e0c3ebacd7f9341bddff3000ee744db0f5a465ae3da16889be14f8adc66cefb32b3bf1124a9d410f1add3f874459886fff9c0a1660f97b6e0f58a87b527337459c83dc0d23431b9d655eb490c4480baad831ce9460e3f0d4f19ddbb2a625b1a71ea6be815353eacb0edd8134cfde222186b186f4155ff1e6da4c24d40283e5344c4cddc1065492284511067947643314827e54eedecbca4925be1fb1884b6c6b660c0c8b1d3b920b42ffebc09d51c56e42f85b55d2b4338d9f39a4e49620b63d98eac4dbc645761805699e66e09110f0cbb088d2232c7caaef322a5ee0be852cf1aa66f2107b744788c87d4338d82d8fd84eaceb14a6a09440cc7e84124236bcf47174e6fbf4a860b59f5abd89194a78eb10b84b67a85f0526cf9f9130c67d0d551d516abb3fec732aab661f317459568a08ff6d6a5d116eac3d9e23f09d4ec61fc64caf56b2a65d92f796adc8466ae5d6708416c067da15964da588a9c15ea3b83f24940ea68c438001c7fb8d9e88c9f8bbb2fa0ee75473bca84357edc930bea46873c1", 0x541}], 0x5) 06:38:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000080)="9196d29a9001437be7da0c8d05b308d89d18ef5ab64ee01e9d", 0x19}, {&(0x7f00000000c0)="1b41d9cf68fd3454ed586679ecf0094d764792eb5ce4d5afed32bf507dcb8efe93cc9a09a1923f4d052c9eafa538544c4b1c0087767021aad050ab297dd6ba9d9a95fabf255178e5733d3ea50d9edc5f569fae3e751e8cbf140e454a32bb98111996f5f37b026d69939bd6ad3979bc7339c63506bdc13612d6cb9ff7e521bacf1fbbbcd53cbeee609ecf8b26872c225792a0a0186ab4d921031948c67850188b2fd9bba8a4129e2f30c2aeb13fb65bafe476cfe40cf979526dcd266418", 0xbd}, {&(0x7f0000000180)="35b8ff3466fe56e25b79068da13ffb44334f04f3efb40c831eefb49c29609423e425c30ca654e2e30dea218140e050be4324dc7a11a03aab353e136e4bcb10a5a3dcd49c09c4baf46534f7b21574fe65111120cbc0f614150224f561c3eda303d099592062fd0c0fcda101f99157583e84c2b34732476aa50cb8c4be1c8a2cb58117ab87bd6a01213a3e3b410b29f45f794aaba3a58de6ba11a81c7d8a2d032adc4dbdcb475bc6bc4bf4a1187f58b66b351eeed9da271954a86be94195675116841266d897093488d318f6d231fdd688853bc1062fbe5ec0981fb13b7c93d24f860163b876cdd618fc2c6b37bb9730bec6529b0953a0ddd5b4a5c294101b27", 0xff}, {&(0x7f0000000280)="fe4b10ed7bda0f0b5c8e0142f938f090eda453b96d59c4d9aad0f18aaf0592a8de182c9e0a6235dea1122be0f3432d6f1b5e2822a2ac13d50df7766bf89df8d620a15a0d2a06bbbfac57dc54fdca8986fd27595acf182ae7acadd7bdb067881ae7df095f227944733d489d1f0560", 0x6e}, {&(0x7f0000000300)="e5160005cdab6eb61270ecb462ae74dc44de05e2faa74f33ac99281731688aef48a0adc4b7701b5cd891d9e610a1521a13a0dae2d4127821086d947b7a726e391aaf1d0bb4ee0a441ee40d564a37cf28906b19751f81471b8e7aeab49d33849add49b9b404d97f4174a8ec9b711d80fbe758a7a3d2fdd6c5bfda58f329ee343fd9d7028ceb2741779df253a84955bb46160bc10971708b53fb0dcd8f6122d175bc0c470052a6ae0341b0bc1219f3ad652a63421a0b29500031fd14e141a532c148cc05bf0d7b7ea41a63446c221de918c071c651d36ec2864cadd11add13c8ba2c9bd36097d4e123c43e3b53328288bb6325b03c2a9230744eecd301e3b68c0ed69315e24068f81067a83242e985e7c91939f9e312b7ccf0f7f2c0aaf7868aefede418b01839babe7f78aacdba0e3c26f90c5aa229ec68cd724d8f3ff821c11dda0ab4f0e4f807d9e4f510974b14cb8f9b17bc2cd956f003d6763c4bdb0dea165ad8d6bf81d745063718a6a035b4de0c57484adaee4314c04c9d9d4b14bcc823a1753e61b47a1a534fedde83cf76ac0087349ebed8dfc95af6f6a9bfdd684395203e2516b2dd59cce9635fe3137389a90cc541d0d46a9c80343f86449755b5b495e8c202b22bda8b7cc5d063674308eb3816a31ebc3ae7b660b193023275b8f26b604e9b067831579768d52cb64c1213cb1a17ae6fa331702407387444c36f2d0f1d930a01043c0166d89bd8938c95a43a759e77171f090b3c479c767058a146f13bdca5f7e8c4c46662eb5da3cea62c49fb0f1f6bd7e5119bd3757457410b648054dc73cd109915a530fdf6c71308a0263a2d2d345835507703fa71bb0886b0a69b1c89d7470c0274c22a9efa4fe92ff460bad166d10bf29f602fd808bfa427ac050c024b0aa0ed512683aeec67d6dcc37b5712742d9c22c1e36859f53eafc7afa44052ade224e83e044df4f6ad90d4003ab34497f9f8e747d318fc16980e66f3c67946a953ac102920daf76218509d0c3c8c940089f09a66d5b8f9529c83e1c23aa38e46feb285a8b459dd58eebbcffe2d69c00c91cb2c6564f7364e87c1ce1f121b69541da67320e1195268f229999051379f3351046eff7abadd7ec64ede714035abf396c4236f80b3bf93597161b7b88caf14ba6f1171377dc8706b89d3c71c5ba6f34dfaaa50d727a8f6dffd6e8a30910705fe85e8027832e1ad5421df343c1c6e962d689cf9a945e4f7a3d2a0eaa07f2f40a43804f5346d2224843fd7130d10d30a208f8a6a4a2eeae645e69d3407a736eeb3d7133ae1657ccfad85b1e7786b3c0b7c068018d17ab36dc0cd4ade6bd119a89de6fa5e7a502801e0c3ebacd7f9341bddff3000ee744db0f5a465ae3da16889be14f8adc66cefb32b3bf1124a9d410f1add3f874459886fff9c0a1660f97b6e0f58a87b527337459c83dc0d23431b9d655eb490c4480baad831ce9460e3f0d4f19ddbb2a625b1a71ea6be815353eacb0edd8134cfde222186b186f4155ff1e6da4c24d40283e5344c4cddc1065492284511067947643314827e54eedecbca4925be1fb1884b6c6b660c0c8b1d3b920b42ffebc09d51c56e42f85b55d2b4338d9f39a4e49620b63d98eac4dbc645761805699e66e09110f0cbb088d2232c7caaef322a5ee0be852cf1aa66f2107b744788c87d4338d82d8fd84eaceb14a6a09440cc7e84124236bcf47174e6fbf4a860b59f5abd89194a78eb10b84b67a85f0526cf9f9130c67d0d551d516abb3fec732aab661f317459568a08ff6d6a5d116eac3d9e23f09d4ec61fc64caf56b2a65d92f796adc8466ae5d6708416c067da15964da588a9c15ea3b83f24940ea68c438001c7fb8d9e88c9f8bbb2fa0ee75473bca84357edc930bea46873c197a3a5ef995ff5d92ee0dbd4f01b4a0a2ac76023f372766b717eb3bbd6519e670a4820e8f098de00cbdab35e95ff9d5dc3bd6ee40fb1ff657b7bcf8cbd206a9c8a7ea7c952c3a9259755b40faef9a17d68755a318716dad6e3a9027c7a9e77a52dc920caa59982018588b5652960349783178172cc70cbf6751a8581b0", 0x5be}], 0x5) 06:38:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000c00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:13 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xa916}, 0x0) 06:38:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d00)={&(0x7f0000000080)=@abs={0x0, 0x0, 0x3}, 0x8, &(0x7f0000001140)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) 06:38:13 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec001800f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2958.611153][T10506] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{0x0}, {0x0}, {&(0x7f00000003c0)='/', 0x1}], 0x3}, 0x0) 06:38:13 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, 0x0, 0x0) 06:38:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, 0x0}, 0x0) [ 2958.962014][T10564] netlink: 'syz-executor.5': attribute type 11 has an invalid length. 06:38:13 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)=@in6={0x18, 0x2}, 0xc) [ 2959.085815][T10511] bond1442: (slave bridge2426): Enslaving as a backup interface with an up link [ 2959.154070][T10520] 8021q: adding VLAN 0 to HW filter on device bond1442 [ 2959.243356][T10520] bond0: (slave bond1442): Enslaving as an active interface with an up link [ 2959.291532][ T3124] bond1442: (slave bridge2426): link status definitely down, disabling slave [ 2959.357709][T10506] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2959.546352][T10520] bond1442: (slave bridge2427): Enslaving as a backup interface with a down link 06:38:14 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x48000000) 06:38:14 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1001, 0x0, 0x0) 06:38:14 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1022, 0x0, 0x0) 06:38:14 executing program 4: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3011, 0xffffffffffffffff, 0x0) 06:38:14 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec002100f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:14 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf000}, 0x0) [ 2959.997524][T10627] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2960.025032][T10625] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:14 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1023, 0x0, 0x0) 06:38:14 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x4, 0x0, 0x0) 06:38:14 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) poll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, 0x0) 06:38:15 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) write(r0, 0x0, 0x0) 06:38:15 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000080)="9196d29a9001437be7da0c8d05b308d89d18ef5ab64ee01e9d", 0x19}, {&(0x7f00000000c0)="1b41d9cf68fd3454ed586679ecf0094d764792eb5ce4d5afed32bf507dcb8efe93cc9a09a1923f4d052c9eafa538544c4b1c0087767021aad050ab297dd6ba9d9a95fabf255178e5733d3ea50d9edc5f569fae3e751e8cbf140e454a32bb98111996f5f37b026d69939bd6ad3979bc7339c63506bdc13612", 0x78}], 0x2) [ 2960.453675][T10637] bond1443: (slave bridge2428): Enslaving as a backup interface with an up link 06:38:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec006900f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2960.512280][T10645] 8021q: adding VLAN 0 to HW filter on device bond1443 [ 2960.631087][T10645] bond0: (slave bond1443): Enslaving as an active interface with an up link [ 2960.704899][T10627] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2960.772417][ T8802] bond1443: (slave bridge2428): link status definitely down, disabling slave 06:38:16 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x0) 06:38:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000300)="f1bbe5ec09e361149535ff5bbe93582da68114f891855152aaa6d4bfb5493234d7dae84c5173d07a411cffb33a79e2800b60983c8242792efa822f838b77", 0x3e}, {&(0x7f0000000340)="ecc4b427b3b985118a019b198c7c3e5e432e89522a5421ff7f1646df87ef2d5a2918db6c2cb8e4d4954d712fc30e7f34e52ca4165af634d2612e8f55a04e348806bee5e59d1bed23dbd06f0346ecf4302ec3a7bbd1", 0x55}, {&(0x7f00000003c0)="2fdac1e34c5407b64e5bc3c07e2a845ced2e4cadfe7dbfce9ffcdf98aa3dd59fbb2a82a10b528142348c8888910f411e07fec7f056170c70de1e6ac88cac5218df01114233ae7d8cd32120f679e6442857f1667e92c9159f281f58e62ce4af18242cde18c7fea0befb0ea85ab791ebbb2c8bbc8e606ba12e23fecaca388dc646d1e47ad300c74b90a9dff1e7b66ac106415c37c640c5bdadc3427ecf02d34ce72ae931e8d63ce92461b8fc91a05fdfc7c25b39c788fc4021fadbe6194297c7417d6bcbc5fbfbd76ada678442207c11650775cc9d259914b7a4205148a83c", 0xde}], 0x3}, 0xe) 06:38:16 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x3}, 0xc) 06:38:16 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0xa) 06:38:16 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf11f}, 0x0) 06:38:16 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000300f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2961.427133][T10751] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) writev(r0, &(0x7f0000000640)=[{0x0}], 0x1) 06:38:16 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x2000, 0x0, 0x0) [ 2961.551412][T10772] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:16 executing program 2: writev(0xffffffffffffffff, &(0x7f0000000180), 0x1000000000000142) 06:38:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) read(r1, 0x0, 0x0) 06:38:16 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1006, 0x0, 0x0) [ 2961.887307][T10764] bond1444: (slave bridge2429): Enslaving as a backup interface with an up link 06:38:16 executing program 4: writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000480)="1d5325eaf445c49de01259a8678f66bf9bcdc334ac89998423096041b8f42379fd7fd6e2a81024595d02e75c2f3979b0e675bb5045107a1642a0dc0f2b6193a78cbc973747b23dde34644fee222aba608e6cef4f31de34d7885d7c79727e2337837dd4df3f58b53a6ac06c769846986721d1759dcd16749535c54fca02b56e4d2c5088e2159a7918f967865f0cf178e5b270d3d90a4d9747c6e4927b29f48f64c8c65f797f510b37c50b6894c8bb86fe0631aa28608e8857e0c75697deecd223d212bee016b3e7838458d4583c7192df2867efb6e3f521d648e4eb1394bca5bad2042075e5b94a7daa769083f9953a8ead8c9519d7ea5122ac3cf3074cf0a7bea588761ee179365ac92d93771b8630910d78902aa98b442b1908d7fc1d3eda8ba581bb0c92795ecfb954b62a7f07bb41b69013a5c377a00c99fc1ee3daf516e54dbd7b62b71f13991aae9a2f1790cf8167229efa3f353c6c83c8910d2ec87b42fdc64d38f21eae9e79f931df905ed58f489aaec65d8a3f20f71870acdbfb52e77c28501cd317d4e2a94200765f6e03b4a35e27d5675dcf999f1afcc12f5f756c8804a4c2d8beead27851350dab4adcff239fea16dd9c9059f147927e2bcb80e68e5d6dce3bfdc9e212f8d4e82ec9a5c8d31e4b0633031e4c5600bad89ab8ab6e34737d7e00"/494, 0xfffffffffffffe04}, {&(0x7f0000000140)="9eb8801627122b69e578e939b85be687", 0x10}, {&(0x7f00000001c0)="c8137cc28d4b6cf00d37e618c68dc73bd9e99a5d27adca2230c06330d784332ad6bea7bd4135e55da6235282d3f2430c8ade28eea1d795321a88bdae61b246792f097c6bc1945a2f5b3d3371fe4f04b51c898311c5b8f6c25d3122b92392da1a64ea6e077222e4a6003e95c24de26c57a78fd8b3", 0x74}, {&(0x7f0000000300)="f70f1fa5a05c9290bfc872255cd9770ae4855a5458567206c3a988d962221f58ea6f629de62aceeb", 0x28}], 0x4) [ 2961.982289][T10773] 8021q: adding VLAN 0 to HW filter on device bond1444 [ 2962.116921][T10773] bond0: (slave bond1444): Enslaving as an active interface with an up link [ 2962.203124][T12670] bond1444: (slave bridge2429): link status definitely down, disabling slave [ 2962.255788][T10764] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2962.376329][T10764] bond1444: (slave bridge2430): Enslaving as a backup interface with a down link 06:38:17 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x0) 06:38:17 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000000)='3', 0x1) 06:38:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000001140)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) 06:38:17 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) poll(&(0x7f0000000040)=[{r0, 0x5c}], 0x1, 0x0) 06:38:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000c00f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:17 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0xf21f}, 0x0) 06:38:17 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x0, 0x0, 0x0) [ 2962.888776][T10864] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:17 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec001800f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:17 executing program 0: pwritev(0xffffffffffffffff, &(0x7f0000003600)=[{&(0x7f0000000180)="062080639fe4227f6c8f81c19f20f030bc37a0cf9641f783109a492c1ec8018cb4394628c1119a94ea3dcd17b663cff7b4ab8f300f999221cc0f81c4b28648ab44058019cb627522c254bd3bf189e0cff4b92f622ac5bbcec2ac8bfb8689b43181e50a5dece7a7fa7b20d98d87194358b4ee9249b5356b48068056f305ca047035f496c216abf561addf29153718abf9c3aa1a3647bc5efa4ce687aaed670e9fdb436e31e36c902ee4124759da51996a240231e78376c0026496f3cc90def5a50c82db8e9dafae651e3a264019a19e0567c3678d5d05f2544c2bbb7c9001e6c0430589", 0xe3}, {&(0x7f0000000280)="15abe5000050dc4036d6138ea9279a503a8c4df32c1455ac6f95bd31bd8c40db7a5b8bbc8a4bab5e232d137391674851506226981bfb9dbd15c96471947dd27d8cea1b6a888ad2087236bcea7dced1a89031531412fb30b1e61705804ed95b6a62d4127520b6c12210df7e625caf04807ee687f3540435885c1a1412d7091009dd8a85a035403ce071563feb35cfa15a373c9c0c60a830008b7e5ca89f8aaf4fabd79b172f4d209f41d1e6a69df10504e5c0df34457f3683c09e1f8b1701b867ced694162899d3d4eed9df6144db0af47d80d797aceb40f8e3541fa197165b61f268743aed99cdcad2449751196a7d4301efdd674807", 0xf6}, {&(0x7f0000001500)="ae96cb5a12070b0882ffa221930e29921ff114107acbba55656d613b354c50a2a2e199a603def4cb6df6710b38ecf0c9e47495f82f2c24a07e7fe0bb624a0f47bf187e3e55c09de6a6c157b78d99a8f2eb3a4b33687a12565663017e08a23ba940e7f81b5372ab6706f7d98024ea1136aedbfc23fccbf56977d052c80a01797ca89e", 0x4c}, {&(0x7f0000000040)="8ced255300ab151f484b907daf6346c125c53b39ef09e57b3ccf", 0x1a}, {&(0x7f0000000500)="c7258f7ffbccb61975696727eaa1ce3eb3e1530617fffec6fb9426ffeb7508b4f42526b81851b5e26e4b088ded25cfcc53083e6c268f8613f6e03cee21796923160c00f73f29ecd8ae23427077e71ddbe1d3684a86d667c069547a26a8149c6f36091752b5574fed41c6733690822012ae2288066fbfe9be31c3b1eef9a0b124340583509842b1eb4c4bc6aaf8e9ca2df263d73b07392e132f1572a4afce077d801f03e81058b101a2ce66065468874c0ffb1cc96e625f46f4e65ce83a78b5bb1686e6bbc7a5128129799ff62f04e93e9b17e296d6674f2496dfda8abeb9a520d5ca9c14ae82800c9c5bb2f130d27dd348b916dacff2af4efaa12bcb2d4c90cd8ca37d983853e4618a591f078ac39830657395253d2d8a425a50e4c2b3a72b19ea120481198a91660f4de5882683910451b13bef1c8ae632b4ecd7f3a858ae599f5b7a7429100d54e59f716d42368b6554c7f318fdc078c63418861683ed08d39d04e447c8e83317c4e9d261ad9b68a0a5bf653267c82f58fd4ba4febb31b8614f8e94de455bf4b9608bfaed8a05015a55359001ad40e23b9b9cf69e450f18174d91a4a922aed7201933fb3283e31486b403dfa1089b70b2b9099c3c9b6b90201fe3e9f6a9cfa73b50e863dcc0d125a1fb0e693ada683c29dc8a6b076a69f1820c66ea272e2780baa1d9e0ca672602ac78c3174aab7adc9213a86334f1d3f311e2724c35cbe403291ab4f791398e88c51add461f79d1fae73f7e248dfdfcced11d563d7a99d226b96f7ff1624194635417f959c49997c9e626ac318b4a7d3b49336b3e28156f8a9148d43423832607119f608040af6300163960dc40d95e46538be347eee5b4daee309c4070b8512bbbb4f10afc47c7af2eabebe8bed6b64f5dc6cb777e831caa9da406d892238afd0b698dfbba6ecb6feb9a9c7a1c67f4281766552cd02b9a19905fdd0d6e8663ebfaebb6dc2b80896f40749459a44620534b8fcb5595f85789b1792d402cbfbc7e3f43a8e959b5928ed8fe02d75c7d71f559a67f5f027c8b548974a33564f03597e4e6e4a1f2605c3bafcf137d90996fa482cb7cac28a35c7b7e607aafb89d791f020cff3cba982b2bf70f779d3109ef4a9e4c00980dc58b532361de755491e73a6ae8ffed13e1e9f7bc994a09af1ce6b5381fb30d084619a36542d99e625dc75184034a460d1bc4be853373a0617014f493b41cf8b99494c48b7058676603718eacc62009841c6ff6353e145ff418e46a15ceb9722486d92dbe7c91740f4168baa10e01ba94086a4e5f8a7cf981ead2e49d67e40225cb7c1f548a0b0abc52f35a7ddf596e2a91a4604ea9e5f4905c8f3689fed0fea413b4a0332a47f5073fafc0f80af5fdbc5d28b087fc1e2bfc5e771dcdcdd7862fb4aa4cee63f9f062617fcc4a8e37810c425ec7ef266b427b74094ce5758a8ec3a1387c54e3cb450173aef55885ab1db4c3130f3588fcb64a232e993fe6f6f5e5893f667be073545d022e9045acb63b727602b430aecde6e0bd836a47d0d3271b3b61a39895791471d61e932efc36feb98223abb70ea50e8f3551d834f74f7f11f21fedd83a2a04daf0f8da0e70fb3c718a8e7c030a95e66562d242ab03039aa357422965b43077a1897b38820f277d0cbb50c0536bae1cbe8d7db2ee0c4d2acf0493fc9634be9f7da7f2e383fde825b288cb9259b4664be31a9946e560274853de6c9290eae956ace1884beb7a09cc456bc3e24c1e1305ccbd8f0c87c3827381d807c5548dd5b04f875c83865bc992f5fa2395e68bdd1558578a9733a0bb08ada75cef26cc33dac9de6003389b51b60f4d1079f1e83d6f8c21c7f98524da40160b4dc48962c9297606a26ddde7d04fab781817657eb8d0d1cff88837c50cb8b8fdca8b29d3e431d7155567502b72c68777761173ab130aade07aa05eaaa85ea116fea20c31bd5dab095553e5333309173c1d17fd50d75b0dc93a96270f090901fdddb2dee27fe9774d9d3c2babf0177b8c4efec2afbde093873eb358361d30c4255fb6022d09107a86de02b538525a4593c2192f0ad4200f929b8598a0f6a1b9464c5702b21ccc4f55a9460c056aac64c3d5a1d1a54ade6e904c9e19a5ec2d531e99815fdd9222473478301b887e167cec27674fd087569b216bf9ea6b5eef5d711a7720f1959a684bb107778c0ee6995107ab980bc0c4365814e9020899f6cac3ee44a338dd44af3ce2bf047b22979d3ebbd4c1a78ec687ed24703bb56eff0456c4077b5f6e1b32519b43176e4618fb17c4bab295165fa6e0623adcdbba3667c0f4cbf53ff1157d5cd6d3250ac75d22b426332b08e80881daa2953adb29189356a399f870a4355e3c5a8043dd4a7b7f03b20e61abc960a7fbb7e40dfed20c52dd30e7943cc42fb6b21a6caf8e34d6b2e8d117c4a73b9946cb5f13fa04b8644d65819b53590fae10086caaf693dd672c48c350619798812e2197554a10a00d04a6ec3b55011ceb67e9c9cfad4122f8e9a3deecec0dfa51afc5e6673d68b24e1b10e8be9b0e6f04fe8d04eff6d29010772804732c863d79b5029196689ed562c405e4989582626da5bfa3ff630bd5de628da63a62b73eaa023e48698387eea36fa50410619757dd4de370aacb054764fa28ebaa925875c672bde8cee3d277f3bf5706eb87e570e03d06e49ad52e91c9837839e5b432ae7e3744555cf7004add696f79af96f4315e0e2448807c0a2bd490ab6e0917b041760456c491454f9602794a8fdce245dda175fc62070f80c45a83c9efa493a74672103052791758edd6edb08add498205e7a29b1f44462d0ecfa16a7c7eeb2bb51d784b9f93baff9cde650afaa233e18110cecb5dc3003b271c9953a5aeeb13e1b073a69c2105ca71e71e4959e01af61d74d78ec89ca090c3f8e2de2918c96f2e7f979a139d90ec734957c47f072548538ccf5e489e9cd24b3a259aa6b53de061d0fdf25dbda5503928fdfb0e0518f5d985de7b6f64f2019e6b8f970c54e0e9edf3feb9dc5b162af4a4d5149f0c9c28f3dd1223c55f5bf2b91045c7029ff747a9a73851efe6a36f245b8c71bcdc1e92775dba19045ad81997e81c25433b5625bbb84c33948335eb0a2f2b55b2e96886cb73c7a09adb008c6891193e044172f8a48381d8363ee3cab62c1a7894e4e384bdc4cee6037883deb50f8a13e4b5e6328a87c145305a1f6f46a226450374ef8f611359d2cbe271047b1ce217185c4efd41280b85b06bc1d34779faca3a39ebaf4298628e124cb039a024cff0611e88558f644036a1c2a158f4105d63797d71d81e3f87034409306d549f921b15e19fbec982ad66b393ae3ce050e011d5fcb75acbc8bac6c20afec84922cbdce8fb121247894bc5e3accda54fb97c7856a76250eeec8003a8d32da63a6ccdda88cc92d9a2a8dfa3ba2dfe31547e16295f982159b54f66dc5153f1784e86e832ac1f945d3c7a9c038387e1c6bd078e2035a5d3ae02089bbddd5f897d4f045717004542dd4c3e30af6f7dae777f28e920298b27e2d8e18a65720c6d74933aa4535e49179203f4092443fb78cebc1e7f04c27baa179199ab0ac5ad644a44d74d944e1b253105666a1e6411320707f46672f4faa12b9eb7256d8dc0eb862dca42e96fcde1312252c8b50729a49d0f8ed559ceaaa08e3d32ff607be8f0af27967bdae265a927f5968a2797fe09cd4bbaaa8cbd49c220ce984e0b29b3ced6597aa386c0c00f990a3e6e57e8c7d46faf676c25bc02f22f871f181361833c909e3297a5901f1790d0858693a038c0a1f091314de1ae14e566710628425700496b7918bcdf9d798229b242c399f6a42aa14b81f737c4156ee31bf60b68768980324d9e9b74158ec1a101c17818f48a7e222419f7239d6e35ba5e62f50ecb706888c5efecbf20d3d08911337a4b167b91d01fac60307cdb8fefbe0e0d7e1b1410b7d844c24019a065d0ddcc3f8dfb986e7a6f2d007db6a1f1a4cd0604fa659d9b9821336bb366f245af208f5cac708aa2b24843d7ce52529ff6f039cc2d8b085aad9aa1b90fb4dd2b15ff7730ba9b5737514edb7f4fd1f50b3b4e69560a080384ea2ed2c2e80b460449d91efe76eb8615505344ddc0ab7052316ccc81a3980075947f58cd4345588293c856bad603db31a1fc95112302f735d05789cb9cd1a5154182ac462e806cde6713d8b9bcf094e0994c8beeb896f7444be47904ce97beed4d6d2769f349d75cf72ee0d9b7351cd939aec5f442d7667cad22056a4c459ac4eaefffa1c3b57710dd9a021c230cfcc5e69eee4f85e17a8820efee84cd3d8ec918b952587fc5da17098bc2929560e2d21745f9796814c8a36e6c9aaa9f1779e773d1862d45c093ed2fd57c7682a9dc1dc382415df7db48cb273985026919e51ddc569ca120e6e55593ff147dc7a65ac4792c9f6435bacb6ec4c0093dde1fe69c0e9fe2299a7502fb71a56dcd673c100a7950a0c6bc8a37e4bb6e46acbe6172b4e0923db3aaa1dd92a4fa21d4ab4835100369d82678e4d395b49328d1a3c6b203c71dd67777cd29eccc5a7f20c9a69ff1cfeb0f6990f1a13a76b51f026d8ac7ed5a3cd24bafc8300282ba3b61cba3076e55b992e46ce5795e7b1042425cf4c6ba0bd15456135a68360233b5a6a30ce78b561c3de04fd89bdd81e3c344742456673eff5bceedfe64a43b62b3877b72682f159ab08a1d9433bd32ff962a081fe1151fb6e16d8ef7d569a430e4b39e29959b0c8cc9a9cab3f54e4c92cb8b41f31164e2b36e007ecaabd1dd5ab3d118e4abb53d88b7cc1dfc75d414a20d9398dcb6119dbdefe07dd6209c4c90009739768e600b3ba060df3b66a7c878aa673305d8a92badbc542cafd0e6044bcbf21d480324fc236a0b06fc41d483dec64f5fb4a2e3aba523e8da550fe8942cc4e26cfafd0451a29c25496cd8643b36b18929cd2b8920a1adf875d6f6eb1395b495edf4a017419f1a92f7201a616e4f3bdef9cc199bedad86d629c4670d26d1cb1845382568b6a1e278580b90388e8bfe52774921280d02636c61bcb602f15a9d7f350805f0b4caed1465e542af88b466811f3a5fb59c3c04a4d4f4f12aec13d94e5f24f91ac3e5ab2345f474828ba99a30f939ed808b0b2e8d5f41c4d2e94fafef973db8f803d103f3e2f853cbc1cbdf810fa6aec36e90e13792f8137e60d634a2f47baece57963658f445798e08e73b9faeb35e01329269e5207329967d45ee2d110f229b2b6c0ab32f757bf7208a4d340c0266e07b98c48bf1eb52d4d3985b8ef5b9781b0f4a0958a3a6c3d3a99d6aa20252970ca434cb369a4c68490aa80419c53ad7a5dac1686982acbbb1595a4172f760a980aa7e53c434d5b2bf5c9023e7262fdc1d05c6d4febafc591ca14ea26edff83bed858c185a4582f75c920dacc8f8173af0141c6cf35e03f62db8105c0b0afcf6602d86159cdc95e7c569c315322427a8b56e2f21708a4d526c3b2e55354326df04ec183bbe7ead2a76b6414f3d3de0c4439cc8ec7e65fa1f46b6ad942313eea5f7f75ea0f0f1469c8e2e74535af377d6c45e1f1afecbc5b5467ef7003dc2d590ce843804c54fc9af1ebeec9ad9c9444e6b8efc3b349916c2752848d02f202274054f996d887edb475852d45c6519b7b8a3693365e28766c06676e02cf46baccb16d9ff2b872ec3420f64a934a41990b3a2484494ab7101f331c1b510371e9ee30352961594195292bffd244c5ebbfb84a5a414895ac175a9369d23df839bc91288c228afae54cae4ee4965310f69ddfd", 0x1000}, {&(0x7f0000000380)="b262c71de733934396d59523a05b92c215e2c954ee09c26ca54a00aa1337ff47190d", 0xffffffffffffffe2}, {&(0x7f0000004bc0)="5614a5a10efe3dc39663f5054a35f15b793e06479b6d688e95a5cf9094ca0ee5b801b593c7865e09d246ff354d3a1bfd10a0542dc92b18de59c1e57205d534f6244394f57295532c730062c3eef3bdf0a15a57456062bbf054b32f5c49bac34c3bc7591d9313b7c4da77bc899a765ee9abc5d738686dd81b77d7528d5080d1a7082431556b0cc77b27334b6af7da9be5203cab83206f1a7a22ad0f571fcda8524af6a049e3577892e534b22ab51f9b977176b0e22146413a0e705c4a450a944ab34a4a59586021db003e699f7b45134a7dcef9b1d53c14e522d2cc815255189e8e8cb308336100e9a1c15b594dae2f67f2db975c5b0f6d", 0xf7}, {&(0x7f0000000400)="fa2c978e8406476403df9daaa92bbeb5530c4ee36fb553e6378cc83e", 0x1c}, {&(0x7f0000004cc0)="5c37f4c0468f0efcc8e1742694a9551422be29d516c26b77c6ad7d8cdec14f1deeb3f393513049b521fd6037c622790bdfd7824e9bbcf960e758c71a9a3e099ba221d34e3c45292bd0b08d898641c0dd6ceeeedaf6e53a037c17975a73d7fb61a3643aee9495a4a05859fb4b5612d012d677437e961d60d57c778c49e2e28bd9464e4a36bc90e264183de845f600e8fe5bb2d5a7e97dc6113791791327a6e420e170e6c4cce111c0b947df0344bb4789a7dee5c82051ec9c87a6af721019c54533a44b27e2067ac15dfaed1d81082abe22fe53b01698280238c15822c414a232e65606ca4fa26129a7ecce7bfaf2701b11318f45ea2144036cb0629a982f4fcfd23fadcdc48da65376c6ba279250631df00ce6488a2b7d5762f9f0dd049136e536d520f0f3fef5febb5c8313af7f1ce1df0395bce73f3a0b22c74760e2da597852f9e53f4592120d058967c5585dd46c90a86c083f97bf6832184bfbf115d766acfc82b8e9dc9e3cb810df1eb97da94260d8b2740a92a645f486232764346b91f8487d18b38d41a36a72ea219d0f568c3b0a3c3df3ad323cbb5e9d4a01e7549c2eb7fc8f6b36b98e6a55248dcbec805cdc6a0a5c22b58cd698f2af4ddc5f331edc342e659ac85a11cedd12bc3a8b40f9909e9c26c2c727b76ce11b5d37fc2bd8ce791d215868e21e3694a5b09b56fad7e4100c2666e713d7d98a0d15bc3401e1785b7799d935d48f4dc609c3bb74308e3872bbf2e10f0a744d289bf73b777336e9725e3c6029ba0a0b6b2d52ddee33f8408f22cf205af0d19518b8938078fa38dc0b9b2441ee879e0f0164f20a0d980fcb5f48c8affbe6f9459242a5a1b32531a48568b2974e948749a73fdfa4472af924d5d2997a545364e9369cbee0099b98f5546c03a55347c74255bde949dd404b687a9718d5aced29fc318c845fa6aaf8ae0e5879831cd802ec48e7248cc1c4c08a1c92f274a53936a602b09865c64d23c017599ff2c755e52f933d055fac7209961fb3c582fb9dd6885a26f59ec6648747dad459b7a42b3ff45527125e20fb868aa321079e1f791ab01c95cc567f76dc47cad5d80777a7cd1fb98d52d004bda8bf5d2498ebc6d25c35fd381adc80b9643284999df95cd0686f3b451d00663695343d2274d4882cf2cb638df1678020194e475a7271818497bd6393b286f1940c6a6b51864586f1f44f729cfc2259dd6b4e782c0c55554e5cbf00bae4f604d0163d8acef3de15a6f6803a844371db2d61ce45c5c5976f530fc06d494c3dfceb7a9c8b105442df5f6a8e8ab5a0c4a25693454db9dcabe8baf3b263f7e5e134133ba01a17981042850a1b3844d939632771bd0dd57bce12e1f246852069150e08adfc728c6431980c4a6b53baa23acb3e6a5214376652c49e0749737cc404f552a0928417c706e9e1e79d919f28f9b2bc293e86328c3e57ade46fd4aa60b8d6dc53475227f78d934d40bfce066ab1042299ddedc3be6045d7a03948b972a51d794902ceab5c6520133d498b987d192b3e040f525e7addb7a7ce74701329476157042a5a6dc15985595d22cb7850e687d30c68e2052abb1a153fba5935577052e716dd096b0e1c5fca9b855bf8f55c693aba889cc62f1c981fb161ae8d6231a4d36ef1f115e6208741e84c3a00cac53835c78638af5242c97e6f6cf27dbfad5c0422f28d1669d891e10086050898980765b8c109cdaee7a4c9cfb25a18e821645c4c468fa750d02276cb28e3440073b0a7fe01687531b8795f4fa0293c04807a17a7e5ea2d0d1340ed9a38d6f7db6bafed01afebfd9ae4deeccd3084b62ce9be734746d079a731788d54e6206d0f2705fa9c6aa0f119bfe3797dd3fdd36616240eb9b890b346b9fd1c5ffb603d58380aa4c123d7276201915f0792709df79e14b1c9a8305afd9956d158eb0a3d6aa9bd3e9bcfff32743801527817b01d4954a33092698c7af0f08d764a3cf27311d82ab71a9b77a7646aecc739d6cb78f85c92fe6ff8aa119bb8498aeb15ef9ff4e351be21b54c638767a41ffe4cbc2a87bc5944a032d7bef4d833bdcee108ef9f198bc7009b1f9a6cbe27eea10040e9fe9c691ea2428ffdacc48d9b4a09369d89c44ec52b920c553ec023323738722f82fd5e2b448912bcb81118e3edda55c900a7d60d5cf49fc7d8f5cd34a0fe30bbd90f7eeb8e1cc6830ddc69e90706745ef08f113031551c4c48ba136ad4da068a821e30b3f70ef60523b1cb2ee5d08e9f0d31548f60cef0f7050a580565d27724424d8bab36453b9e2e4ce279fd99329897aa5a3ef050dbbc9855473b412c966bf641851185f1f6f6c008854112461d1acf4d773d0d802c4bda35c82eaf93f665192f5273b9e946d40c847d2a11c46f489190a1dcbcf8abc0451ba922209ec62a239a970ec15725ee526017ff5c2919e7563b56e87c230dbd0cc00242c9c50c100e8f65ad8237027a0fed727727175f60f200a1a50a062db6cc89c374fcf8364568d724a73f09be1a44e33efdf89799ce2e98bcb61da7f276c6010c5aaf393cf4ba3225b27c3965fe81908750e05815775d59f8ffea0b089f6ad7cebaa506c854e17436ac98ea756bb2a6389b611e5d7f54ec5d76c1fc6c1d6b31de93b71e07fd33c52eb55f8428bd9d111bce0e0d921f8848fb744bfbfd0a46f8f33e3bca528ff23b8d5a2242d5830c38b0a9824f5e82561da284c0c982ee10e29b216199a592fb3b217b25e310b6a48203140f1a8431f35b31f69e337205d85128290fd04f9d23d314979111a8d59ee485bc816267e7a6d5643f3e1b54bf4524b803099993c2a594da25e7ae9845be5f3819f2e70f61b43f21cf39fd28f3088538af6a9b28388aaa1b3c1db16b97a393c39a3f74f192d867471c5250a57663cfcf54ed988b7c20ecb97202812e5a1be6ff5916dac0f84effd3578a3b2e3d323f5e6958d0f82e022559941e8477c7c65978cefa8f0565bdff17793c959639f84ef042d2ffa722cd1918ef83173b2c409d681705e6a0045b5f0ab8c81c3c39d581fff624d70d39f695a5f01412d4f3d87a98f16ef7a4620eddc9a921a550b2ecf640b61ee03fed93864ff7a00d123c017bb77528ec1cc3c2af3230722a06c282d367d3a3af27b58682bcffe695397c5edeb7fba034139d29cf0a59d22f3ff4b717e11fee1af91142e4c5b41afbb4aa068065e499748fd447b619cb1cde6fa1cbff717f370cb65dd9f14ca2fb85d85dbb3635cba5cfb4588bfd630483f1bef015cda5880a8706142c6f750873773ef7d67bce2b7d067fe2b776d436950f3e3b1a1d28c91f23eacf88b4ac568f8cb53d2aa4b68580b830ea2fa4cb649a4c3b435089cd74c730d56d3ce1a75683fab0db1d374be9d96ccdd5ba8ad03597768d022d4df8185042db5a37811187f12d1abec95dd1e04e394f6b92ef958ffc1cb23ecaa6353df8364b85d7458a6294971103592592a1d47b5f94daf1fd10f30c2a7d6ddf0e6e932fe95089f16492b49ae8a3d39da275e036ceaffe81f708fbe49f7f75511cf2c5f3c305d8b7292c9ca7b24b2d67c0636f4c9d4f2fe468867d9ce9c58da2a1c77e3f078b1069323faf2c941323ce148199bb3daab80be7ead56e8ab1afe35f449cf56dd82b9f94f4152bc65cd49b8a27ea716facea90aeb424c836831b8e7fd8c411c82577929cbce42e55fc9a53361ab02e859e0ea983e654b780bec263542120a9f0bb944ae1e81506e4dfd713240ce8b9c3add484fdf9a6287113aaec8b388165e9edc274fcd2b6c5d0a8e82da70ff2113b2a5a0ad99cc21f6a4cfd27c629b046685190ec83b41474e47997427530ccfd9b0885efbfc6f72ad10951496865a17c9d2daef2e081272f396b1bd6f71455343345af94a92daef1d4bd24d394c64dee6fc545a3720b1bcfd878fa0d438aea6a55d2e2a2604bd2ed5a9f426d1edf43af3a31d67edb099390d9eb404418c9b39b03c93a4399a46ab5ef16e78aa2b830c071c32d750ace800febe88f66dfff79b09297a736f8672454207e74b6ba7842e482b190b044c9afd9723d048173194d54e610db915db89b54cf20fc0cd26e27678b5e905b4c7f6b2c153bf4f72ef9f0d5017cb9f84f64d9d4f6f9ad7c9b2e94eecdef1d4a8d7171e520488f7918083f0148a16496aa92e2f401ebc511f7c633dce1c3de07616828785c95f1b4ad46e1e13198f65b501e0050b7340365b73d61a26bd8ea2c4643c0a805ee409d3342d16e5157b87e2778f7b53167b814ee4757318f6ac6c11b9b5ac9af9d1bf6b3e2009c5902b4db326f28cd0da31e2f4b3bc135ef2c186c04f5e2e3f0b3c5d50ff25aa3431522d38fcf16bd0d47cb4fb2abf89deb8cba9fd64e3e5259c2b4890082eeff706f45247e05b3208f603aab59a4f33cb56a4ed162950ed7a04ee5351a29c5df34b195f836c265999effdfa548f25854dff7790dd00de53068f2ee108d6b296511446a784622eef6dec51f543ccbef5ead2d1b4ded6490a031cb9437a4869f039ab880cc7eb13aa7693bd70e51dc190826bf3300538fc037f19b3efc2ca8f4b87bf06d62eeb520a8361ff845d5cef0d29cc6e3d7446624e42f8f482771a0f6244f3f5ce826ed6c32bbb0dbcbd6b5a7ba5c13ccb451de3ec85d1a956023e059925be9759f5ddebbc516adc5e11f632969eeeaef379047e30c46a5e6946018395c3e751cd733fc1fb3ec42fd2d3ab06ef8d1f1070354b7ff4f28291dc26408e02ce39a2064cc843f13107e96484f4d715ec4b613b83099d48c98896e7d36430e480f980daf1c35826976e2bc03145ed8ff100a307101ca523f84df44f76ffc8d5b1d1a3b13b13bc2d4474f7d90c8bd2c9a283fba7447c631d9df6d2bfe54b67b81f5556314b512b9b11ea5824fb0e66a21b42b68c595ae8bade56dbc4b289f310018025091b8efe39058eda8116b530f80170b4bb9e259e236e42b17273fc6a3f14e55bf323c1d3a1bdedd0ce355068fc4146c89e95997d28c7a4b29f3d415b7f05bc0aa764734d23fb4232c8c2657bd3b563af1d6088557185a0761732800445a01e545405591979a414a0a9dd1c1baa43528a2621af3a425a22ddf31700b1fc050896f2f7b4c6c30b6e13d0c0abb396f96a95b3cff274eefb02b74492b50eacb60789246275866e22fb7b9b9b8f778fe75270511a4ff18731d3bb8cbf66e011b1433dec041178760864f2ff7a3689a78e8d8b91161f08d1c97fcd87d13b7bd9d0a6e63387afbe7c03a191985a347f331ec4326c5a9c3e959ff04da9c7875c59ed34a239f88fa482aadc512053d81f310f7920f219e9e1f4b8246fe357c94b921c4818491dbd150c0fb047f54f32e25511e6aa3ad97ccbe6be67315b069f40a2a7c9538889b943f3bc8525a7bd0ee1ddeaf8ec1fe05086cc4dbf32058341b0f382bc39ddf8c282e8d37534d374118d2e121e4bc89a67a76c72a89717c3dc7e50ae49110c84f872660d57ef8b6e618c67bd41c3ec10db915ca4b4c4161ed634e94580c49b91abaec649c760d93ad54b9d9b550af228d0a65ad88154b19d1f153b67491ff380ec4b305b51a69f27c6567d30d1c3632774067b08aa41293ff83947d13093c8696a1039e9b2d4528cb841581541d2694d14f877f4aa8964fc8b28f02c9f9f243fb2c2d603cbb08effa5175d6a803bc2569db39cc09f1bd8202cadc112a32a5c15c6172679a00d7c7f3a92fe1607ff6cb580daa2f2e2702d30a6fb01aa6827e58bf507ddd1168c2c596d416be55e55acd36264124a8859d821a01ee36e0ff2079ede99893c43b840967e7aa60b2dd4264b73a347552d75964cdd44354bf60a811b207c89e82a935f6e1017f6abd8c9e2bf096c4a3187617569a9f308745d103ec70ef5b9c781f6a81586229b9b463c7f22fba71d704fdd45d9ced58eab8cf5380e81e0f037a4b", 0x1000}, {&(0x7f0000002600)="4f7b8dfee50a2136e017f8a7e19554a4366dc683cc8bfa776d7b6a602113a0abff71cccb9d08213c7f9285f5e0f8c9ed77d868b8aa9fa4cf4ae2513e71d2476bfee93594f2afbabefb9005b324a5a6f793b21ddb8c9688df16f41a2cb2e95632954cdafe9b25b75c7d4cb17fe3711e92c8b01c4f38f32b276e453cade490b4c90f777078b64f76f9e6634eec3732b73704614f4641b00529cf0b9743139f4a9cf487fe5efc6d8a0986c3fe3df13bc01c38e861eb9d43c5e9e44407b2ea7d0a63737eea7eb046394fc4b771c73fcee54847aca61afda09c5ecd48281ca9a97ce1ec053b3b5c72e9097884e3c87e50eeeabb8bda030d12e5c9f020be180d341b0ab0b98120656660a9c9085950892f5a1738a46fbb2336298bda8eaec5664d7bc8bae6d6bb8df6088fb0f616fe9f5ddbf3057a42bbe97cb7b0fd7d988d61a4d3bc0ed00d83c8e3ca686c296f7a6dff0a9ab9352b4e67d3d19f7b84377f29ebcf2f680ff0e4c1967a1aefdf43a15212bfd42b4b32f2c417fad39a3e596b94adbd6ad4299d809dcd4c37702760f799482c2bd7a325c5318f05c6a908f05851e5bacc821d33409af825972807195bf719556506e60364c5cf7aa740b93b3ea4a1c6652ecce7e57f1a56ce266adaa8b6881838a89b496f94329a56765888c04ebf188dde967558aa006a96511143554909e638e9dbff8db1331bedc69eedbe024b5adfa73e8da5e01e3d186fb27d1f8b74cf1be277ad2a4f47c7dfa0946166fbb85d811a0caede6c3dddac09324efe42435ee48b807dabd14c4bede97e2d3d40c4066190879443a9205cb7d1776b8126255657c09a7c521ff02741e5ec62ded981b85a1646331059880ab2b6742c18147e90069c2f93bd70bb0de8955a3f65b4f3bdbe45f817d0fae6547a6520343a635d9b34423ce2481f429c961ac266d1cae0b42b140d381774ec4e0057aebb15fef7dc4d7f9ff9bfd723d73b8b4233cc444d4beab1e0e49f8a7c2bf8f3f2381fb0c2348e154b1b20d8ab42c5146318bf386b5228af181400bf0a2b80bac445c0f305f61cef2edcb609af2939a2e85557f494a5dabfe839fbfa3b3ca2b1c4dbdffac36893c808292ae8a508225c7665679d95d74299ccf65e7188978c97115ba034e101a42ec126ac7f099caaf4324ef7a8bf244be9c6bcda1dbb55c472cd46ac8e2eaec2ec6a8ba2568fe94dd88f9078b54130061041bae2b97f99f04a3f3dec0e3499f1fe850256468313e4406539926690464bed73eb20b4784abddeac59dfc290e6c33888b3004cb29752f8fdae96de371aaa0450c0ab2be9ab09bf893cd4d1d57b6e60405b9feb458cca858e2ee501ce27455d6f84ba56513dc71bcee486de03217736e4d2a9b7844fc6374d5dcccd6d2c08b7b3cbb9ed24e2b2ed745ab108659629ccd4dd4590c4d1d589ab1d96a6add2783a236e76af2e475241bb444c7049faacc1c34cfeca75e37d5bed027f80c028975fafeda9453e742f8c371e1befb6cd80dee33c8a900bdf0de420d2aa5f4d6ee03aa319d1acea9fedbc378798018ef70e26e9546d0d38a91b62608b49f8e90e55007a0f6bc194a758ff55ae1bed855c127ebd6c0929805f3985aba539a56bb5b3fdad646e94232f1d168e647cd5c475d1cb6a1ebd6c0066343b0be999a3c9f1764bcdcb5d21a96a68c9637fd4bb358eda4481a2e09b532a90f5226815568a2f92b49450b528f6f8433eb1a7436392d4c375f02df4756339d3225b3398799cc2676f4db5cd8f0bfeb5e66b87c12a68a26f459afceafb8abafc7454462592bc90ab3604ec5232dec4288345c11c8e83fa511834e3469a876ad29575878999bb34ac8ca662d67bf66dd66f940cb341b54e3ee27acfc55488048992a4f6578641de7d98f2e3fb94bb8c9ad229e1c5b056695e0e175a2381d62441d6118e7c2da668b7f660e44ea94adb5be03d3f860c607cd65e2aa5f811cab604cf64bc4cb0c4c8f6df741bdd92c10cf64be14cd91aa610e4742459e37730ce235065850c3cfa0f5f9888453c78c2c4d90182b878c8528bdee1d66f22ec0bf642f759dc3515ec3b9f1cfe645c60354474cf330e7649ef7b2d18b6eb96383bda38a878440dd4a9ddc1366010e16dc021187f7b3af6296060faef224e0280275df7b2940166f94413a7bf064527d3a6937986b12917fa0e2af1eb92a4d898bfa94ab7b22ac2eab5c857c19cee3997d74e85a079fb668cbb336b915f4f195bcabca423cc61d9216ebe06f2ad33bde9363af1feed56febc1c6bab52763873c066901646f0c0877282cea4817d8e0952c82965fd1a5effc627522a7a435fafc48cc73748e3bdc04635f8db864bd3ea3785f9433bed80ac027e44a6d91bfeabe972cff1161d8cac2688864b878ef506cd171d8b5bd7fe869a34093648ecf5537522de27398dcbb061d7a78b58f04130b69463f698a675c9ba72ffb95c89088edcbf6fc920756cb3e1ffa279db7c257fba6859f1c70cf41ad2497ba92c551d7ce1d4f45c246915debf1bd6abc7bb7f70abea8f275a3268bd9b871f572862e6e17afe37899beec77fa12aa1df853b47ccce9002e7fb5ef68d54bf793e48ee91649dd1aa71e1d41275034e23a2b9462ddf255a7fa210aa8d8c42c3dd04a0ee982f47a433af464413e9bb4dc7a2b03fc96a52858e145b070c4e0a6dd4e7d864c32890bd9abfdb85a3f7bbfbd3dfd0dc1adaa5326336cb5596ff759573db56561128723b0f8ce8324406eee0fcdd98bc179367760da11af7e23c0290e79462e1b277ddf158f39cea542b2d03eb00962d3b9f9d507ebe657813d811ddae05b5fde952fa6c98335a55f2258d8268de2e78669b4fe9b6baab6c4f8659f1e3179d345f9db0898ca9574d193015e2a913327291963ea5adf6dfdce1de304af9b88136de6c7ba22d878136677eaad7263c558dbe4616be7307bcaa64116e1d58b99670d28008a8c9ab5f406cca373280b09e58cfff24bee92aed1bcb3cd6634913c50748ad0682513237121187d0556a9d0ae6156cd6db1eb9606f5c0ef8e63eb3345417622afbcf46c786c9f704d3c59584c79e5a00df433b39d7eb30b3ee66643e1ff675a462d786032d2eb76d339b65898a13fb5ead2d0d7a3e310123598c4e54d030d7f9f88c5392db7f55bfd1356912f1eb053f0757550efae91a53802d6543f5dcff2b6587c6a122385a0e09b9355189e820d8f4afd420da01f4a4d22841fa2d234f0e1edacdd83718760fe03d6ba6933b2db4ce14e78155d4b3641e18f1ff27c506b81dcde683ab8c43b6d8d651a9c2679400df98c62df60021f0a99183c55e1b9b068688937c285d461011963335bbf08ce8619a90b8545a3e14b2dcad05bcd5b0d3191b0d9302fa8b57ac0e10ce4577f49895aaab649fd0ac0ef0ac93fff0c7906a0d64baa828eefe3899c6c4ee7c21e5f32ce3cba5bd141eb67d110d83152b3b2cab5024104c4cef7fd6901fab6bff1bcf2405e73191b9717b4b373c5421b95b9f925d73528d28ed4eebfb3c8e1e3b825d880de85a9e2a89c293b80ecdd51a7cc2dac632dbb1f2a4152760fd425dd082318f9c531c3822aef081e40f8b62b15b5ce780970765e1efd5a0b0c1fe11c08bc51bc0f5c5bb741a07f675a04d580a191e0dc2b0d1d58101b7501eaf1e3bc7635637db325f97839d2164de8c4f921461019912f21b201c8ea45987bffb2cf96b85bc403300cbaeb738f42834689558a016740bf1ddd1856f21bdc50e1f97521456810ffaea75e12ad651659047acb1f296c61d2be2cb1e7a84352c0220be37de4ede1520640c395c1b90525c34c0fd298ebcd7420b11874b51372daf66531550f915d53d40dc882253c8e95527f419059e21573cfa421889c6e6e842226a8d9036bd4cbee2ae9b20d38d9e3091a581657e2ccfd46e24952e5d88283cd66b301a5b05150009c7e1a6927c8c9e1d39d375e40915a0804aef8fe28be76e9a9f5d100889f4fad63866044862ef05922ee9ba83526e53d1441033eb3c5f8791385d4a207663d0abbbf0d482e4b661a5fb3af2c8defe7c5598f292a7da9a2f1537b2ed56b16e32cd1c15c060cd9b81ec1f7c07895f8a186b1842be977560cec8a3c20d6e2a5c8d46b185ea8d39aec536e59d0b31246792a576b99703aca30e52ae41b2d22f8c4a22e2ed0e2315b9f2603c593d64d7729148c153496db2c38817254de68b284d8f9766509cfe2ee4336c3b04e869142368403a67e0cf62d9b89a9fe9b29b48cdbbdccaef277a7379e833eafaf89d9a77f5e6d0acd4b99a518cadb28b749261f7749182434bac6e95ac5201a65cc6ac2a264c56b6607c239b370a1c54a299eaf0473139bb6bda1ac83c8f54fafca266fc4688fe25b5f0449e7d24ceb14643903ac9f1fbced3c6a44b2d5dacb42024e7a83e819e5f06fbe2e2f9bf757d6c8265311ab47746e2138cea2591c6920ed4d6487597af0ceb61118e9993adaa41224a554fd3df3349b40c15ad27d2bce11a30db2e62c7b33c3aabe9cd01fd48f4420c57c62a2914dafce139f2a06710434be422a86b3e709168abd5b41e5aa7defaa50b725df7788b3e96e62b1d70c5635b97192a611cd57159c43d04cabe505b69780e0dde22643d3134f220654c928078b874af87fa44735da6759aa66ac849d7b2bbdb021f2dc8640bf6864daadc193169a4028619ce9483da1efb006752a0729bea6a02d57809286678c22c2422f3c4f126ea8a4ac38251c25ceaa61de431baef24dff5241ef9428e752f23a53330721264a9ed872a2b5befe121998dc710253ae7b2056244f2828781003292ea62769705b164a407296dfbfa84c5efd79b98c9d11fadfdb3554d511721c87c672e94919d2794e4131f851494a7e6841ddd577d0086e9539c3621f10d8ec83bf011d24089ac5f1cbbbbb496104e29535466f4b916efc480ffd15e032cc2d49a62313e84bd768b9fb610009e64afcfe07e338eb7245fdce60663ab088a73e967ca817fd10bb48497ba68ead44245cfa7fe64af05039692740968891698d6d600a82c204944049d55699a7b27930eab9a9067417ef93b68d6b5ccc3670d8a370450bbb495042ba469b6486b021f136115d6bd3b91ac02b579713df5cbaa90d4a01582cb31e40bafa2f8d793941b22e1ae19c5916986f62b30d3d799f09b342340ea8dbc50603408bbc2c0151dbf8c1d8735844c66df37eb2010e243353789d9c0eb7a0195105a1dd3b2a499ebcf3bef7ac2abbece5b8f2263b7d9c4d142f1539ba541c400bb81244959971904eacc0346a87276035a3e24a5fecf479fbca215bb62293d3d2fae9ed16c61e3ed9dc06f7edc847c94d49156bfe96a1c154c8b828cc1986469e687278f23410f94d58b71315c0c8ed69835dd9871b64923c7e3ace0ea4948d1ad6ed4030671135ecbb7317edfa3d12bbca2fc15e0a8306253b17f71feecff5aa85b573e480f91006cd749875fba33c3a3e24d09a7e77d5d22845ff3954f76af4034fcf9edcfe36b6551fa9de9ec34870de62adc6b5ce3891a69ccbec74a2f366c0d0ffac556b1b8ec9b9b75e05c28a7ba630981c5eb278ee0ebb03f7af97572516981aea361a4a020dda7bdf1a5692674057e3cccf5330f1bf2e123ab35bd237749164d8e13c8a5f2db7f1aabca7babb2c1e4683cdb1f9b041d5feea81e0a7cb5bfe22ccf6cca42248191ec57faf20f5cdcac5226b9b2fa0e663cd7ad701619bb69756adf6e7fb0bd32109f69191664f0d0dac4c644321c239ec762432e4d1883f7529954264d5972f0", 0x1000}], 0xa, 0x0, 0x8001) 06:38:17 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00000019000100000000000000000002"], 0x2c}}, 0x0) [ 2963.137423][T10874] bond1445: (slave bridge2431): Enslaving as a backup interface with an up link [ 2963.165873][T10879] 8021q: adding VLAN 0 to HW filter on device bond1445 [ 2963.211621][T10879] bond0: (slave bond1445): Enslaving as an active interface with an up link 06:38:18 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x2}, 0xc) [ 2963.272773][T10928] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2963.311876][T10925] netlink: 'syz-executor.5': attribute type 11 has an invalid length. [ 2963.322541][T10864] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) accept(r0, 0x0, 0x0) [ 2963.500892][T10879] bond1445: (slave bridge2432): Enslaving as a backup interface with a down link [ 2963.574639][T10721] bond1445: (slave bridge2431): link status definitely down, disabling slave 06:38:18 executing program 1: pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='ext4_free_blocks\x00'}, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, 0x0) ioctl$BTRFS_IOC_DEFRAG(0xffffffffffffffff, 0x50009402, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3000}, [@alu={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x0, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'macvlan0\x00'}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000003000009000800050000000000000000"], 0x24}}, 0x20044804) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x0, 0xb, &(0x7f0000000180)=@raw=[@generic={0xca, 0x5, 0x2, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, @map={0x18, 0x8, 0x1, 0x0, r1}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @generic={0x0, 0x9, 0x7, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000000280)='syzkaller\x00', 0x6, 0xac, &(0x7f00000012c0)=""/172, 0x41000, 0x5, '\x00', 0x0, 0x1, 0xffffffffffffffff, 0x8, &(0x7f0000001380)={0x7, 0x4}, 0x8, 0x10, &(0x7f00000013c0)={0x2, 0x6, 0x8000, 0x2}, 0x10, 0xffffffffffffffff}, 0x78) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040080}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) unshare(0x0) 06:38:18 executing program 0: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1021, 0x0, 0x0) 06:38:18 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1003, 0x0, 0x0) 06:38:18 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec002100f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 06:38:18 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) read(r0, 0x0, 0x0) [ 2964.311845][T10965] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:19 executing program 0: socket$inet(0x2, 0x324e5d63fd5bf130, 0x0) 06:38:19 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) sendmsg$unix(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) [ 2964.476580][T10984] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:19 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) writev(r0, &(0x7f0000001300)=[{&(0x7f0000000080)="9196d29a9001437be7da0c8d05b308d89d18ef5ab64ee01e9d", 0x19}, {&(0x7f00000000c0)="1b41d9cf68fd3454ed586679ecf0094d764792eb5ce4d5afed32bf507dcb8efe93cc9a09a1923f4d052c9eafa538544c4b1c0087767021aad050ab297dd6ba9d9a95fabf255178e5733d3ea50d9edc5f569fae3e751e8cbf140e454a32bb98111996f5f37b026d69939bd6ad3979bc7339c63506bdc13612d6cb9ff7e521bacf1fbbbcd53cbeee609ecf8b26872c225792a0a0186ab4d921031948c67850188b2fd9bba8a4129e2f30c2aeb13fb65bafe476cfe40cf979526dcd266418", 0xbd}, {&(0x7f0000000180)="35b8ff3466fe56e25b79068da13ffb44334f04f3efb40c831eefb49c29609423e425c30ca654e2e30dea218140e050be4324dc7a11a03aab353e136e4bcb10a5a3dcd49c09c4baf46534f7b21574fe65111120cbc0f614150224f561c3eda303d099592062fd0c0fcda101f99157583e84c2b34732476aa50cb8c4be1c8a2cb58117ab87bd6a01213a3e3b410b29f45f794aaba3a58de6ba11a81c", 0x9b}], 0x3) 06:38:19 executing program 0: mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x494f39bcd3a758f1, 0xffffffffffffffff, 0x0) 06:38:19 executing program 2: r0 = socket$inet6(0x18, 0x3, 0x0) connect$inet6(r0, &(0x7f0000000080)={0x18, 0x2}, 0xc) 06:38:19 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) poll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, 0x0) [ 2964.843873][T10978] bond1446: (slave bridge2433): Enslaving as a backup interface with an up link [ 2964.878349][T10965] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000300)="f1bbe5ec09e361149535ff5bbe93582da68114f891855152aaa6d4bfb5493234d7dae84c5173d07a411cffb33a79e2800b60983c8242792efa822f838b77", 0x3e}, {0x0}, {&(0x7f00000003c0)="2fdac1e34c5407b64e5bc3c07e2a845ced2e4cadfe7dbfce9ffcdf98aa3dd59fbb2a82a10b528142348c8888910f411e07fec7f056170c70de1e6ac88cac5218df01114233ae7d8cd32120f679e6442857f166", 0x53}], 0x3}, 0xe) 06:38:20 executing program 2: mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4, 0x1012, 0xffffffffffffffff, 0x0) 06:38:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000300)="f1bbe5ec09e361149535ff5bbe93582da68114f891855152aaa6d4bfb5493234d7dae84c5173d07a411cffb33a79e2800b60983c8242792efa822f838b77", 0x3e}, {&(0x7f0000000340)="ecc4b427b3b985118a019b198c7c3e5e432e89522a5421ff7f1646df87ef2d5a2918db6c2cb8e4d4954d712fc30e7f34e52ca4165af634d2612e8f55a04e348806bee5e59d1bed23dbd06f0346ecf4302ec3a7", 0x53}], 0x2}, 0xe) 06:38:20 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec006900f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:20 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 06:38:20 executing program 1: mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x1012, 0xffffffffffffffff, 0x0) [ 2965.588054][T11061] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:20 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0x801, 0x0, 0x0) 06:38:20 executing program 4: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x1004, 0x0, 0x0) 06:38:20 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1d}, 0x40) 06:38:20 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_timeval(r0, 0x1, 0x42, 0x0, &(0x7f0000000340)) [ 2965.747830][T11074] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2965.851677][T11067] bond1447: (slave bridge2434): Enslaving as a backup interface with an up link 06:38:20 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast2}}}}) 06:38:20 executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x8, 0x0, 0x0) [ 2965.919759][T11073] 8021q: adding VLAN 0 to HW filter on device bond1447 06:38:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$sock_cred(r0, 0xffff, 0x1022, 0x0, 0x71057e02e47de5d2) 06:38:20 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000300)="f1bbe5ec09e361149535ff5bbe93582da68114f891855152aaa6d4bfb5493234d7dae84c5173d07a411cffb33a79e2800b60983c8242792efa822f838b77", 0x3e}, {&(0x7f0000000340)="ecc4b427b3b985118a019b198c7c3e5e432e89522a5421ff7f1646df87ef2d5a2918db6c2cb8e4d4954d712fc30e7f34e52ca4165af634d2612e8f55a04e348806bee5e59d1bed23dbd06f0346ecf4302ec3a7", 0x53}], 0x2}, 0x0) 06:38:20 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed={{0x18, 0xe}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2966.100384][T11073] bond0: (slave bond1447): Enslaving as an active interface with an up link [ 2966.194480][T11061] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a011700505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:21 executing program 4: socketpair(0x25, 0x3, 0xd9, &(0x7f0000000000)) 06:38:21 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe}, 0x40) 06:38:21 executing program 2: bpf$MAP_CREATE(0x1b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x40) 06:38:21 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b075c}, 0x0) 06:38:21 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000380)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000300)={0x0, 0x7, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, r2, 0x1643a3a6fd511339, 0x0, 0x0, {0x7}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x1000000000000000}, 0x0) [ 2966.360008][T11067] bond1447: (slave bridge2435): Enslaving as a backup interface with a down link [ 2966.393159][ T115] bond1447: (slave bridge2434): link status definitely down, disabling slave 06:38:21 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a012d00505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:21 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'gre0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @private, @loopback}}}}) 06:38:21 executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x61}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2966.550847][T11165] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:21 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x18, 0x1, 0x1, [r0, r1]}}], 0x18}, 0x0) 06:38:21 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = gettid() sendmsg$unix(r0, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x1c, 0x1, 0x2, {r1, 0x0, 0xee01}}}], 0x20}, 0x0) [ 2966.748599][T11213] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@rights={{0x10}}], 0x10}, 0x0) 06:38:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x48, 0x32, 0x3ed, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbedit={0x30, 0x1, 0x0, 0x0, {{0xc}, {0x4}, {0x4}, {0xc, 0x9}, {0xc, 0x7}}}]}]}, 0x48}}, 0x0) 06:38:21 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_buf(r0, 0x107, 0x0, 0x0, &(0x7f0000000000)) 06:38:21 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed={{}, [], {0x95, 0x2}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 2966.974214][T11170] bond1448: (slave bridge2436): Enslaving as a backup interface with an up link [ 2966.999676][T11165] 8021q: adding VLAN 0 to HW filter on device bond1448 06:38:21 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000300)={'ip6_vti0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @dev}}) [ 2967.058184][T11165] bond0: (slave bond1448): Enslaving as an active interface with an up link [ 2967.113863][T11165] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2967.334277][T11170] bond1448: (slave bridge2437): Enslaving as a backup interface with a down link [ 2967.353825][T12671] bond1448: (slave bridge2436): link status definitely down, disabling slave 06:38:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b075d}, 0x0) 06:38:22 executing program 4: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x10) 06:38:22 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x1010}, 0x40) 06:38:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a02f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) 06:38:22 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x10}, 0x10}}, 0x0) 06:38:22 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockname(r0, 0x0, &(0x7f0000000100)) 06:38:22 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x4) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x14, r1, 0x1}, 0x14}}, 0x0) 06:38:22 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x1) 06:38:22 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x28}, 0x0) [ 2967.584007][T11256] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:22 executing program 4: clock_gettime(0x7, &(0x7f0000002740)) 06:38:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a03f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2967.807456][T11256] bond1449: (slave bridge2438): Enslaving as a backup interface with an up link [ 2967.915085][T11260] 8021q: adding VLAN 0 to HW filter on device bond1449 [ 2967.977402][T11260] bond0: (slave bond1449): Enslaving as an active interface with an up link [ 2968.010728][ T36] bond1449: (slave bridge2438): link status definitely down, disabling slave [ 2968.023205][T11315] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2968.034900][T11256] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2968.151626][T11260] bond1449: (slave bridge2439): Enslaving as a backup interface with a down link 06:38:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b075e}, 0x0) 06:38:22 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000002a00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000029c0)={&(0x7f0000001540)={0xec4, 0x0, 0xa, 0x201, 0x0, 0x0, {}, [@generic="4e59e50685f8ae59537138e7906d71ace6e57ea07ee68e2a5421943d1870cd59827a4c2806212662c1f138d677890dacba052d03ccc21319cafeea73cf8feb26a174864df9d008ccdcd5c4b68aff862e88aea24288b5645959d4c6db513a6d03db386ddbc1048a0c6cad419c9adc127aaf303ed3a0e18a5b6db2552e3df27cff97f606753ca6cf6e94c4337190f58aff52526ceaaa9e0fe1028efbce335d4b113c9ef0", @nested={0xe1, 0x0, 0x0, 0x1, [@typed={0x4}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @generic="dce05474cefbd857f31d5e17040cfa97aa348d35e1b0ea1ac80f09fb52ab32f0fb819bd91dc9813eee0631dbbe8641d4ea0f7976f56eb5f0dc79f0a711b6a25de617d52f52391117b472ead27f26da4f0a371bac16159efddc82ba2b1e4e06c70ef8117697662b9f0cd1f71e070f9d3a3f6d6788f6926a7e6a10bf6d2ae75aafccbe95c75e3c79580e10c981a44dd14ee57a19410582742ea6008f480b0de99e46efd9e751667064bd8c4d952c2ac9f015068600eb86d0da298d96b89605fe8e07a953bbc9f4dedc664b712e1f848f74cb"]}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @generic="eb3abbf710efa6015bfd506440e0072082487cc790d9d4134f49fe1bfa624125e085bf5e8d0c6677e700cee28057d7f66748dd2adad1988f9b57eaaea2f8cda47485e188ed", @generic="8695ce9dd0fa2385272b519d1b124237ba05ee718b943440372196b78354c5c9b23246ad0dbcf74f89254a5d99e72830e5cf25e1c45820d0b8e283c8e05b090696d25847f93e991ca62b33d7fce716296287a05b92b535f344727fb30ec70feddfa87b18e93997240ac57fbcaf6622ee4f3573a46d639abf8d9f745911c25836f0bf6d529bd98a3de8edcb38079a5a2d96b2292051ffd5f99f6915b4372d1c52f85f107530918eaa69dbec79fadcc1c7172a2ff7bd71b28eec9c762933affe3a03bdec0ac45d4393e0c74d35a7402d79a13c87abd1f335355d75c57c5f86df4a50f5196db0bf96b3b5d50fbfb1df785121860fb0e50f52a52ac594ee6679", @typed={0x8, 0x0, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc5, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@dev}, @typed={0x8, 0x0, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8d, 0x0, 0x0, 0x0, @binary="8ef901186d3165c2c0d80aad5c0f968328ea1372011751006a26cfbd6326c5c56a6dd3f77daa6a224bafd97db0513cd54171f9875020bb8302989c0f599f7860c92045e8d1e4e901042949b9e4e93f1638946c041ab216e4695464b02883de1f88cb1fb6f4d8d46c0be6b879a46d1d48ad10ad914370fd3fe5e034ec2bbe3441989c81f297d35b2bce"}, @generic="1e8fa8c3889758c30f", @typed={0x4}, @typed={0x6, 0x0, 0x0, 0x0, @str='.\x00'}]}, @generic="094a5b892a5aa52b768927b71da2ee5b527ce54e9a35eeb9999516e907ba58e1e4f404e89d6607b717fbf9044b78a718987475061152fffd9720d15e33fa357d17c5c7ff529019b7c07a50d9e19289158fcfb53e2b8948e7045b4a7722d8bbe3f002e38cab8541a2476575e67b8a8e1c9f19a58a676172", @nested={0xa91, 0x0, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @generic="d8f4a28280f0ed2b5e93cbe6e867a84cc7e1e8b6969d8ae40c62d961365d8a30bbb472b1ccdd3d096e83177c3dbea58616ab2233af26d420", @generic="b57b59863df01b24e1409e792b89bc16ed83689ff2c4897b677860cf968de25b2858b08c2765fa40540d1d24b1acd172a76c2a0a29fcb55be060f14439015d1b69935d89722a15b130859641f134d5319b82d947be9d4aadbc712dd22e33b10fb26f7906e533b5506ca4ea6bdef8f1c1b612a2f87d6233fbd633c23b44e571ab077ff273988ac8b0ab185abcb5e7032f5a837be3ad92531b81b0d0c9b04cb5163ff207a521a10269ab385a62bf1004e0cb373adc24daf45557a220d2985944a633bdd46598e053b1e5888854c0f2bf18a779e0378efd936faccddc7a178603be416f0f1ec5eeb53c3b327bec2419fa1c72f64d4791ea149656a5d1c5da6f763b2e7736c3f1febdc4baa7252de67391f948d54db8b93825983ba6089dccbca374d668d34180854e9e0a372d9efa1fd5ca5f83a228aeff20dd3056f1a9d037ed74ba0ce11086b38ad1fbfa057cab9b7431f18d6ea7c3d7313cf24fedabbacc8890acbc5913433f04aaa05aa2f8f5b1515c632f005bd73a73506c790496d32ad0a0889a76d9436b6e9c6f7102a04db07687583eb64748d8c1c6f6cc4d0b904de776af03c9b8653a0adc776ff5027696b56bab5b972422dda0a33964006fea2c62675940d67d8753917122ba1199395da84af43938168039dedac9314030720e185667ccf231f20dfd51a8a222fd61857589b2052edf16110a46d3155a332df584464bd108c3b778eebc6e5407856c0e8933c85532e0a7b6c8866262cb80434a6bbbbc74e48590aedba8192b9334fc5f888a5c3e101f09626d0434a8c211ab5df93601bd0ed2e46372d1aa0d94fa18544e6ab178b2672731d5be8122cf260ea84c29ad4a13ac97defb127d90c8193577e37513145b4cd7ccba6c2200293885d80d79b414bc28c0d17bc75d8a9eb643a59c770cb2a59fd5f8c74ffc60b53ca2abccdf1ab5c828725e89f14b8c0d3f3f667f83f8884b8756afe8c64ea542243628a567db25617c57d72e0c4724d0df68dcee197afc3854dfbb4e68a5e4f5557eaa09afcae7acd0a049e98af223eef518753e73d9e3b0a0c445287f02786cd349169cb47cb9aa5080197ab67e2e781a4332d54f7d85ad2c9eaccd465e8e27a0dfb1b5bdf19cbbcbc1fa67ad0eebb78b72026213349dac7382241e8876f6a5abbb001ecafa6c5dd60ebf9ea937b094e72ba6796c2c4f059fbcf8fac8777bd36f6a8e8f7de2e73ba466e4f69065a64fb599a0a294fffa02cde5bd7736b9862d95d6d8ebbadde756dcd1266bc5a3509f24585aa26dfd563c6b27e1afab1e4e336eed30195684edc32b5360cac24901dc61d816ddbe6d885c8bffa39b7b413938c70bc8f72c3f519b8ec75a5a8921f19e38d588840997dc8038b7ca279b864cbba40a387c77b3f0d57cc04e57bdd9a8854306f53261ee802ff5a8610fe056402f7e4300ebed76a39b15dace22a0eff87be369fe82470f14ddcc2e20bcb41b7f9d6347a59a2f9054023480301ef000702760fd87fbaaf629b23c04a0d431df4f1c2a9a8b58cadf27cf9f808076c62a98f306313089d0cf294b73e7180572be91e4c2dcb0ecc43d3412bc18abb4681d7e01407df3c257d314c8e35a2e6b58f331269200045c5f08e380927bc16591614dba2af45e6248f8ee06603e3f2ba06e66624b815191a42a0b2920cf9ab259b9b2484bc23c9bcacf3755eb5d291e4be41927eb0a24408a088134f36afbb6180c09536d3eef3e0b419a9e735a81c67d894a2a2310e301381d5404410a329185252403fe49a6b0882a5990ab75879d531e8fe428efd3d54c16b7a9a15332535a6c647f6fe4c383e375c12af2c5c3957045311cb10b0f665e6d709135a45c2d04d8ec5f053f35bf142bc9a8e2efcf98c3d5f6c6a60b0636c691a2fa5285ee2ac654cd45359fd9fe32ad8fc793e4a800793f976c3c1dcde4068a7979cb8d61cf84a137ac28f5b2006a4aea61b068e5f113f7441ee0f133b0b4f48fdf89ddc2dc7a43aabd9995631790fcb55603b79949dc8707f8762a13285cb455c5141fdde86250024d8df1fbbdbef32fabe618ca622ad58d21b2da52ba7db20bdbbcd053b984f234cec18cadb83f850a4e1ab0e131709f3a9e29452aa91bf298776f9ac6476acd296f827eb350ff8f59c02b22badeafd35893f02f62fd3476ed84e40c3f4ae755fbf1bd3fcc9142d57342a945eeae9494a42c8b37dcefc235114ff14c1f4cb661e369f2399018fe3aeda948ffccf7b4519490693ebbac720501456830478d716c5b3acc9b3d672546c197a3b494ce8006834c88358bc675d549a4a2620748ef71ba7ad63aa015f31a6846a7ec4916ea043e9af3ce8fe190be4c1fe2e186d6f2831ea41c68eddda7dea7cbe429b2f3bbc960d55825ee2ef7b8cb54d7832d6074747a0d29a6b4e4f885ffc9ac2d2450a6f435c5293ddebffaf306ecc392cd3380a9d6cd9fa69daa8d917aee35ea3bacacb518c6cfc6e80cc123059dcadb167292bd5a649387a872a10af9f8b6aec566b5d03074f1d310577b0ab9798fc6d51397621ca4562dca2dcd6cccd9e20d2a8b2e007de6fbe17f579ac40a66ada4fc07ba9ee7116b7a75e7305dd384aa73129dd6018b077ad63bc935523e2fb37b91511dd95493d910ee44d7cc96adbbf0cd9aab01518329a070897edcef63ebd607ef3ae486f3314bb86f3c36003b6965f7778e218e6c86e5a0fe8264ab9deb031a4eeed76344d9298da40d59672f0fb1794aabe849c5af239fb36f49d8f950d2537847890e9574312320dc867f5f397f84a69f0be1b62bf68bba6f71ffcb560efda9f1dea05dbbdb3e4909e554b755a984e02ac4c7b7bfd257519e1c7103ccf7c7b5ef5773b25c32de7908767908546424f2f99ab5d08ea7b00526f7cf0e17939628b7b81dbd66ec90ce4babb69f915a28ffe92583ce7ea9e747dfd94788a935c7ae7d63cf3e72a899bedca41224178ed56ca7f53d1057952391d9c8d4431f71ba7c6aff710d862e263a598e126a516d5a4125756d45c23c0d23bac5517ab9fb3ab5f0a7f20ec2f532b35ef11f98a8d9849c83df10112a0d3b7aa54d86f18889b2aed9728b81a517fe9e38700ef49db7fbce9f8367cc8395d6ffa90e9fd05f563eebb606221660ed8bc4f930e17caee4a1d47fcbd597ca00f798f6252b21c140c873185986b7f0cb0c7fd4d7b8a6b8a024e8ad3078942b4abdce0856043798db7f76634969e41facb0fe2f45e7552d7eea827e4f2ccbd74a60d531d4ca518c82c4996773a7de77438ba88b26c07c3c3be43d1dec7d47fb45ac8bc1519779325f8da9a8bff222751b5375d959c87c73e4e2746496299e045bb45ae1e242ddff2e0168290159d0980008c59cd2c08bf2e5d76f4d9a7462e19685a1451208a2302681f2a44119c3728d69db8f879e3388e38669b56d8dedef414ccc776858cc3da5e13f3a6af17b8ba0f46bd879d230659a2688b065790557e0e034f1779fc2702f0918a8f41641dc72d9adcc40bc5bc02df1eaec07894cb6d17609a0e993cc52b6d4dbb905be06e3827033cff6619587b9b85794a6c50d9d91c98ee37f75a3aad2ef13bf107552bdb8efca286f8513e811262b5fac0e1807be5f1f48083f382881f7320c8de5a1fcfb6b3c5cb03303d0102864a4492ad3d502fdfa1a8af2178b39e4d51cbe4a3823398fb6701608ec23b63fb86d7077b1f5cc6df2914a5d94743a99d2cbd74886d1e2"]}]}, 0xec4}}, 0x0) 06:38:22 executing program 1: r0 = epoll_create(0x10000) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)) 06:38:22 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000240), 0x4) 06:38:22 executing program 4: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x2, 0xffffffffffffffff, 0x0) 06:38:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a04f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000001c0), 0x4) [ 2968.292697][T11331] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000014c0)={&(0x7f0000ffb000/0x1000)=nil, 0x2000}, &(0x7f0000001500)=0xfffffffffffffe76) [ 2968.357600][T11333] netlink: 3760 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2968.408122][T11333] netlink: 3760 bytes leftover after parsing attributes in process `syz-executor.0'. 06:38:23 executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000100)=0x2e4, 0x4) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000004540)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x2000000, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c910ccab00220bc31d41e44f96f67971b8ed8a3dc9eb4133a903d58da02dd1eca653150422bc91e9585fbf8", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1ceb", 0xf7}, {&(0x7f00000012c0), 0x80fe}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e2c812a5eefbd78546783b6bd280dc4ec1cd015bee7d07f0993d6", 0xd5}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}}], 0x400000000000132, 0x4000000) [ 2968.523064][T11378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r0, 0x891e, &(0x7f0000000100)={'vlan0\x00', @ifru_addrs=@xdp}) 06:38:23 executing program 2: r0 = socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$sock_timeval(r0, 0x1, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0xfffffffffffffdee) 06:38:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$unix(r0, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="14000000000000000100000001"], 0xf0}, 0x0) [ 2968.691975][T11336] bond1450: (slave bridge2440): Enslaving as a backup interface with an up link [ 2968.744572][T11360] 8021q: adding VLAN 0 to HW filter on device bond1450 [ 2968.838797][T11360] bond0: (slave bond1450): Enslaving as an active interface with an up link [ 2968.861235][ T36] bond1450: (slave bridge2440): link status definitely down, disabling slave [ 2968.900604][T11336] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:23 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b075f}, 0x0) 06:38:23 executing program 2: bpf$MAP_CREATE(0x23, &(0x7f0000000040), 0x40) 06:38:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r0, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x21) 06:38:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000780)={0x14, r1, 0x1}, 0x14}}, 0x0) 06:38:23 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$unix(r0, &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001200)=[@rights={{0x18, 0x1, 0x1, [r1, r2]}}], 0x18}, 0x20000085) 06:38:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a05f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2968.997362][T11360] bond1450: (slave bridge2441): Enslaving as a backup interface with a down link 06:38:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x891f, &(0x7f0000000000)={'ipvlan1\x00', @ifru_map}) 06:38:23 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0xf810}}) 06:38:23 executing program 4: select(0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)={0x0, 0x2710}) [ 2969.205698][T11414] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:23 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a06f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:23 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}, @rights={{0x10}}], 0x30}, 0x0) 06:38:24 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x8}, 0x40) [ 2969.495544][T11455] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2969.652837][T11416] bond1451: (slave bridge2442): Enslaving as a backup interface with an up link [ 2969.712091][T11425] 8021q: adding VLAN 0 to HW filter on device bond1451 [ 2969.744318][T11425] bond0: (slave bond1451): Enslaving as an active interface with an up link [ 2969.775862][T11414] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2969.829810][T10721] bond1451: (slave bridge2442): link status definitely down, disabling slave 06:38:24 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x2, &(0x7f0000000000)=@raw=[@map_val], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) 06:38:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockname(r0, 0x0, &(0x7f0000000300)) 06:38:24 executing program 2: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x78) 06:38:24 executing program 1: bpf$MAP_CREATE(0xa, &(0x7f0000000040), 0x40) 06:38:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a07f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b0760}, 0x0) 06:38:24 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x40) 06:38:24 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000200)) 06:38:24 executing program 0: r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3, 0x12, r0, 0x0) 06:38:24 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_drop_memb(r0, 0x107, 0x2, 0x0, 0x0) 06:38:24 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a08f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2970.149086][T11492] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:25 executing program 1: sendto$inet(0xffffffffffffffff, &(0x7f0000000440)="69fb737b370199cd4cd8966fd4bd0158d730686e72cd40fed8142b410f2bb494d9e962260107098fbbad8d3979fc10d45ef0a1110933b6de0a97c597aaf41bee94283dab808c8283da97f4999b62a5d1714627abbe2a1faf39", 0x59, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000000000000000000000bd000000000000000000000000ed0100000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) close(r0) 06:38:25 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) pselect6(0x40, &(0x7f0000000040)={0x4}, &(0x7f0000000080)={0x8}, 0x0, 0x0, 0x0) 06:38:25 executing program 2: bpf$MAP_CREATE(0x11, &(0x7f0000000040), 0x40) 06:38:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000002a00)={0x0, 0x0, &(0x7f00000029c0)={&(0x7f0000001540)={0xec4, 0x0, 0x0, 0x0, 0x0, 0x0, {}, [@generic="4e59e50685f8ae59537138e7906d71ace6e57ea07ee68e2a5421943d1870cd59827a4c2806212662c1f138d677890dacba052d03ccc21319cafeea73cf8feb26a174864df9d008ccdcd5c4b68aff862e88aea24288b5645959d4c6db513a6d03db386ddbc1048a0c6cad419c9adc127aaf303ed3a0e18a5b6db2552e3df27cff97f606753ca6cf6e94c4337190f58aff52526ceaaa9e0fe1028efbce335d4b113c9ef0", @nested={0xe2, 0x3e, 0x0, 0x1, [@typed={0x4, 0x93}, @typed={0x8, 0x4b, 0x0, 0x0, @fd}, @generic="dce05474cefbd857f31d5e17040cfa97aa348d35e1b0ea1ac80f09fb52ab32f0fb819bd91dc9813eee0631dbbe8641d4ea0f7976f56eb5f0dc79f0a711b6a25de617d52f52391117b472ead27f26da4f0a371bac16159efddc82ba2b1e4e06c70ef8117697662b9f0cd1f71e070f9d3a3f6d6788f6926a7e6a10bf6d2ae75aafccbe95c75e3c79580e10c981a44dd14ee57a19410582742ea6008f480b0de99e46efd9e751667064bd8c4d952c2ac9f015068600eb86d0da298d96b89605fe8e07a953bbc9f4dedc664b712e1f848f74cb9e"]}, @typed={0x8, 0x33, 0x0, 0x0, @fd}, @generic="eb3abbf710efa6015bfd506440e0072082487cc790d9d4134f49fe1bfa624125e085bf5e8d0c6677e700cee28057d7f66748dd2adad1988f9b57eaaea2f8cda47485e188ed", @generic="8695ce9dd0fa2385272b519d1b124237ba05ee718b943440372196b78354c5c9b23246ad0dbcf74f89254a5d99e72830e5cf25e1c45820d0b8e283c8e05b090696d25847f93e991ca62b33d7fce716296287a05b92b535f344727fb30ec70feddfa87b18e93997240ac57fbcaf6622ee4f3573a46d639abf8d9f745911c25836f0bf6d529bd98a3de8edcb38079a5a2d96b2292051ffd5f99f6915b4372d1c52f85f107530918eaa69dbec79fadcc1c7172a2ff7bd71b28eec9c762933affe3a03bdec0ac45d4393e0c74d35a7402d79a13c87abd1f335355d75c57c5f86df4a50f5196db0bf96b3b5d50fbfb1df785121860fb0e50f52a52ac594ee6679", @typed={0x8, 0x77, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc5, 0x0, 0x0, 0x1, [@typed={0x14, 0x52, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x35}}, @typed={0x8, 0x95, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8f, 0x0, 0x0, 0x0, @binary="8ef901186d3165c2c0d80aad5c0f968328ea1372011751006a26cfbd6326c5c56a6dd3f77daa6a224bafd97db0513cd54171f9875020bb8302989c0f599f7860c92045e8d1e4e901042949b9e4e93f1638946c041ab216e4695464b02883de1f88cb1fb6f4d8d46c0be6b879a46d1d48ad10ad914370fd3fe5e034ec2bbe3441989c81f297d35b2bcea750"}, @generic="1e8fa8c3889758c30f", @typed={0x4}, @typed={0x6, 0x0, 0x0, 0x0, @str='.\x00'}]}, @generic="094a5b892a5aa52b768927b71da2ee5b527ce54e9a35eeb9999516e907ba58e1e4f404e89d6607b717fbf9044b78a718987475061152fffd9720d15e33fa357d17c5c7ff529019b7c07a50d9e19289158fcfb53e2b8948e7045b4a7722d8bbe3f002e38cab8541a2476575e67b8a8e1c9f19a58a676172", @nested={0xa93, 0x0, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}, @generic="d8f4a28280f0ed2b5e93cbe6e867a84cc7e1e8b6969d8ae40c62d961365d8a30bbb472b1ccdd3d096e83177c3dbea58616", @generic="b57b59863df01b24e1409e792b89bc16ed83689ff2c4897b677860cf968de25b2858b08c2765fa40540d1d24b1acd172a76c2a0a29fcb55be060f14439015d1b69935d89722a15b130859641f134d5319b82d947be9d4aadbc712dd22e33b10fb26f7906e533b5506ca4ea6bdef8f1c1b612a2f87d6233fbd633c23b44e571ab077ff273988ac8b0ab185abcb5e7032f5a837be3ad92531b81b0d0c9b04cb5163ff207a521a10269ab385a62bf1004e0cb373adc24daf45557a220d2985944a633bdd46598e053b1e5888854c0f2bf18a779e0378efd936faccddc7a178603be416f0f1ec5eeb53c3b327bec2419fa1c72f64d4791ea149656a5d1c5da6f763b2e7736c3f1febdc4baa7252de67391f948d54db8b93825983ba6089dccbca374d668d34180854e9e0a372d9efa1fd5ca5f83a228aeff20dd3056f1a9d037ed74ba0ce11086b38ad1fbfa057cab9b7431f18d6ea7c3d7313cf24fedabbacc8890acbc5913433f04aaa05aa2f8f5b1515c632f005bd73a73506c790496d32ad0a0889a76d9436b6e9c6f7102a04db07687583eb64748d8c1c6f6cc4d0b904de776af03c9b8653a0adc776ff5027696b56bab5b972422dda0a33964006fea2c62675940d67d8753917122ba1199395da84af43938168039dedac9314030720e185667ccf231f20dfd51a8a222fd61857589b2052edf16110a46d3155a332df584464bd108c3b778eebc6e5407856c0e8933c85532e0a7b6c8866262cb80434a6bbbbc74e48590aedba8192b9334fc5f888a5c3e101f09626d0434a8c211ab5df93601bd0ed2e46372d1aa0d94fa18544e6ab178b2672731d5be8122cf260ea84c29ad4a13ac97defb127d90c8193577e37513145b4cd7ccba6c2200293885d80d79b414bc28c0d17bc75d8a9eb643a59c770cb2a59fd5f8c74ffc60b53ca2abccdf1ab5c828725e89f14b8c0d3f3f667f83f8884b8756afe8c64ea542243628a567db25617c57d72e0c4724d0df68dcee197afc3854dfbb4e68a5e4f5557eaa09afcae7acd0a049e98af223eef518753e73d9e3b0a0c445287f02786cd349169cb47cb9aa5080197ab67e2e781a4332d54f7d85ad2c9eaccd465e8e27a0dfb1b5bdf19cbbcbc1fa67ad0eebb78b72026213349dac7382241e8876f6a5abbb001ecafa6c5dd60ebf9ea937b094e72ba6796c2c4f059fbcf8fac8777bd36f6a8e8f7de2e73ba466e4f69065a64fb599a0a294fffa02cde5bd7736b9862d95d6d8ebbadde756dcd1266bc5a3509f24585aa26dfd563c6b27e1afab1e4e336eed30195684edc32b5360cac24901dc61d816ddbe6d885c8bffa39b7b413938c70bc8f72c3f519b8ec75a5a8921f19e38d588840997dc8038b7ca279b864cbba40a387c77b3f0d57cc04e57bdd9a8854306f53261ee802ff5a8610fe056402f7e4300ebed76a39b15dace22a0eff87be369fe82470f14ddcc2e20bcb41b7f9d6347a59a2f9054023480301ef000702760fd87fbaaf629b23c04a0d431df4f1c2a9a8b58cadf27cf9f808076c62a98f306313089d0cf294b73e7180572be91e4c2dcb0ecc43d3412bc18abb4681d7e01407df3c257d314c8e35a2e6b58f331269200045c5f08e380927bc16591614dba2af45e6248f8ee06603e3f2ba06e66624b815191a42a0b2920cf9ab259b9b2484bc23c9bcacf3755eb5d291e4be41927eb0a24408a088134f36afbb6180c09536d3eef3e0b419a9e735a81c67d894a2a2310e301381d5404410a329185252403fe49a6b0882a5990ab75879d531e8fe428efd3d54c16b7a9a15332535a6c647f6fe4c383e375c12af2c5c3957045311cb10b0f665e6d709135a45c2d04d8ec5f053f35bf142bc9a8e2efcf98c3d5f6c6a60b0636c691a2fa5285ee2ac654cd45359fd9fe32ad8fc793e4a800793f976c3c1dcde4068a7979cb8d61cf84a137ac28f5b2006a4aea61b068e5f113f7441ee0f133b0b4f48fdf89ddc2dc7a43aabd9995631790fcb55603b79949dc8707f8762a13285cb455c5141fdde86250024d8df1fbbdbef32fabe618ca622ad58d21b2da52ba7db20bdbbcd053b984f234cec18cadb83f850a4e1ab0e131709f3a9e29452aa91bf298776f9ac6476acd296f827eb350ff8f59c02b22badeafd35893f02f62fd3476ed84e40c3f4ae755fbf1bd3fcc9142d57342a945eeae9494a42c8b37dcefc235114ff14c1f4cb661e369f2399018fe3aeda948ffccf7b4519490693ebbac720501456830478d716c5b3acc9b3d672546c197a3b494ce8006834c88358bc675d549a4a2620748ef71ba7ad63aa015f31a6846a7ec4916ea043e9af3ce8fe190be4c1fe2e186d6f2831ea41c68eddda7dea7cbe429b2f3bbc960d55825ee2ef7b8cb54d7832d6074747a0d29a6b4e4f885ffc9ac2d2450a6f435c5293ddebffaf306ecc392cd3380a9d6cd9fa69daa8d917aee35ea3bacacb518c6cfc6e80cc123059dcadb167292bd5a649387a872a10af9f8b6aec566b5d03074f1d310577b0ab9798fc6d51397621ca4562dca2dcd6cccd9e20d2a8b2e007de6fbe17f579ac40a66ada4fc07ba9ee7116b7a75e7305dd384aa73129dd6018b077ad63bc935523e2fb37b91511dd95493d910ee44d7cc96adbbf0cd9aab01518329a070897edcef63ebd607ef3ae486f3314bb86f3c36003b6965f7778e218e6c86e5a0fe8264ab9deb031a4eeed76344d9298da40d59672f0fb1794aabe849c5af239fb36f49d8f950d2537847890e9574312320dc867f5f397f84a69f0be1b62bf68bba6f71ffcb560efda9f1dea05dbbdb3e4909e554b755a984e02ac4c7b7bfd257519e1c7103ccf7c7b5ef5773b25c32de7908767908546424f2f99ab5d08ea7b00526f7cf0e17939628b7b81dbd66ec90ce4babb69f915a28ffe92583ce7ea9e747dfd94788a935c7ae7d63cf3e72a899bedca41224178ed56ca7f53d1057952391d9c8d4431f71ba7c6aff710d862e263a598e126a516d5a4125756d45c23c0d23bac5517ab9fb3ab5f0a7f20ec2f532b35ef11f98a8d9849c83df10112a0d3b7aa54d86f18889b2aed9728b81a517fe9e38700ef49db7fbce9f8367cc8395d6ffa90e9fd05f563eebb606221660ed8bc4f930e17caee4a1d47fcbd597ca00f798f6252b21c140c873185986b7f0cb0c7fd4d7b8a6b8a024e8ad3078942b4abdce0856043798db7f76634969e41facb0fe2f45e7552d7eea827e4f2ccbd74a60d531d4ca518c82c4996773a7de77438ba88b26c07c3c3be43d1dec7d47fb45ac8bc1519779325f8da9a8bff222751b5375d959c87c73e4e2746496299e045bb45ae1e242ddff2e0168290159d0980008c59cd2c08bf2e5d76f4d9a7462e19685a1451208a2302681f2a44119c3728d69db8f879e3388e38669b56d8dedef414ccc776858cc3da5e13f3a6af17b8ba0f46bd879d230659a2688b065790557e0e034f1779fc2702f0918a8f41641dc72d9adcc40bc5bc02df1eaec07894cb6d17609a0e993cc52b6d4dbb905be06e3827033cff6619587b9b85794a6c50d9d91c98ee37f75a3aad2ef13bf107552bdb8efca286f8513e811262b5fac0e1807be5f1f48083f382881f7320c8de5a1fcfb6b3c5cb03303d0102864a4492ad3d502fdfa1a8af2178b39e4d51cbe4a3823398fb6701608ec23b63fb86d7077b1f5cc6df2914a5d94743a99d2cbd74886d1e2d4bdd05beb97412421"]}]}, 0xec4}, 0x1, 0x0, 0x0, 0x4800}, 0x800) [ 2970.400028][T11533] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 06:38:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x1c}}, 0x0) 06:38:25 executing program 2: bpf$MAP_CREATE(0x1c, &(0x7f0000000040), 0x40) [ 2970.540479][T11498] bond1452: (slave bridge2443): Enslaving as a backup interface with an up link [ 2970.631073][T11515] 8021q: adding VLAN 0 to HW filter on device bond1452 [ 2970.719628][T11515] bond0: (slave bond1452): Enslaving as an active interface with an up link [ 2970.755510][T11492] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b0761}, 0x0) 06:38:25 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x401, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4}, 0x40) 06:38:25 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'gre0\x00', 0x0}) 06:38:25 executing program 2: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_ext={0x1c, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x24e9, r0}, 0x78) [ 2970.794043][ T115] bond1452: (slave bridge2443): link status definitely down, disabling slave 06:38:25 executing program 1: sendto$inet(0xffffffffffffffff, &(0x7f0000000440)="69fb737b370199cd4cd8966fd4bd0158d730686e72cd40fed8142b410f2bb494d9e962260107098fbbad8d3979fc10d45ef0a1110933b6de0a97c597aaf41bee94283dab808c8283da97f4999b62a5d1714627abbe2a1faf39", 0x59, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000000000000000000000bd000000000000000000000000ed0100000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) close(r0) 06:38:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a09f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:25 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000040)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast2}}) 06:38:25 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x4, 0x0, 0x6) 06:38:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a0cf500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000040)=@newspdinfo={0x1c, 0x24, 0x1, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}}, 0x0) 06:38:25 executing program 1: sendto$inet(0xffffffffffffffff, &(0x7f0000000440)="69fb737b370199cd4cd8966fd4bd0158d730686e72cd40fed8142b410f2bb494d9e962260107098fbbad8d3979fc10d45ef0a1110933b6de0a97c597aaf41bee94283dab808c8283da97f4999b62a5d1714627abbe2a1faf39", 0x59, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000000000000000000000bd000000000000000000000000ed0100000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) close(r0) 06:38:25 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={{r1}}) [ 2971.097188][T11585] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2971.424730][T11638] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2971.427863][T11588] bond1453: (slave bridge2444): Enslaving as a backup interface with an up link [ 2971.503136][T11585] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2971.605827][T11588] bond1453: (slave bridge2445): Enslaving as a backup interface with a down link [ 2971.651041][T11620] 8021q: adding VLAN 0 to HW filter on device bond1453 [ 2971.731868][T11620] bond0: (slave bond1453): Enslaving as an active interface with an up link 06:38:26 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b0762}, 0x0) 06:38:26 executing program 0: select(0x3f, 0x0, &(0x7f0000000040)={0x9}, &(0x7f0000000080), &(0x7f00000000c0)) 06:38:26 executing program 2: bpf$MAP_CREATE(0x3, 0x0, 0x82) 06:38:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x8921, &(0x7f0000000180)={'macvlan1\x00', @ifru_data=0x0}) 06:38:26 executing program 1: sendto$inet(0xffffffffffffffff, &(0x7f0000000440)="69fb737b370199cd4cd8966fd4bd0158d730686e72cd40fed8142b410f2bb494d9e962260107098fbbad8d3979fc10d45ef0a1110933b6de0a97c597aaf41bee94283dab808c8283da97f4999b62a5d1714627abbe2a1faf39", 0x59, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000000000000000000000bd000000000000000000000000ed0100000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) close(r0) 06:38:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a0ef500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2971.790621][ T115] bond1453: (slave bridge2444): link status definitely down, disabling slave 06:38:26 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[], 0x20}, 0x25}, 0x0) 06:38:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000bc0)={0x0, 0x2, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x14}, 0x14}, 0x1c}, 0x0) 06:38:26 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0xf, 0x0, 0x0) 06:38:26 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a0ff500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, &(0x7f0000000080)=0x80) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) 06:38:26 executing program 0: syz_emit_ethernet(0x26, &(0x7f0000000000)={@dev, @multicast, @val, {@can={0xc, {{}, 0x0, 0x0, 0x0, 0x0, "af26de06a6d6bb9f"}}}}, 0x0) [ 2972.212458][T11671] bond1454: (slave bridge2446): Enslaving as a backup interface with an up link [ 2972.294489][T11709] 8021q: adding VLAN 0 to HW filter on device bond1454 [ 2972.314769][T11722] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2972.372206][T11709] bond0: (slave bond1454): Enslaving as an active interface with an up link [ 2972.524016][T11665] bond1454: (slave bridge2447): Enslaving as a backup interface with a down link 06:38:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b0763}, 0x0) 06:38:27 executing program 0: pselect6(0x40, &(0x7f0000000000), &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x77359400}, 0x0) 06:38:27 executing program 2: socket(0x26, 0x5, 0x400) 06:38:27 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x3, 0x0, 0x0) 06:38:27 executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)={0x10, 0x3ea}, 0x10}}, 0x0) 06:38:27 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a60f500505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) [ 2972.565463][T27433] bond1454: (slave bridge2446): link status definitely down, disabling slave 06:38:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r0, 0x5452, &(0x7f0000000180)={0x0, @l2tp={0x2, 0x0, @private}, @vsock={0x28, 0x0, 0x0, @hyper}, @generic={0x0, "2914b3833388105581ca431170c7"}}) [ 2972.739146][T11746] validate_nla: 2 callbacks suppressed [ 2972.739167][T11746] netlink: 'syz-executor.3': attribute type 1 has an invalid length. 06:38:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r0, 0x8940, 0x0) 06:38:27 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x4041) 06:38:27 executing program 1: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_cred(r0, 0xffff, 0x8, 0x0, 0x0) 06:38:27 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000580), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b80)={0x14, r1, 0x805}, 0x14}}, 0x0) 06:38:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0), 0x4) [ 2973.082050][T11804] nbd: must specify at least one socket [ 2973.107350][T11750] bond1455: (slave bridge2448): Enslaving as a backup interface with an up link [ 2973.119253][T11805] nbd: must specify at least one socket [ 2973.175922][T11786] 8021q: adding VLAN 0 to HW filter on device bond1455 [ 2973.237105][T11786] bond0: (slave bond1455): Enslaving as an active interface with an up link [ 2973.267442][T11750] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2973.367852][T11750] bond1455: (slave bridge2449): Enslaving as a backup interface with a down link 06:38:28 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x27, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0xa, 0x0, 0x0, r8}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0xf}]}, 0x28}, 0x1, 0x0, 0x0, 0x1b0764}, 0x0) 06:38:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x8912, 0x400308) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="14002c80080000009909000008ffffffff7f00000600eb00000000003c00ac452c0006800800030000000000080001000000000008009ec096d60000080003000000000008000300000000000a00010002020202020200000400ec000a001701505050505050d6000a00f500c0d62cd55a4b0000"], 0x90}}, 0x0) 06:38:28 executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_TTY(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000015c0)={0xec4, 0x464, 0x0, 0x0, 0x0, "d1aa3390255b015cc22cb2d472bb2a05f4e576a71bc3995d0a92ff52f4fc62b2f5d4bcf119ef57d18cec9e215c36b4c335e90730f88e2307e8d7836d16a1e5b077ad1cb47566266a1edd97bc0fe2aa70cb83b86b9381779885a3896c200b7a3efcc128df5a0dd9b372f94596dbe8746a906b4ce93fdb153f25a3763642cd62ea841b8ad084a3984079a29f12875dcf9bd367bb2649ec49b32c111d80720cc6e620d195cf42bf86dcd3e9e993aa14f3cfe17e901c44fc81fa8d5db1bc7c90ce3f8260957c60193eac38bb328aac00b718740d74b39e8a426013d87ce916a595c9d3e4fe71c80bd4c053fa950316be6df37982844d45733fce99d2190b92c9c95171005c7d01f545b8fdd566cc673d6c3fd6976a435cd306e55282acc45f071313ebeb8cf8e06d4fcaaf51fb99005a93059d6c7f16c83fd9829cdabcef96084ea022ca3d0e93fb8854e5ac1113a02972ce53b48a92d5c838c9fdfc3a37ed271b16256008c3215e1c69f37f09051746f8c5c8ffc1119b1e906ecc42dd55db0e38315f79a3abb1566d26925a6e2a8cbe8c7ac46f434006c3241543f9f4185075d1fea587623688e8c894703eafcd0e2827a00ebe3bbea970e9e166b4b36a4d571d22e908ee10a8fcc48bbbb319680befadb79269418b5c963e78ce25e30ca361326f25ae540a9cf64ce1166cf29f7c1e5b05ced29c5353aa5c5e6a1e5d2cbf5ad2939111ef74651c82a9dcc8b5613d65bf39d0415195191fb14f1e609c51b1baf91201d557566ae4439653409c0527ddd46aef10868082108739b4b36785a1333229aa24f59092b4d361750f11c518e457e6302b43925c47c6ca0b659ace42846244798644afedd624fbf5b0d0adf2172c0ffb9b082387bbbc26fbf2d1fe017af8ed9a84f0db00f2f01d5a6a64398b8fd26e1b66aa9c3ad45e56fe15c884cb726f0327e023b9a72d2d42f3dab504fbfbe69d825ef3f5b700804d38faabcfd989672361369d96cb83235bdbac4b8f52c2c2ae8d35f22eecbd3be92e32ea5b366dd932d21d39c52ff5d6b81b6d376b6972fd06d6e0d59ef7e5aa79f234ed64ab42047bd663a1df12d9872f4754b10740b329b312222e3470e61710068e8432f10ba4429966bdb1ae58ccea0a51eb495268d26d1f7588f6e0ac45576ed029b2aabda7a84fed824f8b57d1db3449b77e440f26abac2f713b04d1826d348f1ba38ee235c8e78da84488a200c49f7232010caec439dce3c9a183f4bc777ea17530b5062a18fa8794e991d6866c77f78cd158957f965a199bb81bda748cf71759fa41d930f43858743d97c3284403102968ad3e40c2b8b172f981dff62b3e2e12a32b16110bfd8a211553d36974cd41ffc216d14f3023234738b45cf2ef9eb801279e8af4212830e0a38559e4ce449c5c7619c2e79da1165d4089530b19b1108687e03b70a38e38165d86c07a1ab7a201fc8dd3e2133a12214b4ffcbbeee4fbbefe5f5ed513bb0132d7313472d2c31ff78f219ec337acdbf21947edd09a0fee5d8eaa85d8f71c748024ec2d8e5bc4606fa6d106c2757aec40d5fae8b53bf9917676d916a3b8bd9ca4d757877b5f35e9f059084e1b06093822c2643af11e243bc4e3bc05c1c50e33393485c68a0fb71aa79c0d8a701a28810717fa18103a1fdf7d2d058abe2abb50aa2e6def3be99c09dc72de99c0611f7bebd1855e8d34a99ddf6cec1082ba49fd615fd0a5daebdb0edb05bb58260ca706aea8d010fa65669e40003c0ebfe9b513fe482aa4794c5a02f18cb770f90f87d3cc1b78e3b0e2e40c2128e989c60f7ec5d0056db796fef467148182c6d9f301812ece5e070eb2146372da85f4f7444ad7a8edcf7257979a2f8a10c1210c6248ae2f1e946d1ea105ae7b2dfdfbd19654e5a1210f1da5ec084759c700a88bafd8f112780a97a78090b1c51be8d68299d81ccb53af8117fd8faa99b72903cab6daebd014bd6e9781edb91be265ad91b56cc6e9d01a3024fc6f1084164b8e73e03b96291ae1ca1ef8dfe0cd525ab533c007abd0936ecbf44484d65dc13d2b366b592d8baffff05c6f79b7ac6b551461a7eec7c0747385232da6dc9feb1bb0495e9d139ee4538c1c588d513e910ce67020933bef3f7f567c715df2709895bca5190351cc1a229f307164b4fd3366e7643168fc1164dea127b3f20e74ce662a4b7ec0f0be51e463e2d42c060b409894d2d67d239681a1c87bdbf4142588acd4241a6792105c49c162f54f9b57299bb54335932951b578793b623d622595efe59872acb1252a751a3757fc8fcf3a02714c1ae7ef4f993984b15f2291ad52eecbe9bcabfa681b4f6a6ffcf84ea9f815fe1686b70dc2014930415ba1e4493d8128e43d915fe031bdebca34eacd9e2f9b24868f55bbbb16486f26e2594f869f581c2aaeac4880ca7b2407edd5fa4c36d8e0e4f307fd04e3367a4f92596911b5b9711b6be0108a24ae64a448696abf5bf1dc755792d74724abde9bd47335ed4c1c7c0099a29b52e95890909b50da20752354e66069ae7f39095e89cd7a4027dccd274884ac54cd96c36cd5d151d27a60dee9e4957b21508ef7bf4fbee3080cc699bea07adc2bcc66919c2ee27a341462976bbeda2d66db3b01c30ebdf841280e9994c5ca086044c998295c206e5e8a0e1eb6f417387cb793e10b182bbf10115101db644e9b16bdada14737c6c2956c3347e610349454e7378ea7010a2c835f6a1a22605e34e72b576e68d147091c11473852be38233281ef4f63d7d27c44949fd827d35f816734c5adefefb6931e6a6f75dab603ca779c304c932197986fb17539a296beded712c252cefc3c4c744c76624a268832c9e1a454d3611458ed810bea64bdb0eebcf128eec9d67bb4418747014f3c0744722fc1b54cd41471ae9b5ea159bf408ef55d7e2966ce028427ab7cf12ece374c6dc8411ce6997cadf1bd9610284881a81a06a41a1418dd0f219a18ac0adf34b5cc6b4cbc0e0d8bd5eacdaa1f3c85c12bfa81fdda32347271f5758ff5fdc62ec719c4236ac0dc4f2ee32df1386a35b508f6ce9cf6c4e04432ca51a9e6d4b2e27232975f761c222bdae81d18076c0078c6a4b131f9f09d51a683acfa205d58f387859ca4d1aaca0ea92eb2012cd1c56bea485df60986bad3624b7f97102541bb4ed1016d4a5f4e12484171593b5f9761fd3392ec9abc8f1ae54168c7734f284ecba1d95cf294299e2195b2ce9f4688b8e712fa9e8f1f074be1f71d1c2f71f4126ca9d23a9715ab30ca3be1df642cfde850c53dabe5bc3aaa0fbde4743e854cc63d92d894f979f8276c96dc65ee0c99ae48d69176a6c12f02e76c4daf738680da58f03eb183b6e88c12fd6eb695aca381d008b5c3dc4da95e65f560f0ff059dee6faa348b5c63ffaeb399d242b63e82728294b0889040912e21a9430cda1cffb1d65985c55b4682c34c3f90ea68864e8f0d3f9829fba4fe9d60ef4bb484c6462edfa1dfb2f407ae9693cf91458fe6286054cc4f35cd2dcb396d343cd0b820e8fde8a1dc3e0222b279e4739d80737473dcd10b7fa2b4822610a7b474b93f4b932bb6e46a20939cc7bb9d44ac82ead4ae5d36f7f948c4c3db32bb32ddea205e7eabea68024a0267f283907696f64302d0767aa06f802987cc3f4f35ab56ba1a2fc860edf68a3e0753d219c1331e16d5442b9e50542a62f6b5449cb80c3fb01595cb78297be64907d687f06878371330366e964a182d7a59329dce99456f06d2b4e8f4ffca6a10b1621b0c0153024abf452be3cc295ef12a6584d65f16c3718576cee04bd6cd6f2abd3f1fde405434229da8cbddfea0d9742391e4e6573cf447bb045b798b5538092fd4872d9a6af009877128609fb9e5297a208b085e87435514ef7a19f0baf5aa7cfa1c9b25743aedd6f1f4b73dd203e266e543351c83542556e50e696bf5bfd7ae01f9c4cd7c263fc45acf6715641131ee6d3e4a3fcde042c835e2d39ccaf28fd284616d3409bce6ca69f4475f0cd0bc3a54cf0f0da61b84bd1e477c0dbae0789a1480c18ee7b5527c2cfbf3d99047ce2138148189a76d3f2410cd77ac46be8b94d6da4e86ac8638cd7cde73c80b055153b77e0e85a7a90843a2186985b042268afcd8af79a99b04bb05ae32abaf274b5b71d9f1759287978683bdbc6023d7ea51d11ab3c404cf0a33bea571c17c8f9e2da4ac6d8db3dab4fdf6980a8e8156c101368f539dede998c98b0c113d68a3e16795c9e81d99708df8f61b5cebfb1de4d82db95d4b14c5c6c897842aa180fa87d89da460a70091399ead4a7a7c991985a5b324d4208509a2b56425a7936699be740ef0447951426d6ea3fcaf1a0a6bbfc7813cd090cfb408a21c02320869f7bec940b89d3dec2aa4e3b20ad086612e83361fc76c90801b8f618e2ac61ec23c068942c9f57bce33487d321166136d2d0e8abf7dc104737b1b9c5b08c6c071099abe4f09b739a70a05e4b8e5e1bdca72f8d5e32e1504c8a9797ebd4388eaae370f65d932840534c3cbcd1bf2a4bdeab67a1d75330c0f8c68ccc224d412e7c3198c2fed8a27f2751965d6ace720580b8365261d0d24a5a1e411229441b03709da895ecfd0d4c2a3bf9d81be8bd67c4d1a05fc74971dea6858b5b9dcc345badd268268ae8ccf21bc993c94a9e25af811abb8c6f87ce4b4db232fe1698a481a560d3d178a9a7c1115ccc5a611ddb1fdcb70c992fc3b8aae695bc9df96039b68ff33e6df538a9a57d425c8f71d35f3ecfe1473b8e5dbde1277d90095d86a48a3894395687a54e4efe4a6717570f795bbde9aea0782079672a10ef7a34d9927ca259f1b7bc909bc8fe4b543517f2ea490b200db1f1fbc3dc1f58dd46ed8ff44ee8e87ac4ca4f33bbb204d6797c5395142ca27d224e69ac16bbb8640f7c80ecc3504b8d7b332f7bcb37dcb8ddc8f9c8058a64eae630a3c10d378aee6e2b520b02b5e5dd61ca52c92cb4eaa27b43bfec6607a2f6585377f497d5ea87ba22ff03686a3987677d5660db072ffde397698246891c87854836151d3f1c7cdfa391ba4d687b0d85c72660a978f902126797318c971180e73a6dd3769faad9650b3231a1aa0acd85f5ce459241ef753c0fbf3ef9786e30b1399b1d5ae1d9aee607b47d774e786ec115c4683dea3b178ade052e7e1bc0fe8498d4e7569f9875bd69a178afc559c0ef8f7c680e8b40f7c9a9ffcb43136e5669cb899998b43ec585f54b1370d8771c91bd8bdfa2aec99718779a886a51c11bdcb131183bcd6afaef6c18b58147ed0b014eddc168f9e040372092f22396212439630f4fb302e9968e8e455"}, 0xec4}}, 0x0) 06:38:28 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r0, 0xc0045878, 0x0) 06:38:28 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000580), r1) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r2, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}]}, 0x44}}, 0x4) 06:38:28 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCADDRT(r0, 0x8902, &(0x7f0000000180)={0x0, @l2tp={0x2, 0x0, @private}, @vsock={0x28, 0x0, 0x0, @hyper}, @generic={0x0, "2914b3833388105581ca431170c7"}}) [ 2973.413599][T27433] bond1455: (slave bridge2448): link status definitely down, disabling slave 06:38:28 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000080)=0xddd, 0x4) 06:38:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x14, r1, 0x1}, 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 2973.639257][T11824] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 2973.651151][T11824] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 2973.659577][T11824] CPU: 0 PID: 11824 Comm: syz-executor.2 Tainted: G W 5.14.0-rc1-syzkaller #0 [ 2973.669766][T11824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2973.680032][T11824] RIP: 0010:blk_mq_run_hw_queues+0x32b/0x4a0 06:38:28 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x30, 0x0, 0x0) [ 2973.686118][T11824] Code: ea 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 8b 45 00 89 db 48 8d 1c 98 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ed [ 2973.705753][T11824] RSP: 0018:ffffc9001c8873a8 EFLAGS: 00010246 [ 2973.711858][T11824] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000e226000 [ 2973.719933][T11824] RDX: 0000000000000000 RSI: ffffffff83c25799 RDI: ffff88801f112670 [ 2973.727924][T11824] RBP: ffff88801f238000 R08: 0000000000000000 R09: ffff88801f1125e7 06:38:28 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x418, 0x220, 0x0, 0x220, 0x330, 0x330, 0x330, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @multicast1, 0x1e, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@multicast, @dev={0xac, 0x14, 0x14, 0x28}, @empty, 0x4, 0xffffffff}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, @dev}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) [ 2973.736176][T11824] R10: ffffffff83c255d1 R11: 0000000000000000 R12: ffff88801f111ca0 [ 2973.744182][T11824] R13: ffff88801c63d898 R14: 0000000000000001 R15: ffff88814f198e08 [ 2973.752178][T11824] FS: 00007f78b2e11700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 2973.761136][T11824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2973.767746][T11824] CR2: 00007ffe160b5018 CR3: 0000000159c67000 CR4: 00000000001506f0 [ 2973.775769][T11824] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2973.783761][T11824] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2973.791747][T11824] Call Trace: [ 2973.795132][T11824] blk_freeze_queue_start+0xc4/0xe0 [ 2973.800353][T11824] blk_set_queue_dying+0x24/0x80 [ 2973.805382][T11824] blk_cleanup_queue+0x7b/0x1e0 [ 2973.806791][T11843] x_tables: duplicate underflow at hook 1 [ 2973.810253][T11824] blk_cleanup_disk+0x33/0x80 [ 2973.821385][T11824] nbd_put.part.0+0x92/0x160 [ 2973.826076][T11824] nbd_genl_connect+0x1383/0x1820 [ 2973.831124][T11824] ? nbd_start_device+0xd50/0xd50 06:38:28 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x418, 0x220, 0x0, 0x220, 0x330, 0x330, 0x330, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @multicast1, 0x1e, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@multicast, @dev={0xac, 0x14, 0x14, 0x28}, @empty, 0x4, 0xffffffff}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, @dev}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) [ 2973.840165][T11824] ? lock_downgrade+0x6e0/0x6e0 [ 2973.845051][T11824] ? lock_release+0x522/0x720 [ 2973.849751][T11824] ? rcu_read_lock_sched_held+0xd/0x70 [ 2973.855258][T11824] ? lock_acquire+0x442/0x510 [ 2973.860022][T11824] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 2973.866379][T11824] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x1b7/0x290 [ 2973.873781][T11824] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xaf/0x290 [ 2973.881098][T11824] genl_family_rcv_msg_doit+0x228/0x320 06:38:28 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x418, 0x220, 0x0, 0x220, 0x330, 0x330, 0x330, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast1, @multicast1, 0x1e, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @mac=@multicast, @dev={0xac, 0x14, 0x14, 0x28}, @empty, 0x4, 0xffffffff}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, @dev}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) [ 2973.881316][T11845] x_tables: duplicate underflow at hook 1 [ 2973.886664][T11824] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x290/0x290 [ 2973.886725][T11824] ? genl_op_from_small+0x23/0x3c0 [ 2973.904875][T11824] ? genl_get_cmd+0x3cf/0x480 [ 2973.909584][T11824] genl_rcv_msg+0x328/0x580 [ 2973.914110][T11824] ? genl_get_cmd+0x480/0x480 [ 2973.918813][T11824] ? netlink_sendmsg+0x967/0xdb0 [ 2973.923773][T11824] ? sock_sendmsg+0xcf/0x120 [ 2973.928384][T11824] ? ____sys_sendmsg+0x6e8/0x810 [ 2973.933427][T11824] ? nbd_start_device+0xd50/0xd50 [ 2973.938479][T11824] ? lock_release+0x720/0x720 [ 2973.943177][T11824] ? rcu_read_lock_sched_held+0xd/0x70 [ 2973.948551][T11848] x_tables: duplicate underflow at hook 1 [ 2973.948838][T11824] ? lock_acquire+0x442/0x510 [ 2973.959208][T11824] netlink_rcv_skb+0x153/0x420 [ 2973.964084][T11824] ? genl_get_cmd+0x480/0x480 [ 2973.968823][T11824] ? netlink_ack+0xa60/0xa60 [ 2973.973543][T11824] ? netlink_deliver_tap+0x1b1/0xbc0 [ 2973.978858][T11824] ? _copy_from_iter+0x12b/0x1320 [ 2973.983915][T11824] genl_rcv+0x24/0x40 [ 2973.987918][T11824] netlink_unicast+0x533/0x7d0 [ 2973.992812][T11824] ? netlink_attachskb+0x890/0x890 [ 2973.997948][T11824] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 2974.004213][T11824] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 2974.010575][T11824] ? __phys_addr_symbol+0x2c/0x70 [ 2974.015625][T11824] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 2974.021369][T11824] ? __check_object_size+0x16e/0x3f0 [ 2974.026709][T11824] netlink_sendmsg+0x86d/0xdb0 [ 2974.031497][T11824] ? netlink_unicast+0x7d0/0x7d0 [ 2974.036465][T11824] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 2974.042728][T11824] ? netlink_unicast+0x7d0/0x7d0 [ 2974.047696][T11824] sock_sendmsg+0xcf/0x120 [ 2974.052129][T11824] ____sys_sendmsg+0x6e8/0x810 [ 2974.056911][T11824] ? kernel_sendmsg+0x50/0x50 [ 2974.061618][T11824] ? do_recvmmsg+0x6d0/0x6d0 [ 2974.066240][T11824] ___sys_sendmsg+0xf3/0x170 [ 2974.070850][T11824] ? sendmsg_copy_msghdr+0x160/0x160 [ 2974.076159][T11824] ? rcu_read_lock_sched_held+0xd/0x70 [ 2974.081749][T11824] ? __fget_files+0x21b/0x3e0 [ 2974.086455][T11824] ? lock_downgrade+0x6e0/0x6e0 [ 2974.091329][T11824] ? security_socket_recvmsg+0x8f/0xc0 [ 2974.096806][T11824] ? futex_exit_release+0x220/0x220 [ 2974.102171][T11824] ? fput+0x2a/0x50 [ 2974.106001][T11824] ? __sys_recvfrom+0x2cc/0x3a0 [ 2974.110965][T11824] ? __fget_files+0x23d/0x3e0 [ 2974.115753][T11824] ? __fget_light+0xea/0x280 [ 2974.120366][T11824] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 2974.126629][T11824] __sys_sendmsg+0xe5/0x1b0 [ 2974.131155][T11824] ? __sys_sendmsg_sock+0x30/0x30 [ 2974.136325][T11824] ? syscall_enter_from_user_mode+0x21/0x70 [ 2974.142243][T11824] ? trace_hardirqs_on+0x5b/0x1c0 [ 2974.147491][T11824] do_syscall_64+0x35/0xb0 [ 2974.152017][T11824] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2974.157940][T11824] RIP: 0033:0x4665e9 [ 2974.161848][T11824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2974.181479][T11824] RSP: 002b:00007f78b2e11188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2974.190008][T11824] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 [ 2974.198098][T11824] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 0000000000000004 [ 2974.206172][T11824] RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 [ 2974.214238][T11824] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 [ 2974.222293][T11824] R13: 00007ffefcd760bf R14: 00007f78b2e11300 R15: 0000000000022000 [ 2974.230510][T11824] Modules linked in: [ 2974.268930][T11824] ---[ end trace 8cc77b303d041f4c ]--- [ 2974.284202][T11824] RIP: 0010:blk_mq_run_hw_queues+0x32b/0x4a0 [ 2974.294495][T11824] Code: ea 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 8b 45 00 89 db 48 8d 1c 98 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 ed [ 2974.314756][T11824] RSP: 0018:ffffc9001c8873a8 EFLAGS: 00010246 [ 2974.323643][T11824] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc9000e226000 [ 2974.334321][T11824] RDX: 0000000000000000 RSI: ffffffff83c25799 RDI: ffff88801f112670 [ 2974.343209][T11824] RBP: ffff88801f238000 R08: 0000000000000000 R09: ffff88801f1125e7 [ 2974.352212][T11824] R10: ffffffff83c255d1 R11: 0000000000000000 R12: ffff88801f111ca0 [ 2974.360744][T11824] R13: ffff88801c63d898 R14: 0000000000000001 R15: ffff88814f198e08 [ 2974.400279][T11824] FS: 00007f78b2e11700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 2974.410938][T11832] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 2974.424561][T11824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2974.431728][T11824] CR2: 0000000000006f6c CR3: 0000000159c67000 CR4: 00000000001506f0 [ 2974.440887][T11824] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2974.449615][T11824] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2974.478822][T11824] Kernel panic - not syncing: Fatal exception [ 2974.486576][T11824] Kernel Offset: disabled [ 2974.490942][T11824] Rebooting in 86400 seconds..