last executing test programs: 6.450691877s ago: executing program 4 (id=2866): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000040)=0x1000000, 0x4) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x4}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000200)={'veth1_to_bridge\x00', &(0x7f00000003c0)=@ethtool_link_settings={0x4c, 0x8, 0x1e, 0x3, 0xe9, 0x6, 0x0, 0xf0, 0xf9, 0x0, [0x10, 0x80000000, 0x401, 0x2, 0x8000, 0x6c5a324e, 0xffffffef, 0x3]}}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000017c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x56}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00'}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10004000}, 0xc, &(0x7f0000000240)={&(0x7f00000000c0)={0x34, r2, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xe3}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x1}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xe9}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x800) 4.242084162s ago: executing program 4 (id=2887): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x311585290e0c684d}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xa8, r1, 0x300, 0x70bd27, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4044801}, 0x41) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xd0, r1, 0x200, 0x70bd2a, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0xc, 0x8f, 0x8}, {0xc, 0x90, 0x28c0}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc, 0x8f, 0x4}, {0xc}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x1}, {0xc, 0x90, 0x8}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4000040}, 0x4810) recvmmsg(r0, &(0x7f0000001680)=[{{&(0x7f0000000380)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000400)=""/22, 0x16}, {&(0x7f0000000440)=""/237, 0xed}, {&(0x7f0000000540)=""/21, 0x15}, {&(0x7f0000000580)=""/4096, 0x1000}], 0x4, &(0x7f00000015c0)=""/180, 0xb4}, 0xe201}], 0x1, 0x2000, 0x0) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000001840)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001800)={&(0x7f0000001700)={0xdc, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x4}, @NL80211_ATTR_REG_RULES={0x30, 0x22, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x2}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x6}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x1ff}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3d8d}]}]}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'aa\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_REG_RULES={0x78, 0x22, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x25}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x9}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x3}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xf2e}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x10001}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0xca9f5c}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x1}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x29}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8}]}]}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4}, 0x4000010) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0xbf, &(0x7f0000001880)={@random="ddbfb9753150", @broadcast, @val={@void, {0x8100, 0x4, 0x1, 0x4}}, {@ipv4={0x800, @tipc={{0x1e, 0x4, 0x0, 0x6, 0xad, 0x64, 0x5, 0x9, 0x6, 0x0, @local, @loopback, {[@timestamp_addr={0x44, 0x24, 0xae, 0x1, 0x5, [{@local, 0xb}, {@multicast2, 0x3e}, {@remote, 0x5}, {@broadcast, 0x30}]}, @rr={0x7, 0xf, 0xb0, [@private=0xa010102, @private=0xa010102, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop, @noop, @cipso={0x86, 0x2d, 0x2, [{0x5, 0x5, "bb137c"}, {0x6, 0x12, "42552ac55c0b59a07e5cce430cbdeed2"}, {0x0, 0x2}, {0x2, 0x7, "a38333207d"}, {0x0, 0x7, "07bb45f633"}]}]}}, @payload_mcast={{{{{{0x35, 0x0, 0x0, 0x0, 0x1, 0xb, 0x3, 0x2, 0x8, 0x0, 0x2, 0x0, 0x1, 0x1, 0xa4, 0x3, 0x0, 0x4e20, 0x4e21}, 0x4, 0x4}, 0x3, 0x3}, 0x3}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}}}}, &(0x7f0000001940)={0x0, 0x4, [0xc27, 0x2c5, 0x608, 0x220]}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000019c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001a00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000001b40)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001b00)={&(0x7f0000001a40)={0xa0, r3, 0x400, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x83, 0x5b, "75cbb7540b8830738e7ba348e961b541271f3ebb7228ea6a8b1773383ca9565f32b96c51899a91fc62d565782720460862a24db7f3c4c76ebc5c05b6b3084b491899cb48d6bfa287d4c47194ac28edb64059e062c4a44386969a2dddaafae5bf5346da0176d06d0cea9abe0cb39aff7520f0a0128ee982e3ad5f011f0801e2"}]}, 0xa0}, 0x1, 0x0, 0x0, 0x80}, 0x80) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001bc0), r0) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000001f40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001f00)={&(0x7f0000001c00)={0x2ec, r5, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x357e47e}]}, @TIPC_NLA_NODE={0x50, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_NODE_ID={0x30, 0x3, "739b8ddefe20bac145376f0963d38fefbda68e47c109e5178dea919debf2cc8dc1bf128e39e813d9bfa21736"}]}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffff1}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0xe4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffb}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2e1}]}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8121}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7ff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xf}]}, @TIPC_NLA_LINK={0xd8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x55}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0x2ec}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040001) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_INTERFACE(r6, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x38, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000010}, 0x800) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000002180)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000002140)={&(0x7f00000020c0)={0x6c, 0x0, 0x200, 0x70bd2a, 0xd2e2, {}, [@L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'dvmrp0\x00'}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x30}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x80}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x6c}, 0x1, 0x0, 0x0, 0x14}, 0x8800) syz_genetlink_get_family_id$devlink(&(0x7f00000021c0), r2) r7 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r7, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000002440)=[{&(0x7f0000002200)="07bb030ac77c9c49f8c46603677b60af3a28e8d8c823898bf01ef9c3aeab07118e149042eb190ab27bab6b33f7cf74f7c747ed5f2bf7b2901856bb3dc020bd85d5499ea9c308ebad71c8dd3d870af7d8c0ac005273ac0c90bb3e6a213125637cc8476fa075167ce0882ed200d52f5fd83628ff1b2c05201af5d141140bc2c59c1d00", 0x82}, {&(0x7f00000022c0)="bbe269d844b02378fe19b7efb1b696ee918fcadfdc23b01943f1ab7d92ae59b146c12414b72a3144be5ccf54b9bfaeb15b85f9d77d28fc83a1cc7ce4204920f18d9377643dfcf23da0061d4a48a7a984a1b5a43b797bce26fe65c75fce768ddc34e46f886c1d8bdaf8d4cedcd278c589f7f288e0c9508bbd9a1cc314aa61f274b26d3eca55dc7fb0a1b5b4020d0ba3f6027de39a04d295dda6bea3efbf3ae6a6cbfa82107a3e21dcac87cbfed94f638241de5176e1e679a81dcf36098244b325bfb1571eed13a2eb732d4d313172864683b058fdcdb5735683acc11161b8bae674fd94b1b1eb", 0xe6}, {&(0x7f00000023c0)="8ed283ae9eff22a8eddcb2b43648af5e459232f5fd3790ff3b84f686c39a2ce20822228449e823c04b5aed499ff05b807a75f1d440a3c79c65162b5eb08e2928e364883ad1af13faaab7d42a9070f067d535e988d914eaf770aee21983bab622582b8573f5f81e30", 0x68}], 0x3, &(0x7f0000002480)=[{0xf0, 0x10e, 0x9, "69a6cc715179b92b53cedb297f74364d249f1d430cf77cbd7621070d6664657b258ce612e2d6a56a20164459437338e3b509f1bd130e0faee48d9905726b4f5c3aff49c454fdc83dcf199101bd13779e52bca3a53be165535ebf63ec9b34a197d97268204d14db0dc7ae94c4c00e58127183d034eb3641272e3fc4f63409343b3903e2cda91c64d11cefb632e6e9f93a80de6fffeeb3ab749a16b07a1de613f089182d5a69881ee72e1723550cd92055292f439054dab1c384bbea68dd6bc12d0df10e6ebd22cb8626fa53583b22f226b350d42c2055957fe2b38da4acacf8"}, {0x50, 0x10b, 0x9e5, "0b5ee9a406190a116680242d8e7c7bbe752c4257dbb3009a97dc15253c71de20b03d3b08cdfb3597502d9c694496c087a711228fff6b604257c422ae01347d"}, {0x100, 0x118, 0x2, "60ffa1edc1e3c13d63bc58d4429c6921500a01ec8594b750bb13f9e1dbb5eeffcd789664cd7e59608c89057a86a0132da7fef12d569432c96dad6621d065f001166466ca61cb57d86a6f4b8624f00ffe4112c1d8d0f479f84114d8323b80c568adeef9aec3ae5a22a523e0e04bd9f10f68f1cd51479d7b79f6367673cbf77ed14a6f97904ce65a5f8e1ed47be8e09aae42ed54aff7e8389a0fde477390a2666b8bd83fdca9a7146a9cdaac0c274d69ddd240ff284b4260285a4bf7fdefb36d8ee81cefd9c3e5e272005c203505558f07ec43be5a70859de1fa752a7a9cff5a87e17b0581bdeb5311857d"}, {0xa8, 0x1, 0x6, "6d79250fe2e3d2a3fa1518168254939e6809b3c1eaf937fe23f1c1c203e3b9570f1a0f46b059b576040134cd23157dc65546203cc29a7d9fad4c0767b8f9cb653ff7fdcd96daaea498caad0baa6475133564fb962ee9d2f308e348c7a681857d0fbb0eca104e245578e1041d0df0f74e71d667e4489e4fd87cffd4c330ebbd1340c46c6d9944769c83f114d275bb508cb43338"}, {0xc0, 0x118, 0x5, "5836462410a768b8a090574c1dccd0f0691c9473ed1d41ce4b174a565e4b82cf5cf52e93dc8dfe64d65b8b7c273b1c8946db16d9c55f473b4bd5102a4a1cf5accf4b06fd18f2bb925685507995a96ab9afc87a44d96309a228821c890abc7d5267a200d415267603ab302ea49682a1572ec0de211225d207bd2a9833d649ffbdacb933eea81412aa8fff5109355741e6317136d2ce8f3b89073468779e9911e24952efa475f75d77ca6878d5"}, {0x20, 0xbe, 0xee0, "c61bba42155305e8cda8c748"}, {0xf8, 0x119, 0xf0, "0354280fdc7ce2292622f741802b8e6bffa23bc74f8b919924f8f69ebffc3d971fbcd166e8a621e6fca65d81b0e14ecced5cf8132398117be911d80327b4485b1b0de3b141ec88ece65f55a77d53ca1cc6f971c90bb8ddedfe332244b7a7646e36a30e569822b3543f567eb1bea007a91b6764446097ed587881da67d26e311444eb580e5fc0627c7372e8ea9b13bef076475591434ba7e980c351b0b8587c0e7454e257570b20823a7f1dffba1a4ba164311bac867c19d11a156ecbc505a6983d4485a58be2bb70af89b1b482d167d1267a8ce8ca0fdbf8877cda569ad1da2107"}, {0x108, 0x109, 0x4, "c2cad32f1ef1a4c5c0f7ceb344cdb015f1413945c6aad18b819f7d617017a9ca3ce0276826af276aa5d531c20265e8bc74e12e7795d3b89b072d8f828f67bbd2a44257c7eaa2c921467a1d0a1c7d2b8f3074b8c4969493dd7d9133531f46fa5ffd589f964c7929fddaffb3c2f0d12efea57ffa539edff7e42edc4b7d495a977798e03b987941ac5f5ee24d56eb0559e58e9b9a8c4d3cc8bf9b8a85a794c130216abf1e8bfde4345574a2d3ae80bd42bdff35f2720a7346a44bc0d72735e7e49aac3c357fb82bfd9bbe6d30d180c975caf30fe5646896110166b384950b8dad6cf41b3e9a4f02f6f44d1fcfbb1f7a52b134d00b"}], 0x5c8}, 0xc0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000002ac0), &(0x7f0000002b00)=0x40) sendmsg$NET_DM_CMD_START(r6, &(0x7f0000002c00)={&(0x7f0000002b40)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b80)={0x14, 0x0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x20000000) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000002c40)={r2}) getsockopt$packet_buf(r8, 0x107, 0x1, &(0x7f0000002c80)=""/54, &(0x7f0000002cc0)=0x36) openat$tun(0xffffffffffffff9c, &(0x7f0000002d00), 0x400240, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000002d80), r8) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000002e40)={&(0x7f0000002d40), 0xc, &(0x7f0000002e00)={&(0x7f0000002dc0)={0x24, r9, 0x6, 0x70bd2c, 0x25dfdbfc, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x40) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r8, 0x6628) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000002ec0), r6) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000002f00)=0x0) sendmsg$NFC_CMD_VENDOR(r6, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f40)={0x1c, r10, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) 1.894143177s ago: executing program 2 (id=2897): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x403, 0x0, 0x25dfdbff, {0x0, 0x0, 0x74, 0x0, 0x10800, 0x45007}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0x53}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.803623012s ago: executing program 4 (id=2899): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2712, &(0x7f00000193c0)=""/102394, &(0x7f0000000040)=0x18ffa) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r1, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r2, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61103400000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916000000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d2aca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c437dc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc28206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418df19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200"/1582], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x0, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0xf, &(0x7f00000002c0)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4, r3}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYRES32=r2], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x7}, 0x8, 0x10, &(0x7f0000000000), 0x10, r4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x5) sendmsg$nl_route_sched(r5, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x2, 0x1}, 0x2, r7}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) 1.745130235s ago: executing program 2 (id=2901): r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f00000000c0)=0x5, 0x17) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r1, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001840)=r2, 0x4) sendmmsg$inet(r0, &(0x7f0000000100)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}], 0x1, 0x4800) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x10020) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002e00010000000000fbdbdf25040117800c00160006ac0f00000000001400010000000000000000000000ffff0000000050bb2d6f67d29d6fabadb107d0def49c885ef9c38bc48d3fb22a1b504677b07ed89446b0449ade682e882348c26c2126237dd5b37f5af155b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b94f9ffffffffffffffc65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddedc802a078cf0d972df9e99f079767734f69ce475f00ac6433787a20eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be820400eb000000000000"], 0x114}, {&(0x7f0000000040)={0x10, 0x42, 0x400, 0x70bd2a, 0x25dfdbfd}, 0x10}], 0x2, 0x0, 0x0, 0x40001}, 0x0) 1.597143268s ago: executing program 4 (id=2903): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbf6, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000bc0)=""/260, 0x104}, {&(0x7f0000000600)=""/245, 0xf5}, {&(0x7f0000000f80)=""/4070, 0xfe6}, {&(0x7f0000000e80)=""/230, 0xe6}, {&(0x7f0000000500)=""/245, 0xf5}, {&(0x7f0000000ac0)=""/216, 0xd8}, {&(0x7f0000000240)=""/166, 0xa6}, {&(0x7f0000000980)=""/194, 0xc2}, {&(0x7f0000000d00)=""/169, 0xa9}, {&(0x7f0000000300)=""/100, 0x64}, {&(0x7f0000000040)=""/53, 0x35}, {&(0x7f0000000dc0)=""/147, 0x93}], 0xc}, 0x40002100) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt(r0, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) sendto$inet6(r0, &(0x7f0000000080)="28a616", 0x3, 0x40500c1, &(0x7f0000000100)={0xa, 0x4e23, 0x7, @loopback, 0x879}, 0x1c) r3 = socket$inet6(0xa, 0x3, 0xff) close(r3) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f0000000000)={r6, @in={{0x2, 0x4e24, @empty}}, 0x27c0}, 0x90) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000440)={r6, @in={{0x2, 0x4e24, @loopback}}, 0x6, 0x85}, &(0x7f00000000c0)=0x90) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={r7, 0x4}, 0xc) 1.383976623s ago: executing program 4 (id=2905): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e7, &(0x7f0000000440)="fcb089bbb55d580b677a6173d0b3879e8aacdb04efd067011264093478bc3b14c589b06f6c3337383368634a96551ad76ea129d443ed3487f5e901ee784269b79ec1b8944d2bad73d33c42b8fce16f1a0f4b19045eb44d805c37fc95c6e160d5c7d6be2536432aa87766c0c166d9b50bbada6681f59ed22d65b4e5c38fd15899aeeb14a7656219d64067349f01323c55562d0a41a2fbdff15eff0f68bad52b71ad6e89d89a03743ed563cbc98216b70af2f104d5b845709a216627dd") ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000001c0)={0x2, 0x8d, "f212f99f286f04c7005b68eca87cda4ec3bd8550892c40c2d16da23ac0f6b22051d3f1fd11c0707eca4c479ee2240de91f1413c019ce98b448d5d67405450597a8b955bc1a1bdc2dda83c845add6f9a23e5a30d69a033845f71a9b1c1403446e461262373713333300aeb7b201dda8e088652f0f63de8526ade6584f3086899f6dea27b2da5a64bf6573e874fa"}) bind$bt_l2cap(r0, &(0x7f0000000980)={0x1f, 0x0, @any, 0x0, 0x2}, 0xe) r3 = socket$kcm(0x29, 0x5, 0x0) socket$kcm(0x29, 0x7, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @random="97c4864ef7a3", @void, {@ipv4={0x800, @generic={{0x9, 0x4, 0x0, 0x0, 0x24, 0x64, 0x0, 0x0, 0xc84cf8fe4733a687, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xc}, {[@ssrr={0x89, 0x7, 0xef, [@multicast1=0xe000000d]}, @cipso={0x86, 0x6}]}}}}}}, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000140)={0x1f, 0x2, 0x3}, 0x6) sendmsg$kcm(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x44080) sendmsg(r3, &(0x7f0000003680)={0x0, 0x0, &(0x7f0000003140)=[{&(0x7f0000002d80)="0f", 0x1}, {0x0, 0x2}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x0) r5 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000080)={0x10000000}) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r8, &(0x7f0000000040)={0x40000000}) r9 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_ERRQUEUE(r9, 0x6b, 0x4, &(0x7f0000000000)=0xfffffffe, 0x4) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f00000000c0)={0x0, 0xfff, "5f29ab", 0x3d, 0x6}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f0000000100)={0x20000014}) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000c95aada1d9676e7f8d2e8b5f47cd82e9bc90e5e568d60f300671b7d69e26650fa80c92e33c2fed677a73355aceb0ef172af66a75f679e0d35af7b6395746f0dd2f36fd71f5ee70290fc6d2740d55acd811e1ada28c54e4e8657048c5a8bde94d313c31742825d2d789e1151f7ab6774e7ef27bd3460dded6a535089cdac16888a8ca2137b6bbfb24241b287335551f444f4195f3505b4c736efbffaabd61ece46827e4af1dd49d50eae01190aaffa462325ef7e8fca30db96db1fdce31ed80451b7336494d9f846ac487435a703cae82f4aca1b1c4ec595c", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r10}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x256c6c64}}, [@printk={@lx, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.375747675s ago: executing program 3 (id=2906): r0 = socket$netlink(0x10, 0x3, 0x7) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) 1.252556964s ago: executing program 4 (id=2908): r0 = socket$pptp(0x18, 0x1, 0x2) accept4(r0, 0x0, 0x0, 0x800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x9, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10002}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000008c0), 0x75, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000400)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r3, r2}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) recvmsg$unix(r4, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x4008054) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a09040000000000000000020000000900010073797a30000000000900020073797a32000000002c00048028000180080001006e6174001c0002800800024000000002080003400000000a08000140000001"], 0x80}}, 0x0) r9 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) write$nci(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) 1.25215918s ago: executing program 2 (id=2909): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) clock_gettime(0xfffffff2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x12, r0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180400000000000000000000000000007110a0000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) clock_gettime(0xfffffff2, 0x0) (async) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x12, r0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180400000000000000000000000000007110a0000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x21}, 0x94) (async) 1.144387481s ago: executing program 3 (id=2910): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@setneightbl={0x24, 0x43, 0x400, 0x0, 0x0, {}, [@NDTA_NAME={0xf, 0x1, '\xaa\xaa\xaa\xaa\xaa\xc47\xa5m\"0'}]}, 0x24}}, 0x40040c0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x8, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r2, 0x0, &(0x7f0000000080)=""/12}, 0x20) 1.075951118s ago: executing program 1 (id=2911): r0 = socket(0x2, 0x80805, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000340)={'wg2\x00', {0x2, 0x4e24, @loopback}}) socket(0x2, 0x80805, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) (async) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000340)={'wg2\x00', {0x2, 0x4e24, @loopback}}) (async) 1.01995391s ago: executing program 0 (id=2912): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c40)=@raw={'raw\x00', 0x8, 0x3, 0x3d8, 0x0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x308, 0xffffffff, 0xffffffff, 0x308, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@unspec=@physdev={{0x68}, {'dummy0\x00', {0xff}, 'macvtap0\x00', {0xff}, 0x0, 0x2}}, @common=@srh1={{0x90}, {0x1, 0x1, 0x0, 0x0, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x3a}, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xff000000, 0xff, 0xffffffff, 0xffffffff], [0x0, 0x0, 0x0, 0xffffff00], [0xff, 0xffffffff, 0xff], 0x1, 0x1aeeb7877a132835}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private2, [0xffffff00, 0xff000000, 0x0, 0xffffff00], [0x0, 0xffffffff, 0xffffffff, 0xff000000], 'team_slave_0\x00', 'bridge_slave_1\x00', {0xff}, {0x101}, 0x11, 0x2, 0x5, 0x5}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x3, 0x2, 0x3, 0x1, 0x2}}, @common=@inet=@set1={{0x28}, {{0x0, 0x2, 0x1}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x100, 0x700000, 0x8, 'syz0\x00', {0x8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newlink={0x44, 0x10, 0x403, 0x58bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x20}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newlink={0x64, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x6}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x2}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x100}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.019095295s ago: executing program 2 (id=2913): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000400)={r0, r0, 0x0, 0x0, 0x0, 0x9, 0x1, 0xb57, 0x1012, 0x43, 0x1, 0x7, 'syz0\x00'}) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) openat$cgroup_ro(r2, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) (async) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f00000000c0)={@none, 0x1, 0x1ff, 0x2, 0x1, 0x2, "5096c62eaf17a13ca5ca65fabe357fa38f111a027a64f3ac74a1a90245d0c15deab6b81fa0a93e3890e0c51e218eef0622037f93d09bb6f15bb72ee847485869f0be3e35f98338553ddaa3063aedc92825b8c5529603a82dbac2161f12d1687c4aec1476732428a43e1647235d122da0c4622355f6c3b331e208f1f15b6349dd"}) 931.507196ms ago: executing program 3 (id=2914): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r1 = socket$kcm(0x2, 0xa, 0x2) (async) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x256c6c64}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) (async) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth1_virt_wifi\x00', 0x0}) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x2}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_BETA={0x8, 0x6, 0x8}]}}]}, 0x3c}}, 0x20008000) ioctl$int_in(r3, 0x5452, &(0x7f0000000280)=0x3a0af83a) shutdown(r3, 0x1) (async) listen(r3, 0x20) shutdown(r3, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r0, &(0x7f0000000100)={@void, @void, @eth={@broadcast, @link_local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4, 0x0, 0x0, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x14}, @multicast1}, {0x4e24, 0x17c1, 0x48, 0x0, @wg=@cookie={0x3, 0x1, "7bab609c8da617628791d4c4290502fbe4481908af13a098", "4c41fee30f9b16c1af63fc61b08209779d8ad0653947e12de7ee64af1d2289ae"}}}}}}}, 0x6e) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x2, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5d}]}, &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 891.989185ms ago: executing program 1 (id=2915): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000000)="9f9553a5fa0410eaca62941e35abe0f4b8c4b8f380a06b8c2c8e7a91a9f8ce03acdc435f611da62c6637498e0d059c3ccc26dea1351126af62814b9c44716a09d32f4e18dcbe441a791a469f62a7039667370ddf9b05828738fde0e303ad7500c524fb09c7c3df9b") 704.008838ms ago: executing program 1 (id=2916): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000000c0)={0x0, 0x3, 0x20, 0xfffffffffffffffb, 0x2}, &(0x7f0000000140)=0x18) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={r2, 0x5}, 0x8) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000000c0)={0x0, 0x3, 0x20, 0xfffffffffffffffb, 0x2}, &(0x7f0000000140)=0x18) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={r2, 0x5}, 0x8) (async) 637.459621ms ago: executing program 2 (id=2917): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r1, 0x3a, 0x8, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000001c0)={r2, 0x9}, &(0x7f00000002c0)=0x8) 502.614933ms ago: executing program 2 (id=2918): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000480)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd70000200df2528000000050007001c00000008000300", @ANYRES32=r2], 0x24}}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MON_PEER_GET(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8001}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x40011}, 0x8001) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x30, 0x40, 0x1, 0x7fffc, 0x25dfdbfe, {0x1}, [@nested={0x4, 0x47}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @pid}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd}]}, 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071043d000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) 432.562323ms ago: executing program 1 (id=2919): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x3}, [@alu={0x4, 0x1, 0x9, 0x0, 0x0, 0x1}]}, &(0x7f00000005c0)='syzkaller\x00', 0x2}, 0x94) 431.8381ms ago: executing program 0 (id=2920): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x34}}, 0x20000000) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0008"], 0x34}}, 0x400c010) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="660a000000000000611183000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x34}}, 0x20000000) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0008"], 0x34}}, 0x400c010) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="660a000000000000611183000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) (async) 429.798745ms ago: executing program 3 (id=2921): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000400)="580000001400192340834b80040d8c560a063fbc45ff6205000000000700580003480400945f640094272d7061d328b92d0900000000008000f0fffeffe809000000ffd9dd000000100001000b0808004149224e06040800", 0x58}], 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="020000000000000002000000e0"], 0x190) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="340000001000050025bd7000fadbdf2500000000", @ANYRES32=r5, @ANYBLOB="00000000010400000a0001"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xfffb, 0x1}, 0x6) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e001"], 0x190) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000080)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000040)={'ip_vti0\x00', 0x0, 0x8000, 0x80, 0x8b, 0x12, {{0x16, 0x4, 0x1, 0x4, 0x58, 0x68, 0x0, 0x2, 0x29, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@rr={0x7, 0xf, 0xee, [@multicast2, @local, @broadcast]}, @ssrr={0x89, 0x13, 0x80, [@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @broadcast, @multicast2]}, @generic={0x7, 0xb, "9ca86d885ec4d243ba"}, @rr={0x7, 0x17, 0xd2, [@broadcast, @private=0xa010101, @local, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@bridge_newvlan={0x74, 0x70, 0x10, 0x70bd28, 0x25dfdbfb, {0x7, 0x0, 0x0, r7}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x5, 0x6, 0x5}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x2}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x25, 0x1}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_RANGE={0x6, 0x2, 0x10}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x13}}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8, 0x2, 0x11}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x40000}, 0x18001) write(r0, &(0x7f00000000c0)="240000005f005f03a9f9f4ba0a1f0000000000000000ecffffffffffffff000000000000", 0x24) 363.876066ms ago: executing program 1 (id=2922): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) (async) listen(r0, 0x0) (async) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) sendmmsg$alg(r1, &(0x7f0000004ec0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000004}], 0x1, 0x20) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) (async) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) (async, rerun: 32) r3 = accept4$unix(r0, 0x0, 0x0, 0x0) (rerun: 32) recvfrom$unix(r3, &(0x7f00000002c0)=""/263, 0x107, 0x0, 0x0, 0x0) (async) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xb, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095", @ANYRESDEC=r3, @ANYRESHEX=r2, @ANYBLOB="fbcb1006023e9a3e66d03b6fdbd91c8764b2a13f13df717dcb124be6d40f2da3b434f8d61fdc4f4b3dcd9e513ff64d7d975c8fe534ebe6f6"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r4, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="1100"/12, @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0xa) (async, rerun: 64) r6 = epoll_create(0x7) (rerun: 64) syz_emit_ethernet(0x46, &(0x7f0000000800)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="8f4961884fc4", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x10, 0x3a, 0xff, @dev, @mcast2, {[], @ni={0x8c, 0x0, 0x0, 0x6, 0x2, 0x4}}}}}}, 0x0) (async) r7 = socket$key(0xf, 0x3, 0x2) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000280)={0x20000000}) 358.591736ms ago: executing program 0 (id=2923): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000003200)={'ip6tnl0\x00', &(0x7f0000003180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty}}) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$inet_sctp(r2, &(0x7f0000000ec0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000004c0)="a7", 0x1}], 0x1, 0x0, 0x0, 0x14}], 0x1, 0xc804) sendmsg$NL80211_CMD_SET_CHANNEL(r2, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="40082dbd7000ffdbdf25410000000c0099000400403b8e4a168e5a8d7a30c80d257cdf7a009500000006685260f7441036d9f141a57bb169c313c2d32b033a3dd664d06f04cd4ced72b31789a5db7ad2a5e3e13291d8"], 0x20}, 0x1, 0x0, 0x0, 0x40008000}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000640)={@map, 0xffffffffffffffff, 0x1d}, 0x20) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r4 = socket$netlink(0x10, 0x3, 0x0) preadv(r3, &(0x7f0000000b80)=[{&(0x7f0000000140)=""/10, 0xa}, {0x0, 0x61}], 0x2, 0x7, 0x8000) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) socket$alg(0x26, 0x5, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000003200)={'ip6tnl0\x00', &(0x7f0000003180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @empty}}) (async) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) (async) accept4(r0, 0x0, 0x0, 0x800) (async) sendmmsg$inet_sctp(r2, &(0x7f0000000ec0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000004c0)="a7", 0x1}], 0x1, 0x0, 0x0, 0x14}], 0x1, 0xc804) (async) sendmsg$NL80211_CMD_SET_CHANNEL(r2, &(0x7f0000001f40)={0x0, 0x0, &(0x7f0000001f00)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="40082dbd7000ffdbdf25410000000c0099000400403b8e4a168e5a8d7a30c80d257cdf7a009500000006685260f7441036d9f141a57bb169c313c2d32b033a3dd664d06f04cd4ced72b31789a5db7ad2a5e3e13291d8"], 0x20}, 0x1, 0x0, 0x0, 0x40008000}, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000640)={@map, 0xffffffffffffffff, 0x1d}, 0x20) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) (async) socket$netlink(0x10, 0x3, 0x0) (async) preadv(r3, &(0x7f0000000b80)=[{&(0x7f0000000140)=""/10, 0xa}, {0x0, 0x61}], 0x2, 0x7, 0x8000) (async) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) 226.826042ms ago: executing program 1 (id=2924): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getsockname$packet(r1, 0x0, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='devices.list\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x30, r4, 0x1, 0x70bd29, 0x4, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xca}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x80) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xbfd9ff4e18d51abe}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x5c}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="a90cdf69017f"}, @chandef_params]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@multicast2, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@remote, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 156.777434ms ago: executing program 3 (id=2925): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f0000001280)=""/4107, &(0x7f00000000c0)=0x100b) r1 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$sock(r1, &(0x7f0000001c00)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000300)="95cb57f7f9f5e9b19422fdbba16052a29a2d3be6e213bd75a97b56c7dc217216090e7c97", 0x34000}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000880)="05ba8c1cfb03f631fd2d06121541e78e6718599f7482f9b4b4464ff2d795", 0x1e}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x40) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af3653c001a0004000202080002000300010004000600eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 149.904063ms ago: executing program 3 (id=2926): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d000000000000000002000000000000060000000006001500010000001800168014000100800000000000000000001000000011"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) r3 = socket$nl_rdma(0x10, 0x3, 0x14) recvmmsg(r3, &(0x7f0000000ec0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x12022, 0x0) sendmsg$RDMA_NLDEV_CMD_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="100000000114a73a"], 0x5c}}, 0x0) sendmsg$NL80211_CMD_START_SCHED_SCAN(r0, &(0x7f0000000580)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)={0x120, r1, 0x20, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x7c}}}}, [@NL80211_ATTR_SCHED_SCAN_MATCH={0x8, 0x84, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_IE={0xe5, 0x2a, [@perr={0x84, 0x63, {0x3, 0x7, [{{}, @broadcast, 0x2, @void, 0x10}, {{}, @device_b, 0x54, @void, 0x31}, {{}, @broadcast, 0xfffffff7, @void, 0x18}, {{0x0, 0x1}, @device_b, 0x1, @value=@broadcast, 0x9d8f}, {{}, @device_b, 0x8, @void, 0x1e}, {{}, @device_a, 0x0, @void, 0x21}, {{}, @device_a, 0x8, @void, 0x23}]}}, @perr={0x84, 0x69, {0x1, 0x7, [{{0x0, 0x1}, @broadcast, 0x19, @value, 0x2c}, {{}, @device_a, 0xf, @void, 0x37}, {{}, @device_b, 0x8000, @void, 0x5}, {{}, @device_a, 0x9, @void, 0xa}, {{0x0, 0x1}, @device_a, 0xfffff801, @value=@device_b, 0x3f}, {{}, @device_b, 0x6, @void, 0x2a}, {{}, @device_a, 0xd66c, @void, 0x40}]}}, @mesh_id={0x72, 0x6}, @mesh_config={0x71, 0x7, {0x0, 0x0, 0x1, 0x1, 0x2, 0x9, 0x45}}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0xb}]}, 0x120}, 0x1, 0x0, 0x0, 0x81}, 0x20000810) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000046c0)={'filter\x00', 0x7, 0x4, 0x3c8, 0x0, 0x0, 0x110, 0x2e0, 0x110, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@arp={@multicast2, @private=0xa010100, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0xe8}, @unspec=@AUDIT={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) listen(r5, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000300)=@generic={&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x10}, 0x18) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r10 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) recvmmsg(r6, &(0x7f0000007f00)=[{{0x0, 0x0, &(0x7f0000002740)=[{&(0x7f00000005c0)=""/178, 0xb2}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/11, 0xb}, {&(0x7f0000002340)=""/112, 0x70}, {&(0x7f00000023c0)=""/223, 0xdf}, {&(0x7f00000024c0)=""/247, 0xf7}, {&(0x7f00000025c0)=""/23, 0x17}, {&(0x7f0000002600)=""/154, 0x9a}, {&(0x7f00000026c0)=""/108, 0x6c}], 0x9, &(0x7f0000002800)=""/235, 0xeb}, 0x5}, {{&(0x7f0000002900)=@generic, 0x80, &(0x7f0000003a40)=[{&(0x7f0000002980)=""/142, 0x8e}, {&(0x7f0000002a40)=""/4096, 0x1000}], 0x2, &(0x7f0000003a80)=""/21, 0x15}, 0x6}, {{&(0x7f0000003ac0)=@xdp, 0x80, &(0x7f0000003ec0)=[{&(0x7f0000003b40)=""/163, 0xa3}, {&(0x7f0000003c00)=""/59, 0x3b}, {&(0x7f0000003c40)=""/220, 0xdc}, {&(0x7f0000003d40)=""/193, 0xc1}, {&(0x7f0000003e40)=""/44, 0x2c}, {&(0x7f0000003e80)=""/24, 0x18}], 0x6, &(0x7f0000003f40)}, 0x1}, {{&(0x7f0000003f80)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000006140)=[{&(0x7f0000004000)=""/4096, 0x1000}, {&(0x7f0000005000)=""/25, 0x19}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/68, 0x44}, {&(0x7f00000060c0)=""/78, 0x4e}], 0x5}, 0xe51}, {{&(0x7f00000061c0)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f00000074c0)=[{&(0x7f0000006240)=""/140, 0x8c}, {&(0x7f0000006300)=""/47, 0x2f}, {&(0x7f0000006340)=""/242, 0xf2}, {&(0x7f0000006440)=""/113, 0x71}, {&(0x7f00000064c0)=""/4096, 0x1000}], 0x5, &(0x7f0000007540)=""/36, 0x24}, 0x400}, {{&(0x7f0000007580)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f00000077c0)=[{&(0x7f0000007600)=""/92, 0x5c}, {&(0x7f0000007680)}, {&(0x7f00000076c0)=""/111, 0x6f}, {&(0x7f0000007740)=""/68, 0x44}], 0x4, &(0x7f0000007800)=""/184, 0xb8}, 0x9}, {{&(0x7f00000078c0)=@l2, 0x80, &(0x7f0000007e00)=[{&(0x7f0000007940)=""/56, 0x38}, {&(0x7f0000007980)=""/129, 0x81}, {&(0x7f0000007a40)=""/247, 0xf7}, {&(0x7f0000007b40)=""/194, 0xc2}, {&(0x7f0000007c40)=""/159, 0x9f}, {&(0x7f0000007d00)=""/134, 0x86}, {&(0x7f0000007dc0)=""/56, 0x38}], 0x7, &(0x7f0000007e80)=""/67, 0x43}, 0x7}], 0x7, 0x160, &(0x7f00000080c0)={0x0, 0x3938700}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000e00)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x10, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x6}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x4e21, 0x2, @loopback, 0x1fcf}}, 0x0, 0x0, 0x3f, 0x0, "34b4cd04032119e5b9358ab008d64d23d37d0684330b9822d52059f471d511c3730f4ee62103b8782c561daf37d3b4c7c540a693f71a75782f24ebaf48637f6026d20b578d4f9799d13ceafef728cf68"}, 0xd8) r11 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r11, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 135.015779ms ago: executing program 0 (id=2927): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28011, r0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xf, &(0x7f0000000900)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0xffffff6a) (async) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000000)={r4, 0xffff, 0x3}, 0x8) socket(0x15, 0x2, 0x7fff) 83.135392ms ago: executing program 0 (id=2928): socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 32) unshare(0x26020480) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f00000000c0)=@file={0x0, './file1\x00'}, 0x6e) (async) unshare(0x100) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x33}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xc4}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20080040) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.sectors\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 0s ago: executing program 0 (id=2929): r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000000980)={0x28, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x8e1, 0x1e}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x400e080}, 0x4) (async, rerun: 64) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) (rerun: 64) sendmsg$SMC_PNETID_DEL(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x98, r1, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'vxcan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_team\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'nicvf0\x00'}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) (async) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xd0, r2, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x1000}, {0x8, 0x15, 0x20000000}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1}, {0x6, 0x11, 0xfffd}, {0x8, 0x15, 0xfffffff8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x3}, {0x8, 0x15, 0x5}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40010}, 0x4000) r3 = socket(0x10, 0x80002, 0x0) getsockopt$sock_int(r3, 0x1, 0x30, 0x0, &(0x7f0000000000)=0x24) kernel console output (not intermixed with test programs): yz.2.1173'. [ 194.398480][T10445] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1175'. [ 194.597880][T10466] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1180'. [ 194.608964][T10466] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1180'. [ 194.874410][T10475] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1182'. [ 195.085094][T10496] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 195.102080][T10493] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 195.262636][T10504] netlink: 'syz.4.1188': attribute type 16 has an invalid length. [ 195.270268][T10503] syzkaller0: entered promiscuous mode [ 195.280267][T10503] syzkaller0: entered allmulticast mode [ 195.288849][T10504] netlink: 'syz.4.1188': attribute type 3 has an invalid length. [ 195.308981][T10504] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1188'. [ 195.321673][T10505] netlink: 'syz.1.1190': attribute type 1 has an invalid length. [ 195.329937][ T29] audit: type=1107 audit(1778344769.582:7): pid=10498 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Ù‹5ž÷Œ•%èÍUýAÊÃËÙ ë0ä™l…t¿Ý•/Öÿ Ž6òŠ¨Šç›PL' [ 195.425217][T10518] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1190'. [ 195.445210][T10505] 8021q: adding VLAN 0 to HW filter on device bond3 [ 195.507843][T10523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1193'. [ 195.920814][T10540] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 195.950511][T10540] bond4: (slave lo): Enslaving as an active interface with an up link [ 195.974630][T10540] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 196.014073][T10553] syzkaller0: entered promiscuous mode [ 196.029692][T10553] syzkaller0: entered allmulticast mode [ 196.207673][T10555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.354837][ T5633] Bluetooth: hci2: command 0x0406 tx timeout [ 196.365582][ T5630] Bluetooth: hci1: command 0x0406 tx timeout [ 196.373167][ T50] Bluetooth: hci3: command 0x0406 tx timeout [ 196.565092][T10589] netlink: 'syz.2.1212': attribute type 16 has an invalid length. [ 197.274245][T10645] netlink: 'syz.2.1220': attribute type 3 has an invalid length. [ 197.587951][T10660] bond0: (slave geneve0): Releasing active interface [ 197.652026][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 197.673356][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 197.734869][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 197.759291][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 197.929119][T10681] netlink: 'syz.1.1229': attribute type 1 has an invalid length. [ 198.149936][T10681] 8021q: adding VLAN 0 to HW filter on device bond4 [ 198.161416][ T12] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 198.222659][T10682] bond4: (slave veth0_to_bond): making interface the new active one [ 198.234083][T10682] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 200.938618][T10688] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 201.191653][T10777] __nla_validate_parse: 42 callbacks suppressed [ 201.191670][T10777] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1247'. [ 201.206691][T10773] syzkaller0: entered promiscuous mode [ 201.216070][T10773] syzkaller0: entered allmulticast mode [ 201.283821][T10773] tipc: Enabled bearer , priority 0 [ 201.380636][T10772] tipc: Resetting bearer [ 201.664616][T10772] tipc: Disabling bearer [ 201.762845][ T809] hsr0: entered promiscuous mode [ 202.002480][T10826] syzkaller0: entered promiscuous mode [ 202.023732][T10826] syzkaller0: entered allmulticast mode [ 202.036530][T10823] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1254'. [ 202.101507][T10826] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 202.119324][T10826] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 202.183739][T10842] netlink: 'syz.3.1259': attribute type 5 has an invalid length. [ 202.622010][T10837] netlink: 'syz.1.1255': attribute type 29 has an invalid length. [ 202.643691][T10837] netlink: 'syz.1.1255': attribute type 29 has an invalid length. [ 202.779018][T10869] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1267'. [ 203.100465][T10877] bond0: entered allmulticast mode [ 203.120311][T10878] netlink: 'syz.0.1268': attribute type 39 has an invalid length. [ 203.134527][T10881] veth0: entered promiscuous mode [ 203.236056][T10881] dvmrp0: entered allmulticast mode [ 203.257796][T10880] veth0: left promiscuous mode [ 203.376625][T10890] bond0: option ad_select: unable to set because the bond device is up [ 203.421888][T10890] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1274'. [ 203.440467][T10894] netlink: 'syz.4.1275': attribute type 4 has an invalid length. [ 203.468669][T10894] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1275'. [ 203.491976][T10897] netlink: 'syz.3.1276': attribute type 32 has an invalid length. [ 203.504263][T10891] dvmrp0: entered allmulticast mode [ 203.511099][T10894] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 203.526623][T10897] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1276'. [ 203.653643][T10897] bond3: option coupled_control: invalid value (192) [ 203.667845][T10897] bond3 (unregistering): Released all slaves [ 203.713044][T10915] erspan0: entered promiscuous mode [ 203.742243][T10915] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1280'. [ 203.763218][T10915] erspan0: left promiscuous mode [ 203.765422][T10917] netlink: 'syz.4.1279': attribute type 1 has an invalid length. [ 203.814869][T10919] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1281'. [ 203.862011][T10913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1279'. [ 203.981899][T10913] team1: entered promiscuous mode [ 203.997535][T10913] team1: entered allmulticast mode [ 204.198996][T10944] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1285'. [ 205.556881][T11009] veth0: entered promiscuous mode [ 206.213453][T11030] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 206.229520][T11034] IPv6: addrconf: prefix option has invalid lifetime [ 206.241997][ T809] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 206.261952][T11039] IPv6: addrconf: prefix option has invalid lifetime [ 206.504290][T11054] __nla_validate_parse: 6 callbacks suppressed [ 206.504309][T11054] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1322'. [ 206.609529][T11059] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1324'. [ 206.634435][T11059] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.1324'. [ 206.663734][T11063] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1326'. [ 206.922766][T11084] xt_recent: Unsupported userspace flags (000000b1) [ 207.018402][T11087] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1332'. [ 207.159183][T11098] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1334'. [ 207.241752][T11100] netlink: 19668 bytes leftover after parsing attributes in process `syz.0.1336'. [ 207.784063][T11128] netem: change failed [ 208.045317][T11144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1353'. [ 208.181562][T11153] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1354'. [ 208.391691][T11170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1361'. [ 208.604104][T11174] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 208.621422][T11174] bond5 (unregistering): Released all slaves [ 208.693522][ T1121] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.733348][ T1121] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.764215][ T1121] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 208.789493][ T1121] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 209.204124][T11219] bond0: left allmulticast mode [ 209.353844][T11227] veth1_macvtap: left promiscuous mode [ 209.369164][T11232] netlink: 'syz.3.1376': attribute type 2 has an invalid length. [ 209.404853][T11227] block nbd2: not configured, cannot reconfigure [ 209.416354][T11232] netlink: 'syz.3.1376': attribute type 1 has an invalid length. [ 209.444263][T11232] netlink: 'syz.3.1376': attribute type 1 has an invalid length. [ 209.622670][T11244] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 209.640114][T11244] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 209.710631][T11245] netlink: 'syz.2.1381': attribute type 11 has an invalid length. [ 209.741772][T11244] netlink: 'syz.2.1381': attribute type 11 has an invalid length. [ 209.951791][T11268] syzkaller1: entered promiscuous mode [ 209.969053][T11268] syzkaller1: entered allmulticast mode [ 210.083847][T11283] netlink: 'syz.2.1391': attribute type 23 has an invalid length. [ 210.284231][T11294] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 210.582234][T11308] netlink: 'syz.1.1398': attribute type 4 has an invalid length. [ 210.752673][T11313] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 210.874732][T11315] xt_CT: No such helper "pptp" [ 210.900000][T11325] syzkaller0: entered promiscuous mode [ 210.905799][T11325] syzkaller0: entered allmulticast mode [ 211.011874][T11325] tipc: Started in network mode [ 211.019016][T11327] Bluetooth: MGMT ver 1.23 [ 211.021233][T11325] tipc: Node identity 4e86a1d04cfa, cluster identity 4711 [ 211.033339][T11325] tipc: Enabled bearer , priority 0 [ 211.099204][T11325] tipc: Resetting bearer [ 211.123061][T11325] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 211.132814][T11325] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 211.192581][T11324] tipc: Resetting bearer [ 211.303387][T11324] tipc: Disabling bearer [ 211.605048][T11353] netlink: 'syz.2.1411': attribute type 12 has an invalid length. [ 211.929934][ T29] audit: type=1107 audit(1778344786.202:8): pid=11366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Ù‹5ž÷Œ•%èÍUýAÊÃËÙ ë0ä™l…t¿Ý•/Öÿ Ž6òŠ¨Šç›' [ 212.051289][ T29] audit: type=1804 audit(1778344786.322:9): pid=11372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1417" name="/newroot/266/cgroup.controllers" dev="tmpfs" ino=1381 res=1 errno=0 [ 212.114305][ T29] audit: type=1800 audit(1778344786.342:10): pid=11372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1417" name="cgroup.controllers" dev="tmpfs" ino=1381 res=0 errno=0 [ 212.339908][T11397] netlink: 'syz.1.1424': attribute type 1 has an invalid length. [ 212.428880][T11402] __nla_validate_parse: 18 callbacks suppressed [ 212.428899][T11402] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1427'. [ 212.438411][T11397] 8021q: adding VLAN 0 to HW filter on device bond5 [ 212.504255][T11405] xt_hashlimit: size too large, truncated to 1048576 [ 212.516145][T11397] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1424'. [ 212.771739][T11422] netlink: 'syz.3.1428': attribute type 1 has an invalid length. [ 212.950508][T11432] openvswitch: netlink: Missing key (keys=40, expected=80) [ 212.963015][T11432] openvswitch: netlink: IP tunnel dst address not specified [ 213.022343][T11426] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1431'. [ 213.099471][T11437] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1431'. [ 213.157283][T11422] 8021q: adding VLAN 0 to HW filter on device bond3 [ 213.187288][T11424] vlan0: entered allmulticast mode [ 213.192592][T11424] bond3: entered allmulticast mode [ 213.225532][T11428] bond3: (slave geneve2): making interface the new active one [ 213.234771][T11428] geneve2: entered allmulticast mode [ 213.243259][T11428] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 213.473495][T11456] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1436'. [ 213.586042][T11459] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1437'. [ 213.619862][T11465] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1439'. [ 213.689875][T11470] pimreg: entered allmulticast mode [ 213.730765][T11472] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1442'. [ 213.901461][T11472] bond4: option xmit_hash_policy: invalid value (64) [ 213.924599][T11472] bond4 (unregistering): Released all slaves [ 213.972332][T11485] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1447'. [ 213.984337][T11484] pim6reg: entered allmulticast mode [ 214.015006][T11485] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1447'. [ 214.144552][T11490] bond5: entered promiscuous mode [ 214.157298][T11490] 8021q: adding VLAN 0 to HW filter on device bond5 [ 214.419001][T11506] validate_nla: 3 callbacks suppressed [ 214.419018][T11506] netlink: 'syz.2.1453': attribute type 2 has an invalid length. [ 214.469661][T11510] netlink: 'syz.3.1455': attribute type 1 has an invalid length. [ 214.641355][T11524] xt_policy: neither incoming nor outgoing policy selected [ 214.794997][T11533] netlink: 'syz.2.1463': attribute type 1 has an invalid length. [ 214.892649][T11544] ieee802154 phy1 wpan1: encryption failed: -22 [ 215.014272][T11536] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 215.036876][T11536] bond4: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 215.055117][T11536] bond4: (slave vxcan3): making interface the new active one [ 215.067137][T11555] syz2: rxe_newlink: already configured on ipvlan1 [ 215.080154][T11536] bond4: (slave vxcan3): Enslaving as an active interface with an up link [ 215.265315][T11545] bond4: (slave vxcan5): The slave device specified does not support setting the MAC address [ 215.280783][T11545] bond4: (slave vxcan5): Enslaving as a backup interface with an up link [ 215.336839][T11555] syzkaller1: entered promiscuous mode [ 215.372848][T11555] syzkaller1: entered allmulticast mode [ 215.475709][T11560] syzkaller1: left promiscuous mode [ 215.483959][T11560] syzkaller1: left allmulticast mode [ 215.818413][T11591] netlink: 'syz.1.1474': attribute type 1 has an invalid length. [ 215.863731][T11591] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 216.114856][T11614] netlink: 'syz.2.1480': attribute type 30 has an invalid length. [ 216.474837][T11643] netlink: 'syz.2.1489': attribute type 1 has an invalid length. [ 216.854679][T11650] veth0: entered promiscuous mode [ 216.870084][T11649] veth0: left promiscuous mode [ 217.115471][T11664] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 217.380823][T11673] netlink: 'syz.2.1497': attribute type 30 has an invalid length. [ 217.445352][T11673] bond5: option arp_missed_max: invalid value (0) [ 217.452503][T11673] bond5: option arp_missed_max: allowed values 1 - 255 [ 217.468643][T11673] bond5 (unregistering): Released all slaves [ 217.696655][T11686] __nla_validate_parse: 25 callbacks suppressed [ 217.696674][T11686] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1500'. [ 217.865234][T11700] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.1504'. [ 217.866077][T11697] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1503'. [ 218.303588][T11709] netlink: 'syz.2.1506': attribute type 12 has an invalid length. [ 218.341558][T11725] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.365125][T11725] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.393944][T11725] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.416644][T11725] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 218.444788][T11729] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1510'. [ 218.481471][T11729] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1510'. [ 218.514546][T11733] xt_hashlimit: size too large, truncated to 1048576 [ 218.530316][T11727] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 218.589952][T11732] netlink: 248 bytes leftover after parsing attributes in process `syz.3.1512'. [ 218.600414][ T1125] netdevsim netdevsim4 eth0: set [0, 1] type 1 family 0 port 8472 - 0 [ 218.614600][ T1125] netdevsim netdevsim4 eth1: set [0, 1] type 1 family 0 port 8472 - 0 [ 218.625901][T11729] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1510'. [ 218.647202][T11732] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1512'. [ 218.662376][ T1125] netdevsim netdevsim4 eth2: set [0, 1] type 1 family 0 port 8472 - 0 [ 218.666297][T11729] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1510'. [ 218.680207][ T1125] netdevsim netdevsim4 eth3: set [0, 1] type 1 family 0 port 8472 - 0 [ 218.898158][T11742] Unsupported ieee802154 address type: 0 [ 218.947688][T11743] netlink: 'syz.3.1515': attribute type 1 has an invalid length. [ 218.966043][T11743] netlink: 'syz.3.1515': attribute type 2 has an invalid length. [ 218.988774][T11743] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1515'. [ 219.168039][T11756] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 219.202173][T11756] ieee802154 phy1 wpan1: encryption failed: -22 [ 219.219509][T11757] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 219.224155][T11756] ieee802154 phy1 wpan1: encryption failed: -22 [ 219.290542][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.343816][T11763] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.388760][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.425284][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.476765][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.498630][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.520355][T11773] validate_nla: 1 callbacks suppressed [ 219.520370][T11773] netlink: 'syz.1.1523': attribute type 12 has an invalid length. [ 219.523055][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.550140][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.567770][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.581362][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.609349][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.629813][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.643111][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.670765][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.702169][T11762] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.780474][T11780] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 219.860167][T11780] netlink: 'syz.1.1527': attribute type 2 has an invalid length. [ 219.874493][T11780] netlink: 'syz.1.1527': attribute type 2 has an invalid length. [ 219.890106][T11780] tipc: Enabling of bearer rejected, media not registered [ 220.264607][T11813] siw: device registration error -23 [ 220.264611][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.308315][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.337683][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.394313][T11815] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 220.395972][T11822] netlink: 'syz.4.1537': attribute type 1 has an invalid length. [ 220.421596][T11826] openvswitch: netlink: Multiple metadata blocks provided [ 220.425929][T11815] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 220.448749][T11815] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 220.454875][T11828] openvswitch: netlink: Multiple metadata blocks provided [ 220.499564][T11815] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 220.522803][T11831] x_tables: duplicate underflow at hook 3 [ 220.589678][T11815] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 220.607653][T11838] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 220.630710][T11837] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 220.716957][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.728744][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.730617][T11841] bond0: Device is already in use. [ 220.794598][T11841] bond6: option xmit_hash_policy: invalid value (64) [ 220.830429][T11841] bond6 (unregistering): Released all slaves [ 220.872173][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.882283][T11829] nbd1: detected capacity change from 0 to 63 [ 220.905755][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.945999][T11850] netlink: 'syz.2.1546': attribute type 10 has an invalid length. [ 220.949392][T11815] hsr0 speed is unknown, defaulting to 1000 [ 220.963590][ T5637] block nbd1: Send control failed (result -32) [ 220.965258][ T4946] block nbd1: Receive control failed (result -32) [ 220.973225][ T5632] block nbd1: Receive control failed (result -32) [ 221.006605][ T5637] block nbd1: Request send failed, requeueing [ 221.037629][ T11] block nbd1: Dead connection, failed to find a fallback [ 221.047903][ T11] block nbd1: shutting down sockets [ 221.053818][ T11] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.069230][ T11] Buffer I/O error on dev nbd1, logical block 0, async page read [ 221.078102][ T5637] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.088128][ T5637] Buffer I/O error on dev nbd1, logical block 1, async page read [ 221.097850][ T5637] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.107526][ T5637] Buffer I/O error on dev nbd1, logical block 2, async page read [ 221.115440][ T5637] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.124663][ T5637] Buffer I/O error on dev nbd1, logical block 3, async page read [ 221.140157][ T5637] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.150549][ T5637] Buffer I/O error on dev nbd1, logical block 0, async page read [ 221.158545][ T5637] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.169297][ T5637] Buffer I/O error on dev nbd1, logical block 1, async page read [ 221.177283][ T5637] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.186664][ T5637] Buffer I/O error on dev nbd1, logical block 2, async page read [ 221.194667][ T5637] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.210581][ T5637] Buffer I/O error on dev nbd1, logical block 3, async page read [ 221.235913][ T5637] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.268683][ T5637] Buffer I/O error on dev nbd1, logical block 0, async page read [ 221.295190][ T5637] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 221.331491][ T5637] Buffer I/O error on dev nbd1, logical block 1, async page read [ 221.359660][T11866] IPv6: NLM_F_CREATE should be specified when creating new route [ 221.405435][ T5637] ldm_validate_partition_table(): Disk read failed. [ 221.459807][ T5637] Dev nbd1: unable to read RDB block 0 [ 221.497256][ T5637] nbd1: unable to read partition table [ 221.552501][ T5637] ldm_validate_partition_table(): Disk read failed. [ 221.595524][ T5637] Dev nbd1: unable to read RDB block 0 [ 221.622991][ T5637] nbd1: unable to read partition table [ 221.731016][T11886] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 221.737585][T11886] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 221.741487][T11889] bond0: mtu less than device minimum [ 221.878576][T11896] netlink: 'syz.4.1561': attribute type 1 has an invalid length. [ 221.923418][T11896] bond6: entered promiscuous mode [ 221.929972][T11896] 8021q: adding VLAN 0 to HW filter on device bond6 [ 221.965333][T11896] bond6: (slave bridge5): making interface the new active one [ 221.973853][T11896] bridge5: entered promiscuous mode [ 221.980101][T11901] netlink: 'syz.0.1563': attribute type 12 has an invalid length. [ 221.988174][T11896] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 222.378182][T11922] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 222.587934][T11928] netlink: 'syz.4.1573': attribute type 1 has an invalid length. [ 222.669886][T11945] netlink: 'syz.0.1577': attribute type 1 has an invalid length. [ 222.976089][T11962] netlink: zone id is out of range [ 222.990254][T11962] netlink: zone id is out of range [ 223.001533][T11962] netlink: zone id is out of range [ 223.013622][T11962] netlink: zone id is out of range [ 223.019321][T11962] netlink: zone id is out of range [ 223.024604][T11962] netlink: zone id is out of range [ 223.033043][T11962] netlink: zone id is out of range [ 223.046296][T11962] netlink: zone id is out of range [ 223.054767][T11962] netlink: zone id is out of range [ 223.470743][T11991] __nla_validate_parse: 23 callbacks suppressed [ 223.470764][T11991] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1590'. [ 223.562968][T11993] ip6erspan1: entered allmulticast mode [ 223.575988][T11996] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1592'. [ 223.861226][T12008] xt_ecn: cannot match TCP bits for non-tcp packets [ 223.871978][T12008] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1598'. [ 224.048117][T12014] tipc: New replicast peer: 255.255.255.255 [ 224.055316][T12014] tipc: Enabled bearer , priority 10 [ 224.108150][T12017] netlink: 'syz.0.1602': attribute type 16 has an invalid length. [ 224.138003][T12017] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1602'. [ 224.160183][T12017] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1602'. [ 224.285879][T12021] bond4 (unregistering): Released all slaves [ 224.534509][T12038] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1608'. [ 224.621118][T12040] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1609'. [ 224.680649][T12043] ieee802154 phy1 wpan1: encryption failed: -90 [ 224.689269][T12043] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1610'. [ 224.834517][T12043] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 224.881746][T12043] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 225.358348][T12071] ip6gre1: entered allmulticast mode [ 225.380076][T12073] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1620'. [ 225.385075][T12075] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1621'. [ 226.222550][T12109] team0: entered promiscuous mode [ 226.227900][T12109] team_slave_0: entered promiscuous mode [ 226.233944][T12109] team_slave_1: entered promiscuous mode [ 226.752437][T12124] 8021q: adding VLAN 0 to HW filter on device bond5 [ 226.829655][T12134] nft_compat: unsupported protocol 0 [ 227.045230][T12149] netlink: 'syz.0.1642': attribute type 11 has an invalid length. [ 227.107125][T12152] syzkaller1: entered promiscuous mode [ 227.144478][T12157] validate_nla: 1 callbacks suppressed [ 227.144499][T12157] netlink: 'syz.1.1644': attribute type 9 has an invalid length. [ 227.146614][T12152] syzkaller1: entered allmulticast mode [ 227.585999][T12178] veth0: entered promiscuous mode [ 227.670021][T12168] veth0: left promiscuous mode [ 227.906435][T12194] workqueue: Failed to create a rescuer kthread for wq "nfc5_nci_tx_wq": -EINTR [ 228.152184][T12214] netlink: 'syz.4.1656': attribute type 1 has an invalid length. [ 228.159916][ T29] audit: type=1800 audit(1778344802.422:11): pid=12213 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1657" name="memory.events" dev="tmpfs" ino=1673 res=0 errno=0 [ 228.506907][T12224] __nla_validate_parse: 6 callbacks suppressed [ 228.506925][T12224] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1662'. [ 228.725377][T12239] netlink: 'syz.3.1667': attribute type 1 has an invalid length. [ 228.762061][T12238] netlink: 'syz.3.1667': attribute type 1 has an invalid length. [ 228.785628][T12239] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1667'. [ 228.807376][T12247] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1667'. [ 228.829835][T12239] net_ratelimit: 13 callbacks suppressed [ 228.829853][T12239] openvswitch: netlink: Flow key attr not present in new flow. [ 228.862883][T12247] openvswitch: netlink: Flow key attr not present in new flow. [ 228.886891][T12236] syzkaller0: entered promiscuous mode [ 228.892652][T12236] syzkaller0: entered allmulticast mode [ 229.801273][T12270] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1673'. [ 230.989566][T12270] team1: entered promiscuous mode [ 231.009878][T12270] team1: entered allmulticast mode [ 231.045092][T12277] netlink: 'syz.4.1676': attribute type 1 has an invalid length. [ 231.212996][T12291] netlink: 'syz.4.1681': attribute type 1 has an invalid length. [ 231.221424][T12291] netlink: 'syz.4.1681': attribute type 3 has an invalid length. [ 231.246139][T12291] netlink: 172 bytes leftover after parsing attributes in process `syz.4.1681'. [ 231.260774][T12291] NCSI netlink: No device for ifindex 813332851 [ 231.269278][T12290] netlink: 'syz.4.1681': attribute type 1 has an invalid length. [ 231.280391][T12290] netlink: 'syz.4.1681': attribute type 3 has an invalid length. [ 231.294044][T12290] netlink: 172 bytes leftover after parsing attributes in process `syz.4.1681'. [ 231.309328][T12290] NCSI netlink: No device for ifindex 813332851 [ 231.582417][T12315] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1688'. [ 231.742614][T12325] xt_limit: Overflow, try lower: 604147548/4200216962 [ 231.781061][T12325] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.883711][T12327] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1693'. [ 231.908589][T12331] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1695'. [ 232.124195][T12349] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1698'. [ 232.238221][T12353] bond5: entered allmulticast mode [ 232.253137][T12353] netlink: 'syz.2.1701': attribute type 19 has an invalid length. [ 232.264405][T12355] netlink: 'syz.3.1700': attribute type 1 has an invalid length. [ 232.289817][T12353] netlink: 'syz.2.1701': attribute type 19 has an invalid length. [ 232.311389][T12353] bridge3: entered promiscuous mode [ 232.317310][T12353] bridge3: entered allmulticast mode [ 232.338849][T12353] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 232.351449][T12353] netlink: 'syz.2.1701': attribute type 12 has an invalid length. [ 232.555541][T12362] netlink: 'syz.2.1702': attribute type 4 has an invalid length. [ 232.755893][T12376] IPVS: set_ctl: invalid protocol: 103 172.30.1.5:20004 [ 232.771722][T12379] netlink: 'syz.2.1707': attribute type 10 has an invalid length. [ 233.255986][T12405] netlink: 'syz.3.1714': attribute type 1 has an invalid length. [ 233.361500][T12405] 8021q: adding VLAN 0 to HW filter on device bond6 [ 233.448689][T12410] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 233.500493][T12405] bond6: entered promiscuous mode [ 233.521078][T12405] bond6: entered allmulticast mode [ 233.568328][T12422] netlink: 'syz.0.1718': attribute type 3 has an invalid length. [ 233.832144][T12437] x_tables: duplicate underflow at hook 1 [ 234.075185][T12453] FAULT_INJECTION: forcing a failure. [ 234.075185][T12453] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 234.120852][T12453] CPU: 0 UID: 0 PID: 12453 Comm: syz.0.1725 Not tainted syzkaller #0 PREEMPT(full) [ 234.120896][T12453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 234.120910][T12453] Call Trace: [ 234.120917][T12453] [ 234.120925][T12453] dump_stack_lvl+0xe8/0x150 [ 234.120953][T12453] should_fail_ex+0x412/0x560 [ 234.120982][T12453] _copy_to_user+0x31/0xb0 [ 234.121010][T12453] simple_read_from_buffer+0xe1/0x170 [ 234.121036][T12453] proc_fail_nth_read+0x1bb/0x230 [ 234.121061][T12453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 234.121087][T12453] ? rw_verify_area+0x2a6/0x4d0 [ 234.121110][T12453] ? tun_chr_write_iter+0xe0/0x200 [ 234.121129][T12453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 234.121152][T12453] vfs_read+0x20c/0xa70 [ 234.121182][T12453] ? __pfx_vfs_read+0x10/0x10 [ 234.121206][T12453] ? do_sys_openat2+0x14c/0x200 [ 234.121223][T12453] ? kmem_cache_free+0x182/0x650 [ 234.121245][T12453] ? fd_install+0x94/0x3d0 [ 234.121276][T12453] ksys_read+0x150/0x270 [ 234.121300][T12453] ? __pfx_ksys_read+0x10/0x10 [ 234.121331][T12453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.121350][T12453] do_syscall_64+0x15f/0xf80 [ 234.121373][T12453] ? trace_irq_disable+0x3b/0x140 [ 234.121398][T12453] ? clear_bhb_loop+0x40/0x90 [ 234.121420][T12453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.121436][T12453] RIP: 0033:0x7fc05215d60e [ 234.121453][T12453] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 234.121467][T12453] RSP: 002b:00007fc0530b1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 234.121497][T12453] RAX: ffffffffffffffda RBX: 00007fc0530b26c0 RCX: 00007fc05215d60e [ 234.121509][T12453] RDX: 000000000000000f RSI: 00007fc0530b20a0 RDI: 0000000000000004 [ 234.121520][T12453] RBP: 00007fc0530b2090 R08: 0000000000000000 R09: 0000000000000000 [ 234.121531][T12453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 234.121541][T12453] R13: 00007fc052416038 R14: 00007fc052415fa0 R15: 00007ffec087a888 [ 234.121568][T12453] [ 234.498018][T12462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 234.740721][T12470] __nla_validate_parse: 4 callbacks suppressed [ 234.740740][T12470] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1728'. [ 234.848597][T12475] IPVS: ovf: SCTP 172.20.20.187:0 - no destination available [ 235.047680][T12485] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1732'. [ 235.118611][T12485] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 235.125136][T12485] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 235.189202][T12485] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1732'. [ 235.571347][T12496] netem: change failed [ 235.590106][T12512] netem: change failed [ 235.973899][ T57] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 236.281771][T12560] Cannot find del_set index 4 as target [ 236.313768][T12563] sctp: [Deprecated]: syz.0.1743 (pid 12563) Use of int in maxseg socket option. [ 236.313768][T12563] Use struct sctp_assoc_value instead [ 236.402713][T12566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1748'. [ 236.429407][T12544] veth1_macvtap: left promiscuous mode [ 236.445901][T12566] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1748'. [ 236.446940][T12574] netlink: 'syz.3.1748': attribute type 1 has an invalid length. [ 236.466367][T12544] macsec0: entered promiscuous mode [ 236.475684][T12544] macsec0: entered allmulticast mode [ 236.488777][T12548] veth1_macvtap: entered promiscuous mode [ 236.494642][T12548] veth1_macvtap: entered allmulticast mode [ 236.503886][T12548] macsec0: left promiscuous mode [ 236.513274][T12548] macsec0: left allmulticast mode [ 236.518321][T12566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1748'. [ 236.530977][T12548] veth1_macvtap: left allmulticast mode [ 236.643139][T12559] ieee802154 phy1 wpan1: encryption failed: -22 [ 236.654632][T12583] netlink: 'syz.4.1752': attribute type 33 has an invalid length. [ 236.699885][T12583] bond7: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 236.712127][T12583] bond7 (unregistering): Released all slaves [ 236.761277][T12588] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 236.823337][T12586] bond1: (slave lo): Releasing backup interface [ 236.841142][T12586] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 236.867708][T12586] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 236.879463][T12586] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 237.321378][T12618] validate_nla: 2 callbacks suppressed [ 237.321396][T12618] netlink: 'syz.1.1763': attribute type 4 has an invalid length. [ 237.595478][T12637] netlink: 71 bytes leftover after parsing attributes in process `syz.4.1769'. [ 237.655556][T12641] netlink: 'syz.0.1770': attribute type 10 has an invalid length. [ 237.692725][T12641] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 237.709582][T12641] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 237.733903][T12641] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.747975][T12641] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 237.907522][T12653] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1773'. [ 238.197184][T12662] vlan4: entered allmulticast mode [ 238.228193][T12666] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1779'. [ 238.345966][T12673] netlink: 'syz.4.1781': attribute type 4 has an invalid length. [ 238.488610][T12680] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.524346][T12680] batadv_slave_0: entered promiscuous mode [ 238.589115][T12687] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.1787'. [ 238.892140][T12708] netlink: 'syz.1.1794': attribute type 1 has an invalid length. [ 239.069651][T12708] 8021q: adding VLAN 0 to HW filter on device bond7 [ 239.095945][T12711] vlan5: entered allmulticast mode [ 239.106300][T12711] bond7: entered allmulticast mode [ 239.129464][T12716] bond7: (slave geneve4): making interface the new active one [ 239.137728][T12716] geneve4: entered allmulticast mode [ 239.151311][T12716] bond7: (slave geneve4): Enslaving as an active interface with an up link [ 239.312596][T12732] 0·: renamed from hsr0 (while UP) [ 239.855299][T12732] 0·: entered allmulticast mode [ 239.866510][T12732] hsr_slave_0: entered allmulticast mode [ 239.872540][T12732] hsr_slave_1: entered allmulticast mode [ 239.882890][T12732] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 239.959372][T12732] __nla_validate_parse: 5 callbacks suppressed [ 239.959389][T12732] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1799'. [ 239.991196][T12744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 240.007231][T12744] team0: Failed to send port change of device batadv0 via netlink (err -105) [ 240.021052][T12744] team0: Failed to send options change via netlink (err -105) [ 240.031707][T12744] team0: Port device batadv0 added [ 240.078068][T12732] 1·: renamed from c0· (while UP) [ 240.082126][ T10] 1· speed is unknown, defaulting to 1000 [ 240.137797][T12732] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 240.231482][T12756] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1803'. [ 240.431347][T12756] bond6: Invalid ad_actor_system MAC address. [ 240.464567][T12774] netlink: 'syz.4.1808': attribute type 23 has an invalid length. [ 240.485157][T12756] bond6: option ad_actor_system: invalid value (1) [ 240.505730][T12756] bond6 (unregistering): Released all slaves [ 240.570509][T12777] netlink: 'syz.0.1809': attribute type 29 has an invalid length. [ 240.585696][T12781] netlink: 'syz.0.1809': attribute type 29 has an invalid length. [ 240.768793][T12791] netlink: 'syz.2.1813': attribute type 4 has an invalid length. [ 240.793599][T12791] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1813'. [ 240.917502][T12802] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1816'. [ 241.188973][T12808] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1819'. [ 241.220950][T12808] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1819'. [ 241.234453][T12808] netlink: 'syz.0.1819': attribute type 3 has an invalid length. [ 241.298090][T12815] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.1823'. [ 241.429908][T12817] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 241.438580][T12828] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1827'. [ 241.464068][T12828] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1827'. [ 241.610165][T12838] netlink: 'syz.1.1829': attribute type 10 has an invalid length. [ 241.681302][T12837] gre2: entered promiscuous mode [ 242.172485][T12869] veth0: entered promiscuous mode [ 242.220217][T12869] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1842'. [ 242.259315][T12869] veth0 (unregistering): left promiscuous mode [ 243.086925][T12932] netlink: 'syz.4.1859': attribute type 9 has an invalid length. [ 243.092245][T12930] netlink: 'syz.1.1860': attribute type 3 has an invalid length. [ 243.102368][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.119707][T12924] sch_fq: defrate 0 ignored. [ 243.183518][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.202326][T12924] sch_fq: defrate 0 ignored. [ 243.215931][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.225620][T12924] sch_fq: defrate 0 ignored. [ 243.281876][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.308984][T12924] sch_fq: defrate 0 ignored. [ 243.315266][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.328911][T12924] sch_fq: defrate 0 ignored. [ 243.336124][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.348138][T12924] sch_fq: defrate 0 ignored. [ 243.352816][T12953] xt_hashlimit: size too large, truncated to 1048576 [ 243.369131][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.378514][T12924] sch_fq: defrate 0 ignored. [ 243.429876][T12960] –: renamed from vxcan1 [ 243.461994][T12924] netlink: 'syz.3.1857': attribute type 8 has an invalid length. [ 243.489530][T12924] sch_fq: defrate 0 ignored. [ 243.508281][T12924] sch_fq: defrate 0 ignored. [ 243.971274][T12924] sch_fq: defrate 0 ignored. [ 244.698897][T13009] 8021q: VLANs not supported on ip6gre0 [ 245.130379][T13025] __nla_validate_parse: 136 callbacks suppressed [ 245.130400][T13025] netlink: 112 bytes leftover after parsing attributes in process `syz.0.1881'. [ 245.515495][T13034] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1883'. [ 245.546588][T13034] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1883'. [ 246.101387][T13057] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1889'. [ 246.115367][T13055] IPVS: ovf: SCTP 172.20.20.187:0 - no destination available [ 246.264024][T13061] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1891'. [ 246.282878][T13059] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1890'. [ 246.303327][T13061] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1891'. [ 246.572690][T13075] vlan1: entered promiscuous mode [ 246.580210][T13075] bridge0: entered promiscuous mode [ 246.615911][T13077] bond8: option resend_igmp: invalid value (32767) [ 246.649898][T13077] bond8: option resend_igmp: allowed values 0 - 255 [ 246.679636][T13077] bond8 (unregistering): Released all slaves [ 246.906064][T13092] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1899'. [ 247.011141][T13097] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1900'. [ 247.035319][T13097] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1900'. [ 247.184676][T13110] xt_hashlimit: invalid rate [ 247.190731][T13111] xt_hashlimit: invalid rate [ 247.203249][T13116] tipc: Invalid UDP bearer configuration [ 247.204250][T13116] tipc: Enabling of bearer rejected, failed to enable media [ 247.353373][T13118] bond7 (unregistering): Released all slaves [ 247.454757][T13121] bond9: Unable to set down delay as MII monitoring is disabled [ 247.473471][T13121] bond9 (unregistering): Released all slaves [ 248.417079][T13144] 1· speed is unknown, defaulting to 1000 [ 248.659953][T13193] validate_nla: 39 callbacks suppressed [ 248.659970][T13193] netlink: 'syz.1.1925': attribute type 1 has an invalid length. [ 248.722780][T13193] bond9: entered promiscuous mode [ 248.733911][T13193] 8021q: adding VLAN 0 to HW filter on device bond9 [ 249.275526][T13207] netlink: 'syz.1.1930': attribute type 2 has an invalid length. [ 250.404327][T13261] syzkaller1: entered promiscuous mode [ 250.410567][T13261] syzkaller1: entered allmulticast mode [ 250.479143][T13263] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 250.593243][T13270] __nla_validate_parse: 41 callbacks suppressed [ 250.593262][T13270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1951'. [ 250.628004][T13279] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1949'. [ 250.645342][T13272] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1951'. [ 250.958300][T13295] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1956'. [ 251.063958][T13293] only policy match revision 0 supported [ 251.063980][T13293] unable to load match [ 251.646043][T13330] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1965'. [ 251.994465][T13345] syzkaller0: entered promiscuous mode [ 252.002390][T13345] syzkaller0: entered allmulticast mode [ 252.024344][T13353] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.1973'. [ 252.150552][T13364] sctp: [Deprecated]: syz.1.1975 (pid 13364) Use of int in max_burst socket option. [ 252.150552][T13364] Use struct sctp_assoc_value instead [ 252.408500][T13383] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1980'. [ 252.442635][T13384] netlink: 'syz.0.1981': attribute type 11 has an invalid length. [ 252.605611][T13397] openvswitch: netlink: VXLAN extension 1 has unexpected len 8 expected 4 [ 252.891246][T13411] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1986'. [ 252.901294][T13411] openvswitch: netlink: Flow actions attr not present in new flow. [ 253.684659][ T4946] Bluetooth: hci4: link tx timeout [ 253.697229][ T4946] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 253.717519][ T4946] Bluetooth: hci4: link tx timeout [ 253.720739][T13464] veth1_macvtap: entered allmulticast mode [ 253.723943][ T4946] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.740917][ T4946] Bluetooth: hci4: link tx timeout [ 253.746093][ T4946] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 253.752737][T13464] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1997'. [ 253.754105][ T4946] Bluetooth: hci4: link tx timeout [ 253.770729][ T4946] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.787602][T13436] nbd2: detected capacity change from 0 to 63 [ 253.821589][ T50] block nbd2: Receive control failed (result -32) [ 253.821601][ T5627] block nbd2: Receive control failed (result -32) [ 253.852438][ T5637] block nbd2: Dead connection, failed to find a fallback [ 253.889798][ T5637] block nbd2: shutting down sockets [ 253.906361][ T5637] blk_print_req_error: 138 callbacks suppressed [ 253.906381][ T5637] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 253.953051][ T5637] buffer_io_error: 138 callbacks suppressed [ 253.953067][ T5637] Buffer I/O error on dev nbd2, logical block 0, async page read [ 253.958692][T13463] veth1_macvtap: left allmulticast mode [ 253.973197][ T5637] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.030243][ T5637] Buffer I/O error on dev nbd2, logical block 1, async page read [ 254.053303][ T5637] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.073062][ T5637] Buffer I/O error on dev nbd2, logical block 2, async page read [ 254.082017][ T5637] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.095744][ T5637] Buffer I/O error on dev nbd2, logical block 3, async page read [ 254.135729][ T5637] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.189096][ T5637] Buffer I/O error on dev nbd2, logical block 0, async page read [ 254.189221][T13483] netlink: 'syz.3.2000': attribute type 1 has an invalid length. [ 254.206739][ T5637] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.224212][T13483] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 254.242069][ T5637] Buffer I/O error on dev nbd2, logical block 1, async page read [ 254.279697][ T5637] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.309827][ T5637] Buffer I/O error on dev nbd2, logical block 2, async page read [ 254.327880][ T5637] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.351703][ T5637] Buffer I/O error on dev nbd2, logical block 3, async page read [ 254.386050][ T5637] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.412595][ T5637] Buffer I/O error on dev nbd2, logical block 0, async page read [ 254.443573][ T5637] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 254.481481][ T5637] Buffer I/O error on dev nbd2, logical block 1, async page read [ 254.508222][T13494] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2004'. [ 254.517882][ T5637] ldm_validate_partition_table(): Disk read failed. [ 254.541649][ T5637] Dev nbd2: unable to read RDB block 0 [ 254.572628][ T5637] nbd2: unable to read partition table [ 254.625549][ T5637] ldm_validate_partition_table(): Disk read failed. [ 254.649139][ T5637] Dev nbd2: unable to read RDB block 0 [ 254.668813][ T5637] nbd2: unable to read partition table [ 254.805086][T13483] 1· speed is unknown, defaulting to 1000 [ 255.058821][T13521] 8021q: adding VLAN 0 to HW filter on device bond7 [ 255.182053][T13529] macvlan0: entered promiscuous mode [ 255.208654][T13529] macvlan0: entered allmulticast mode [ 255.227196][T13529] bond7: entered promiscuous mode [ 255.243177][T13529] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 255.261001][T13529] bond7: left promiscuous mode [ 255.505740][T13537] : entered promiscuous mode [ 255.534532][T13545] veth0: entered promiscuous mode [ 255.619472][T13544] netlink: 'syz.2.2018': attribute type 9 has an invalid length. [ 255.710902][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.744489][T13555] __nla_validate_parse: 4 callbacks suppressed [ 255.744509][T13555] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2019'. [ 255.798137][ T50] Bluetooth: hci4: command 0x0405 tx timeout [ 256.092467][T13575] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2024'. [ 256.148575][T13575] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2024'. [ 256.165714][T13575] gre0: entered promiscuous mode [ 256.262617][T13539] veth0: left promiscuous mode [ 256.363677][T13588] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2027'. [ 256.392694][T13588] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2027'. [ 256.675158][T13619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2034'. [ 256.732066][T13622] netem: change failed [ 256.950964][T13634] xt_CT: You must specify a L4 protocol and not use inversions on it [ 256.973820][T13634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2040'. [ 256.984575][T13634] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2040'. [ 256.996112][T13634] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2040'. [ 257.173799][T13623] netem: change failed [ 257.659559][T13657] tipc: Enabled bearer , priority 0 [ 257.723277][T13651] tipc: Disabling bearer [ 257.809933][T13670] tipc: Enabling of bearer rejected, failed to enable media [ 257.868015][ T50] Bluetooth: hci4: command 0x0405 tx timeout [ 257.931536][T13676] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2054'. [ 258.364938][T13699] netlink: 'syz.3.2057': attribute type 1 has an invalid length. [ 258.371074][T13700] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 258.406333][T13699] 8021q: adding VLAN 0 to HW filter on device bond8 [ 258.425906][T13699] vlan1: entered allmulticast mode [ 258.432705][T13699] bond8: entered allmulticast mode [ 258.463206][T13699] bond8: (slave geneve3): making interface the new active one [ 258.473003][T13699] geneve3: entered allmulticast mode [ 258.480998][T13699] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 258.665977][T13712] IPVS: set_ctl: invalid protocol: 255 127.0.0.1:20001 [ 258.693582][T13714] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 258.704897][T13715] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 258.806513][T13721] macsec1: entered promiscuous mode [ 258.819109][T13721] batadv0: entered promiscuous mode [ 258.846446][T13721] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 258.869989][T13721] batadv0: left promiscuous mode [ 259.211010][T13743] macvlan1: entered promiscuous mode [ 259.238010][T13743] macvlan1: entered allmulticast mode [ 259.251008][T13743] veth1_vlan: entered allmulticast mode [ 259.296116][T13755] netlink: 'syz.4.2073': attribute type 1 has an invalid length. [ 259.438607][T13768] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 259.482965][T13774] netlink: 'syz.2.2078': attribute type 1 has an invalid length. [ 259.722509][T13781] bond8: (slave vxcan7): The slave device specified does not support setting the MAC address [ 259.750970][T13781] bond8: (slave vxcan7): Error -95 calling set_mac_address [ 259.855389][T13783] bond8: (slave bridge4): Enslaving as an active interface with a down link [ 259.869875][T13802] netlink: 'syz.0.2084': attribute type 1 has an invalid length. [ 259.895993][T13774] macvlan1: entered promiscuous mode [ 259.901565][T13774] macvlan1: entered allmulticast mode [ 259.909712][T13774] bond8: entered promiscuous mode [ 259.918465][T13774] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 259.929691][T13774] bond8: left promiscuous mode [ 260.086124][T13813] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.469254][T13845] syzkaller1: entered promiscuous mode [ 260.487979][T13845] syzkaller1: entered allmulticast mode [ 260.501470][T13850] netlink: 'syz.0.2096': attribute type 32 has an invalid length. [ 260.561385][T13845] openvswitch: netlink: Unknown key attributes 2 [ 260.576106][T13850] bond8: option coupled_control: invalid value (119) [ 260.613682][T13850] bond8 (unregistering): Released all slaves [ 260.707037][T13856] netlink: 'syz.1.2097': attribute type 1 has an invalid length. [ 260.827362][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 260.992093][T13872] __nla_validate_parse: 13 callbacks suppressed [ 260.992115][T13872] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2100'. [ 261.064953][T13877] xt_TPROXY: Can be used only with -p tcp or -p udp [ 261.441801][T13895] netlink: 'syz.0.2108': attribute type 1 has an invalid length. [ 261.479342][T13895] netlink: 760 bytes leftover after parsing attributes in process `syz.0.2108'. [ 261.509111][T13895] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2108'. [ 261.783644][T13908] syzkaller0: entered promiscuous mode [ 261.806091][T13908] syzkaller0: entered allmulticast mode [ 262.099858][T13917] openvswitch: netlink: IP tunnel dst address not specified [ 262.188597][T13917] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2115'. [ 262.250099][T13934] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2117'. [ 262.265270][T13932] netlink: 'syz.1.2116': attribute type 1 has an invalid length. [ 262.282344][T13934] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2117'. [ 262.368888][T13932] 8021q: adding VLAN 0 to HW filter on device bond10 [ 263.217320][T13993] netlink: 'syz.0.2130': attribute type 1 has an invalid length. [ 263.265429][T13998] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2131'. [ 263.611536][T14017] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 264.053956][T14042] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2145'. [ 264.079274][T14043] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 264.106621][T14051] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2145'. [ 264.118930][T14043] 8021q: adding VLAN 0 to HW filter on device bond1 [ 264.153084][T14043] 8021q: adding VLAN 0 to HW filter on device bond4 [ 264.164133][T14043] 8021q: adding VLAN 0 to HW filter on device bond6 [ 264.193884][T14043] 8021q: adding VLAN 0 to HW filter on device bond7 [ 264.202895][T14053] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2146'. [ 264.245683][T14051] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.255519][T14051] bridge0: port 2(bridge_slave_1) entered listening state [ 264.263035][T14051] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.270323][T14051] bridge0: port 1(bridge_slave_0) entered listening state [ 264.291190][T14051] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.298524][T14051] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.369645][ T12] bond6: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 264.406661][ T12] bond6: (slave veth0_to_bond): making interface the new active one [ 264.429831][ T12] veth0_to_bond: entered promiscuous mode [ 264.444825][ T12] veth0_to_bond: entered allmulticast mode [ 264.463907][ T12] bond6: active interface up! [ 264.641786][T14079] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 264.659746][T14079] Cannot find add_set index 4 as target [ 264.929309][T14093] nbd3: detected capacity change from 0 to 127 [ 264.951114][T14101] netlink: 'syz.1.2159': attribute type 1 has an invalid length. [ 264.978154][ T5632] block nbd3: Receive control failed (result -104) [ 265.049672][T14107] xt_connbytes: Forcing CT accounting to be enabled [ 265.057554][T14107] Cannot find add_set index 4 as target [ 265.127789][T14118] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 265.318779][T14126] netlink: get zone limit has 4 unknown bytes [ 265.588389][T14142] bond9: option miimon: invalid value (18446744073709551585) [ 265.597798][T14142] bond9: option miimon: allowed values 0 - 2147483647 [ 265.611362][T14142] bond9 (unregistering): Released all slaves [ 266.004041][ T147] tipc: Subscription rejected, illegal request [ 266.141853][T14160] __nla_validate_parse: 4 callbacks suppressed [ 266.141870][T14160] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2178'. [ 266.533743][T14165] syzkaller0: entered promiscuous mode [ 266.570869][T14165] syzkaller0: entered allmulticast mode [ 266.639872][T14176] xt_TPROXY: Can be used only with -p tcp or -p udp [ 266.813486][T14186] syzkaller0: entered promiscuous mode [ 266.834323][T14186] syzkaller0: entered allmulticast mode [ 266.862929][T14187] netlink: 'syz.0.2182': attribute type 10 has an invalid length. [ 267.008589][T14198] netlink: 'syz.2.2186': attribute type 1 has an invalid length. [ 267.102376][T14203] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2187'. [ 267.125463][T14187] team_slave_0: left promiscuous mode [ 267.141066][T14187] team0 (unregistering): Port device team_slave_0 removed [ 267.151555][T14187] team_slave_1: left promiscuous mode [ 267.172428][T14187] team0 (unregistering): Port device team_slave_1 removed [ 267.184541][T14187] team0 (unregistering): Port device bridge1 removed [ 267.378782][T14214] netlink: 45349 bytes leftover after parsing attributes in process `syz.0.2189'. [ 267.426612][T14214] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 267.484535][T14216] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2192'. [ 267.491090][T14214] 0ªX¹¦Dö»: entered allmulticast mode [ 267.504973][T14221] netlink: 332 bytes leftover after parsing attributes in process `syz.2.2193'. [ 267.602301][T14218] bond9 (unregistering): Released all slaves [ 267.762352][T14209] 1· speed is unknown, defaulting to 1000 [ 267.849749][T14231] IPVS: set_ctl: invalid protocol: 29 172.20.20.62:20004 [ 268.531789][T14262] sctp: [Deprecated]: syz.2.2210 (pid 14262) Use of int in maxseg socket option. [ 268.531789][T14262] Use struct sctp_assoc_value instead [ 268.554083][T14263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2210'. [ 269.106637][T14301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2220'. [ 269.207334][T14309] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2222'. [ 269.231432][T14309] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2222'. [ 269.232269][T14310] x_tables: duplicate underflow at hook 2 [ 269.470146][T14322] IPVS: set_ctl: invalid protocol: 137 172.20.20.170:20004 [ 269.528344][T14327] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2228'. [ 269.531415][T14330] IPVS: set_ctl: invalid protocol: 103 224.0.0.2:20004 [ 269.763380][T14337] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 270.131277][T14354] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 270.170030][T14353] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 270.233281][T14365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 270.359722][T14371] : entered promiscuous mode [ 270.463232][T14379] netlink: 'syz.2.2242': attribute type 1 has an invalid length. [ 270.496834][T14366] nbd4: detected capacity change from 0 to 63 [ 270.511373][ T5632] block nbd4: Receive control failed (result -32) [ 270.513921][ T5640] block nbd4: Send control failed (result -32) [ 270.518313][ T50] block nbd4: Receive control failed (result -32) [ 270.584416][ T5640] block nbd4: Request send failed, requeueing [ 270.614440][ T11] block nbd4: Dead connection, failed to find a fallback [ 270.622961][ T11] block nbd4: shutting down sockets [ 270.628529][ T11] blk_print_req_error: 138 callbacks suppressed [ 270.628545][ T11] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.647382][ T11] buffer_io_error: 138 callbacks suppressed [ 270.647404][ T11] Buffer I/O error on dev nbd4, logical block 0, async page read [ 270.665683][ T5640] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.687489][ T5640] Buffer I/O error on dev nbd4, logical block 1, async page read [ 270.704213][ T5640] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.726370][ T5640] Buffer I/O error on dev nbd4, logical block 2, async page read [ 270.739522][ T5640] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.759820][ T5640] Buffer I/O error on dev nbd4, logical block 3, async page read [ 270.776525][ T5640] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.785690][ T5640] Buffer I/O error on dev nbd4, logical block 0, async page read [ 270.806012][ T5640] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.817508][ T5640] Buffer I/O error on dev nbd4, logical block 1, async page read [ 270.825454][ T5640] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.856783][ T5640] Buffer I/O error on dev nbd4, logical block 2, async page read [ 270.872653][ T5640] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.895444][ T5640] Buffer I/O error on dev nbd4, logical block 3, async page read [ 270.925347][ T5640] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 270.942180][ T5640] Buffer I/O error on dev nbd4, logical block 0, async page read [ 270.965997][ T5640] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 271.000997][ T5640] Buffer I/O error on dev nbd4, logical block 1, async page read [ 271.033656][ T5640] ldm_validate_partition_table(): Disk read failed. [ 271.051523][ T5640] Dev nbd4: unable to read RDB block 0 [ 271.072722][ T5640] nbd4: unable to read partition table [ 271.099677][T14405] : entered promiscuous mode [ 271.126007][ T5640] ldm_validate_partition_table(): Disk read failed. [ 271.154709][ T5640] Dev nbd4: unable to read RDB block 0 [ 271.169201][ T5640] nbd4: unable to read partition table [ 271.209496][T14414] tipc: Enabling of bearer rejected, failed to enable media [ 271.345806][T14426] __nla_validate_parse: 8 callbacks suppressed [ 271.345824][T14426] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2256'. [ 271.367672][T14426] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2256'. [ 271.418347][T14428] netlink: 'syz.4.2256': attribute type 30 has an invalid length. [ 271.474561][T14428] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 271.545874][T14436] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2258'. [ 271.565790][T14436] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2258'. [ 271.580683][T14432] netlink: 'syz.3.2258': attribute type 4 has an invalid length. [ 295.390884][ T11] block nbd3: Possible stuck request ffff8880273ce000: control (read@0,1024B). Runtime 30 seconds [ 295.404645][ T11] block nbd3: Possible stuck request ffff8880273ce1c0: control (read@1024,1024B). Runtime 30 seconds [ 295.415675][ T11] block nbd3: Possible stuck request ffff8880273ce380: control (read@2048,1024B). Runtime 30 seconds [ 295.427073][ T11] block nbd3: Possible stuck request ffff8880273ce540: control (read@3072,1024B). Runtime 30 seconds [ 296.118411][T14438] netem: change failed [ 296.292619][T14455] netlink: 'syz.3.2265': attribute type 10 has an invalid length. [ 296.322608][T14457] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.2260'. [ 296.373954][T14457] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 296.405411][T14468] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2267'. [ 296.483758][T14453] netlink: 'syz.2.2261': attribute type 16 has an invalid length. [ 296.521258][T14453] netlink: 'syz.2.2261': attribute type 17 has an invalid length. [ 296.599773][T14453] ip6_vti0: left promiscuous mode [ 296.615554][T14453] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.622821][T14453] bridge0: port 2(bridge_slave_1) entered listening state [ 296.630281][T14453] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.637624][T14453] bridge0: port 1(bridge_slave_0) entered listening state [ 296.693103][T14453] batadv_slave_0: left promiscuous mode [ 296.700440][T14453] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 296.715517][T14453] veth1_macvtap: entered promiscuous mode [ 296.729504][T14453] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 296.742546][T14453] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 296.755082][T14453] ip6tnl1: left allmulticast mode [ 296.771840][T14453] bond2: left promiscuous mode [ 296.777903][T14453] vcan1: left promiscuous mode [ 296.785321][T14453] vcan2: left promiscuous mode [ 296.801883][T14453] 8021q: adding VLAN 0 to HW filter on device bond3 [ 296.814429][T14453] h: left promiscuous mode [ 296.821156][T14453] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.831971][T14453] 8021q: adding VLAN 0 to HW filter on device bond4 [ 296.842129][T14453] ip6erspan1: left allmulticast mode [ 296.850117][T14453] ip6gre1: left allmulticast mode [ 296.859182][T14453] team1: left promiscuous mode [ 296.864012][T14453] team1: left allmulticast mode [ 296.869456][T14453] 8021q: adding VLAN 0 to HW filter on device team1 [ 296.878168][T14453] bond5: left allmulticast mode [ 296.883980][T14453] 8021q: adding VLAN 0 to HW filter on device bond5 [ 296.892693][T14453] bridge3: left promiscuous mode [ 296.897776][T14453] bridge3: left allmulticast mode [ 296.909635][T14453] 8021q: adding VLAN 0 to HW filter on device bond6 [ 296.918510][T14453] bond0: entered promiscuous mode [ 296.924113][T14453] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 296.933268][T14453] 8021q: adding VLAN 0 to HW filter on device bond8 [ 297.020956][ T5728] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 297.486586][ T5728] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 297.867792][ T1125] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 298.907552][T13689] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 298.917962][T13689] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 299.151463][T14445] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 299.360875][T14493] bond9: option resend_igmp: invalid value (32767) [ 299.378974][T14505] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2275'. [ 299.386413][T14493] bond9: option resend_igmp: allowed values 0 - 255 [ 299.399018][T14493] bond9 (unregistering): Released all slaves [ 299.411477][T14506] xt_TPROXY: Can be used only with -p tcp or -p udp [ 299.508573][T14510] bond9: entered promiscuous mode [ 299.517441][T14510] bond9: entered allmulticast mode [ 299.524671][T14510] 8021q: adding VLAN 0 to HW filter on device bond9 [ 299.705787][T14527] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2286'. [ 299.715603][ T809] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 299.730742][T14528] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2286'. [ 299.848654][T14524] netlink: 'syz.4.2284': attribute type 1 has an invalid length. [ 299.859746][T14524] netlink: 'syz.4.2284': attribute type 2 has an invalid length. [ 299.909408][T14533] netlink: 'syz.2.2287': attribute type 1 has an invalid length. [ 299.929588][T14536] netlink: 'syz.2.2287': attribute type 10 has an invalid length. [ 299.973519][T14540] netlink: 'syz.4.2289': attribute type 1 has an invalid length. [ 299.982448][T14539] netlink: 'syz.4.2289': attribute type 1 has an invalid length. [ 300.057771][T14540] 8021q: adding VLAN 0 to HW filter on device bond7 [ 300.079428][T14550] netlink: 'syz.2.2291': attribute type 1 has an invalid length. [ 300.087474][T14550] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2291'. [ 300.105735][T14551] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.2290'. [ 300.131914][T14551] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 300.351580][T14566] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2298'. [ 300.557390][T14585] xt_ecn: cannot match TCP bits for non-tcp packets [ 302.746387][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 303.000828][T14542] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 310.746372][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 317.148686][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 325.021883][T14594] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2304'. [ 325.074557][T14602] validate_nla: 2 callbacks suppressed [ 325.074574][T14602] netlink: 'syz.3.2306': attribute type 64 has an invalid length. [ 325.080236][T14603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2303'. [ 325.484153][ T11] block nbd3: Possible stuck request ffff8880273ce000: control (read@0,1024B). Runtime 60 seconds [ 325.499085][ T11] block nbd3: Possible stuck request ffff8880273ce1c0: control (read@1024,1024B). Runtime 60 seconds [ 325.511482][ T11] block nbd3: Possible stuck request ffff8880273ce380: control (read@2048,1024B). Runtime 60 seconds [ 325.524662][ T11] block nbd3: Possible stuck request ffff8880273ce540: control (read@3072,1024B). Runtime 60 seconds [ 325.658541][T14640] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.2306'. [ 325.729478][T14642] netlink: 'syz.1.2309': attribute type 21 has an invalid length. [ 325.801100][T14642] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2309'. [ 326.002577][T14662] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.2313'. [ 326.066773][T14662] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 326.106352][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 326.748600][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 326.757682][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 328.893620][T14656] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 328.908585][T14696] netlink: 'syz.3.2322': attribute type 2 has an invalid length. [ 328.928561][T14696] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2322'. [ 328.938672][T14699] netlink: 'syz.3.2322': attribute type 2 has an invalid length. [ 328.948424][T14699] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2322'. [ 329.180112][T14721] netlink: 9 bytes leftover after parsing attributes in process `syz.2.2331'. [ 329.211571][T14726] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.228906][T14721] 0·: renamed from hsr0 (while UP) [ 329.244654][T14721] 0·: entered allmulticast mode [ 329.254447][T14721] hsr_slave_0: entered allmulticast mode [ 329.265035][T14721] hsr_slave_1: entered allmulticast mode [ 329.279365][T14721] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 329.429031][T14735] openvswitch: netlink: IPv4 tun info is not correct [ 329.498646][T14747] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 329.512357][T14747] syzkaller0: entered promiscuous mode [ 329.519970][T14747] syzkaller0: entered allmulticast mode [ 329.534373][T14751] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.2338'. [ 329.545480][T14751] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 330.088930][T14732] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 330.176978][T14764] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.2344'. [ 330.189119][T14764] netlink: 'syz.4.2344': attribute type 9 has an invalid length. [ 330.241239][T14769] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 330.253192][T14769] syzkaller0: entered promiscuous mode [ 330.261751][T14769] syzkaller0: entered allmulticast mode [ 330.448271][T14773] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2347'. [ 330.512577][T14779] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2347'. [ 332.402357][T14741] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 332.545073][T14786] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2349'. [ 332.655024][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.691794][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 332.725048][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.751577][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 332.790180][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.814558][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 332.854000][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.883982][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 332.924667][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.944464][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 332.963725][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 332.982834][T14797] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.2353'. [ 333.004793][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 333.033342][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 333.061215][T14797] netlink: 'syz.0.2353': attribute type 12 has an invalid length. [ 333.426855][T14844] vcan0: entered allmulticast mode [ 333.448791][T14834] syzkaller0: entered promiscuous mode [ 333.469121][T14834] syzkaller0: entered allmulticast mode [ 333.480796][T14846] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 336.349604][T14836] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 336.493959][T14881] validate_nla: 57 callbacks suppressed [ 336.493978][T14881] netlink: 'syz.3.2378': attribute type 1 has an invalid length. [ 336.523516][T14881] netlink: 'syz.3.2378': attribute type 2 has an invalid length. [ 336.594341][T14886] bond9: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 336.610258][T14886] bond9 (unregistering): Released all slaves [ 336.661031][T14883] netlink: 'syz.1.2375': attribute type 1 has an invalid length. [ 336.683727][T14884] netlink: 'syz.1.2375': attribute type 1 has an invalid length. [ 336.815393][T14911] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 336.825692][T14899] bond12: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 336.834048][T14911] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 336.836921][T14899] bond12: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 336.860298][T14899] bond12: (slave ip6gre2): making interface the new active one [ 336.869459][T14899] bond12: (slave ip6gre2): Enslaving as an active interface with an up link [ 336.929778][T14905] __nla_validate_parse: 69 callbacks suppressed [ 336.929796][T14905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2381'. [ 337.001772][T14906] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2381'. [ 337.075381][T14926] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2384'. [ 337.305181][T14939] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2389'. [ 337.404302][T14949] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.2388'. [ 337.414420][T14949] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 338.062945][T14961] syzkaller0: entered promiscuous mode [ 338.068723][T14961] syzkaller0: entered allmulticast mode [ 338.190643][T14963] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2396'. [ 338.207829][T14963] vcan0 (unregistering): left allmulticast mode [ 338.301684][T14972] netlink: 'syz.1.2398': attribute type 1 has an invalid length. [ 338.541849][T14985] netlink: 294 bytes leftover after parsing attributes in process `syz.1.2403'. [ 338.552177][T14985] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 340.289963][T14940] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 340.487749][T14996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2405'. [ 340.711469][T15019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2412'. [ 340.893972][T15026] syzkaller0: entered promiscuous mode [ 340.906732][T15026] syzkaller0: entered allmulticast mode [ 340.942685][T13691] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x6 [ 341.062388][T15038] veth0: entered promiscuous mode [ 341.071072][T15038] veth0: left promiscuous mode [ 341.116793][T15038] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2418'. [ 341.231254][T15047] netlink: 'syz.0.2421': attribute type 1 has an invalid length. [ 341.261799][T15047] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 341.271778][T15048] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 341.613093][T15069] netlink: 'syz.2.2428': attribute type 1 has an invalid length. [ 341.674886][T15069] bond9: entered promiscuous mode [ 341.680781][T15069] 8021q: adding VLAN 0 to HW filter on device bond9 [ 342.009718][T15091] bond10: entered allmulticast mode [ 342.051269][T15099] veth11: entered allmulticast mode [ 342.092296][T15099] bond10: (slave veth11): Enslaving as an active interface with an up link [ 342.150002][T15111] netlink: 'syz.4.2438': attribute type 16 has an invalid length. [ 342.150735][T15091] bond10 (unregistering): (slave veth11): Releasing backup interface [ 342.159603][T15111] netlink: 'syz.4.2438': attribute type 17 has an invalid length. [ 342.197451][T15091] bond10 (unregistering): Released all slaves [ 342.200846][T15113] netlink: 'syz.0.2439': attribute type 30 has an invalid length. [ 342.225687][T15111] gre0: left promiscuous mode [ 342.246019][T15111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.265750][T15111] 8021q: adding VLAN 0 to HW filter on device team0 [ 342.277713][T15111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 342.289062][T15111] wireguard: wg1: Could not create IPv4 socket [ 342.297789][T15111] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 342.391494][T15117] syzkaller0: entered promiscuous mode [ 342.402057][T15117] syzkaller0: entered allmulticast mode [ 342.590292][T15131] ieee802154 phy1 wpan1: encryption failed: -90 [ 342.699754][T15135] __nla_validate_parse: 2 callbacks suppressed [ 342.699770][T15135] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2447'. [ 342.770088][T15140] netlink: set zone limit has 4 unknown bytes [ 343.000472][T15153] siw: device registration error -23 [ 343.080688][T15161] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2455'. [ 343.171287][T15165] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 343.345613][T15176] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2462'. [ 343.420994][T15180] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2464'. [ 343.440094][T15178] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2463'. [ 343.459303][T15178] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2463'. [ 343.494470][T15186] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2466'. [ 343.504384][T15186] netlink: 'syz.4.2466': attribute type 7 has an invalid length. [ 343.515241][T15186] netlink: 'syz.4.2466': attribute type 8 has an invalid length. [ 343.523573][T15186] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2466'. [ 343.721870][T15207] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2472'. [ 344.198413][T15238] netlink: 'syz.0.2481': attribute type 1 has an invalid length. [ 344.271848][T15238] bond10: (slave bridge5): making interface the new active one [ 344.280574][T15238] bond10: (slave bridge5): Enslaving as an active interface with an up link [ 344.490279][T15245] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2484'. [ 344.565440][T15248] bond10: Unable to set up delay as MII monitoring is disabled [ 344.587667][T15248] bond10 (unregistering): Released all slaves [ 345.441203][T15294] bridge0: port 1(batadv1) entered blocking state [ 345.456539][T15294] bridge0: port 1(batadv1) entered disabled state [ 345.470483][T15297] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 345.488255][T15294] batadv1: entered allmulticast mode [ 345.506496][T15294] batadv1: entered promiscuous mode [ 345.919273][ T12] batman_adv: batadv1: IGMP Querier appeared [ 345.927724][ T12] batman_adv: batadv1: MLD Querier appeared [ 346.105794][T15330] syzkaller0: entered promiscuous mode [ 346.119095][T15330] syzkaller0: entered allmulticast mode [ 346.185258][T15336] netlink: 'syz.1.2506': attribute type 4 has an invalid length. [ 346.273233][T15334] syzkaller0: entered promiscuous mode [ 346.284398][T15334] syzkaller0: entered allmulticast mode [ 347.142115][T15376] syzkaller0: entered promiscuous mode [ 347.157642][T15376] syzkaller0: entered allmulticast mode [ 347.173073][T15390] netlink: 'syz.4.2519': attribute type 7 has an invalid length. [ 349.813108][T15364] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 350.254552][T15441] __nla_validate_parse: 14 callbacks suppressed [ 350.254573][T15441] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2532'. [ 350.267953][T15443] netlink: 'syz.3.2533': attribute type 25 has an invalid length. [ 350.278530][T15441] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2532'. [ 350.290419][T15443] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2533'. [ 350.378810][T15448] netlink: 'syz.1.2534': attribute type 10 has an invalid length. [ 350.537087][ T1125] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 350.560796][T15461] veth1_macvtap: Device is already in use. [ 350.810306][T15488] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2542'. [ 350.838916][T15488] bond11: entered promiscuous mode [ 350.844231][T15488] bond11: entered allmulticast mode [ 351.015828][T15497] bond1: (slave veth0_to_bond): Releasing active interface [ 351.025986][T15497] veth0_to_bond: left promiscuous mode [ 351.032117][T15497] veth0_to_bond: left allmulticast mode [ 353.409045][T15450] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 353.657166][T15519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2553'. [ 353.687107][T15519] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2553'. [ 353.716535][T15519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2553'. [ 353.726075][T15515] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2552'. [ 353.728708][T15519] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2553'. [ 353.793372][T15527] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2554'. [ 353.908993][T15531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 353.918306][T15531] IPv6: NLM_F_CREATE should be set when creating new route [ 353.925679][T15531] IPv6: NLM_F_CREATE should be set when creating new route [ 353.958028][ T29] audit: type=1804 audit(1778344928.232:12): pid=15534 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2556" name="/newroot/554/cgroup.controllers" dev="tmpfs" ino=2845 res=1 errno=0 [ 354.039074][ T29] audit: type=1800 audit(1778344928.232:13): pid=15534 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2556" name="cgroup.controllers" dev="tmpfs" ino=2845 res=0 errno=0 [ 354.912000][T15582] netlink: 'syz.4.2569': attribute type 16 has an invalid length. [ 354.931967][T15582] netlink: 'syz.4.2569': attribute type 17 has an invalid length. [ 354.983300][T15582] wireguard: wg1: Could not create IPv4 socket [ 354.990835][T15582] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 355.371384][T15617] ieee802154 phy1 wpan1: encryption failed: -22 [ 355.490565][ T1125] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 355.547524][ T11] block nbd3: Possible stuck request ffff8880273ce000: control (read@0,1024B). Runtime 90 seconds [ 355.558635][ T11] block nbd3: Possible stuck request ffff8880273ce1c0: control (read@1024,1024B). Runtime 90 seconds [ 355.569853][ T11] block nbd3: Possible stuck request ffff8880273ce380: control (read@2048,1024B). Runtime 90 seconds [ 355.584655][ T11] block nbd3: Possible stuck request ffff8880273ce540: control (read@3072,1024B). Runtime 90 seconds [ 355.603483][T15635] netlink: 'syz.0.2582': attribute type 1 has an invalid length. [ 355.732181][T15635] 8021q: adding VLAN 0 to HW filter on device bond12 [ 355.799891][T15642] bond12: (slave geneve3): making interface the new active one [ 355.831848][T15654] __nla_validate_parse: 2 callbacks suppressed [ 355.831868][T15654] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2584'. [ 355.854242][T15654] netlink: 13 bytes leftover after parsing attributes in process `syz.3.2584'. [ 355.869382][T15642] bond12: (slave geneve3): Enslaving as an active interface with an up link [ 356.352276][T15672] can: request_module (can-proto-0) failed. [ 356.399455][T15675] sit0: entered promiscuous mode [ 356.409842][T15675] netlink: 'syz.0.2590': attribute type 1 has an invalid length. [ 356.418135][T15675] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2590'. [ 356.561981][T15687] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_rx_wq": -EINTR [ 356.644144][T15693] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2595'. [ 356.667601][T15693] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2595'. [ 356.829180][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 356.836472][ C0] bridge0: topology change detected, propagating [ 356.843181][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 356.850455][ C0] bridge0: topology change detected, propagating [ 356.889545][T15697] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 356.902503][T15697] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 356.911918][T15697] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 357.039864][T15701] netlink: 'syz.2.2597': attribute type 63 has an invalid length. [ 357.051944][T15701] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.466548][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 358.320227][T15613] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 358.625125][T15739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2605'. [ 358.698748][ T29] audit: type=1107 audit(1778344932.972:14): pid=15744 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 358.699594][T15743] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2606'. [ 358.909659][T15759] IPv6: sit2: Disabled Multicast RS [ 358.942164][T15760] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2609'. [ 358.953605][T15760] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2609'. [ 358.963150][T15760] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2609'. [ 359.021718][ T1345] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 359.099740][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.115078][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.127186][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.159513][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.170884][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.183122][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.194301][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.207204][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.218817][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.229930][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.241360][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.253705][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.265554][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.277543][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.290216][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.307915][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.319966][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.331405][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.342803][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.356258][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.379349][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.405149][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.417825][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.429571][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.440556][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.452214][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.465017][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.476508][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.489899][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.501272][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.513121][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.524696][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.535696][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.547522][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.558494][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.569570][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.581040][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.591985][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.603415][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.615684][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.627273][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.639037][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.650687][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.661899][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.673599][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.684644][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.695498][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.707913][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.719343][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.730235][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.741574][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.752773][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.764287][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.775919][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.786945][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.798192][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.809338][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.820648][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.831995][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.842848][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.853662][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.865004][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.876030][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.887545][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 359.898536][T15781] netdevsim netdevsim1: Firmware load for './file0/../file0' refused, path contains '..' component [ 361.841744][T15751] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 361.854439][T15771] netlink: 'syz.0.2614': attribute type 2 has an invalid length. [ 361.878267][T15771] __nla_validate_parse: 2 callbacks suppressed [ 361.878284][T15771] netlink: 188 bytes leftover after parsing attributes in process `syz.0.2614'. [ 362.098469][T15804] netem: change failed [ 362.118215][T15813] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2623'. [ 362.130417][T15813] xt_hl: Unknown Hop Limit match mode: 206 [ 364.431056][T15807] kthread_run failed with err -4 [ 364.534503][T15833] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 364.564448][T15833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2627'. [ 364.638580][T15839] netlink: 284 bytes leftover after parsing attributes in process `syz.2.2629'. [ 364.802165][ T12] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 367.617319][T15841] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 367.983401][T15895] smc: net device xfrm0 applied user defined pnetid SYZ0 [ 368.311876][T15916] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2647'. [ 368.380894][T15921] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2648'. [ 368.390602][T15921] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.397885][T15921] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.410401][T15921] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2648'. [ 368.758505][T15884] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 369.018278][ T147] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 369.031957][T15952] vet: renamed from ip6gre0 (while UP) [ 369.228077][T15963] ieee802154 phy1 wpan1: encryption failed: -22 [ 369.396827][T15970] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2658'. [ 371.896082][T15939] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 372.331830][T16002] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2665'. [ 372.438053][T15989] bond10: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 372.452912][T15989] bond10 (unregistering): Released all slaves [ 372.647946][T16009] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2669'. [ 372.835688][ T1345] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 372.851929][T16017] bridge0: port 1(batadv1) entered blocking state [ 372.858564][T16017] bridge0: port 1(batadv1) entered forwarding state [ 372.873634][T16039] netlink: 'syz.4.2676': attribute type 1 has an invalid length. [ 372.894289][T16017] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 372.902724][T16039] netlink: 244 bytes leftover after parsing attributes in process `syz.4.2676'. [ 372.948502][T16044] x_tables: unsorted underflow at hook 3 [ 372.955099][T16039] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2676'. [ 372.966367][T16044] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2677'. [ 372.976002][T16044] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2677'. [ 375.684448][T16018] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 375.694597][T16024] nbd: socks must be embedded in a SOCK_ITEM attr [ 375.877629][T16056] syzkaller0: entered promiscuous mode [ 375.883181][T16056] syzkaller0: entered allmulticast mode [ 375.937522][T16060] bridge11: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 375.971578][ T29] audit: type=1804 audit(1778344950.242:15): pid=16063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2684" name="/newroot/585/cgroup.controllers" dev="tmpfs" ino=3003 res=1 errno=0 [ 376.059748][ T29] audit: type=1800 audit(1778344950.242:16): pid=16063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2684" name="cgroup.controllers" dev="tmpfs" ino=3003 res=0 errno=0 [ 376.176559][T16076] Unsupported ieee802154 address type: 0 [ 376.214867][T16078] netlink: 'syz.3.2686': attribute type 4 has an invalid length. [ 376.609234][ T1345] nci: nci_rsp_packet: unknown rsp opcode 0xb05 [ 377.327291][T16137] netlink: 'syz.0.2701': attribute type 1 has an invalid length. [ 378.588666][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.497512][T16105] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 379.695364][T16156] __nla_validate_parse: 2 callbacks suppressed [ 379.695383][T16156] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2705'. [ 379.722378][T16155] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2707'. [ 379.845987][T16165] C: renamed from lo [ 379.869465][T16165] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 379.908898][T16169] bridge6: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 379.953997][T16176] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2713'. [ 379.957408][T16171] tipc: Enabled bearer , priority 0 [ 380.003358][T16171] syzkaller0: entered promiscuous mode [ 380.022503][T16171] syzkaller0: entered allmulticast mode [ 380.117688][T16171] tipc: Resetting bearer [ 380.121025][T16180] netlink: 'syz.2.2715': attribute type 1 has an invalid length. [ 380.214616][T16180] 8021q: adding VLAN 0 to HW filter on device bond10 [ 380.254685][T16168] tipc: Resetting bearer [ 380.370873][T16168] tipc: Disabling bearer [ 380.445518][T16204] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2718'. [ 380.463185][T16151] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 380.516815][T16206] IPv6: NLM_F_CREATE should be specified when creating new route [ 380.538130][T16206] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2719'. [ 380.576810][T16206] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2719'. [ 380.731359][T16223] netlink: 'syz.3.2724': attribute type 6 has an invalid length. [ 380.933697][T16241] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.2730'. [ 380.956928][T16241] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 381.040155][T16244] netlink: 'syz.2.2732': attribute type 1 has an invalid length. [ 381.081538][T16244] bond11: entered promiscuous mode [ 381.088463][T16244] 8021q: adding VLAN 0 to HW filter on device bond11 [ 381.101429][T16252] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 381.115374][T16244] bond11: (slave bridge7): making interface the new active one [ 381.123627][T16244] bridge7: entered promiscuous mode [ 381.131195][T16244] bond11: (slave bridge7): Enslaving as an active interface with an up link [ 381.294322][T16258] netlink: 'syz.0.2737': attribute type 1 has an invalid length. [ 381.453038][T16271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2736'. [ 381.578007][T16276] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2741'. [ 381.686489][T16258] 8021q: adding VLAN 0 to HW filter on device bond14 [ 381.709766][T16263] vlan0: entered promiscuous mode [ 381.720157][T16263] bond14: entered promiscuous mode [ 381.728582][T16263] vlan0: entered allmulticast mode [ 381.733777][T16263] bond14: entered allmulticast mode [ 381.784560][T16282] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 381.830434][T16282] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2742'. [ 382.684653][ T5627] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 382.699449][ T5627] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 382.710548][ T5627] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 382.723699][ T5627] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 382.733871][ T5627] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 383.187202][T16300] 1· speed is unknown, defaulting to 1000 [ 383.681014][T16328] syzkaller0: entered promiscuous mode [ 383.687749][T16328] syzkaller0: entered allmulticast mode [ 383.732067][T16338] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 384.391960][T16349] xt_l2tp: invalid flags combination: 8 [ 384.827619][ T5632] Bluetooth: hci5: command tx timeout [ 385.637305][ T11] block nbd3: Possible stuck request ffff8880273ce000: control (read@0,1024B). Runtime 120 seconds [ 385.648210][ T11] block nbd3: Possible stuck request ffff8880273ce1c0: control (read@1024,1024B). Runtime 120 seconds [ 385.661416][ T11] block nbd3: Possible stuck request ffff8880273ce380: control (read@2048,1024B). Runtime 120 seconds [ 385.672524][ T11] block nbd3: Possible stuck request ffff8880273ce540: control (read@3072,1024B). Runtime 120 seconds [ 386.320485][T16358] netlink: 'syz.4.2760': attribute type 8 has an invalid length. [ 386.371896][T16358] __nla_validate_parse: 3 callbacks suppressed [ 386.371913][T16358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2760'. [ 386.424026][T16363] tipc: Enabled bearer , priority 0 [ 386.484447][T16363] syzkaller0: entered promiscuous mode [ 386.501392][T16363] syzkaller0: entered allmulticast mode [ 386.689943][T16306] 1· speed is unknown, defaulting to 1000 [ 386.802431][T16381] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2767'. [ 386.836671][T16381] netlink: 'syz.4.2767': attribute type 63 has an invalid length. [ 386.837972][T16360] tipc: Resetting bearer [ 386.884932][T16360] tipc: Disabling bearer [ 386.906695][ T5632] Bluetooth: hci5: command tx timeout [ 386.941658][T16381] netlink: 'syz.4.2767': attribute type 63 has an invalid length. [ 387.064193][T16399] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2772'. [ 387.074671][T16398] tipc: Enabling of bearer rejected, failed to enable media [ 387.379911][T16409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2775'. [ 387.470551][T16306] bridge0: port 1(bridge_slave_0) entered blocking state [ 387.479588][T16423] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2776'. [ 387.489549][T16306] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.497861][T16306] bridge_slave_0: entered allmulticast mode [ 387.505604][T16306] bridge_slave_0: entered promiscuous mode [ 387.515413][T16306] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.522685][T16306] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.530499][T16306] bridge_slave_1: entered allmulticast mode [ 387.538240][T16306] bridge_slave_1: entered promiscuous mode [ 387.576792][T16306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.589670][T16306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.629554][T16306] team0: Port device team_slave_0 added [ 387.639990][T16306] team0: Port device team_slave_1 added [ 387.682150][T16306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.693132][T16306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.720252][T16306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.742619][T16428] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 387.762466][T16428] bond1: (slave lo): Enslaving as an active interface with an up link [ 387.773232][T16428] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 387.791776][T16306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.801963][T16306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.834701][T16306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.906553][T16306] hsr_slave_0: entered promiscuous mode [ 387.913308][T16306] hsr_slave_1: entered promiscuous mode [ 387.920133][T16306] debugfs: 'hsr0' already exists in 'hsr' [ 387.927472][T16306] Cannot create hsr debugfs directory [ 388.447491][T16306] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.462710][T16466] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2786'. [ 388.467613][T16306] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 388.615392][T16471] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2789'. [ 388.638939][T16473] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2790'. [ 388.680684][T16473] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2790'. [ 388.709140][T16469] netlink: 'syz.3.2789': attribute type 64 has an invalid length. [ 388.711168][T16306] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.729100][T16306] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 388.827079][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 388.840322][T16306] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.869658][T16306] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 388.963899][T16486] syzkaller0: entered promiscuous mode [ 388.981188][T16486] syzkaller0: entered allmulticast mode [ 388.997335][ T5627] Bluetooth: hci5: command tx timeout [ 389.082084][T16306] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 389.093429][T16306] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.612542][T16509] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2801'. [ 389.683889][T16306] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 389.714047][T16306] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 389.725983][T16306] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 389.748949][T16306] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 389.768001][T16306] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 389.792149][T16306] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 389.808480][T16306] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 389.842216][T16306] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 390.087745][T16306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 390.135974][T16306] 8021q: adding VLAN 0 to HW filter on device team0 [ 390.168302][ T1107] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.175541][ T1107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 390.220815][ T1107] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.228059][ T1107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 390.442887][T16546] syzkaller0: entered promiscuous mode [ 390.460081][T16546] syzkaller0: entered allmulticast mode [ 390.496767][T16553] tipc: Enabled bearer , priority 14 [ 391.068675][ T5627] Bluetooth: hci5: command tx timeout [ 392.779606][ T809] tipc: Node number set to 3543224227 [ 393.024637][T16581] ip6gre0: entered allmulticast mode [ 393.329704][T16600] netlink: 'syz.1.2822': attribute type 23 has an invalid length. [ 393.401331][T16306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 393.642562][T16626] __nla_validate_parse: 6 callbacks suppressed [ 393.642582][T16626] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2830'. [ 393.685132][T16306] veth0_vlan: entered promiscuous mode [ 393.714210][T16306] veth1_vlan: entered promiscuous mode [ 393.758938][T16306] veth0_macvtap: entered promiscuous mode [ 393.781242][T16632] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2833'. [ 393.798933][T16306] veth1_macvtap: entered promiscuous mode [ 393.835248][T16306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 393.857261][T16306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 393.892685][ T1125] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.912722][ T1125] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.942640][ T1125] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.972688][ T1125] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.119625][T16647] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2837'. [ 394.131672][T16647] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 394.149620][T16647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2837'. [ 394.217698][T16647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2837'. [ 394.452053][T16659] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2841'. [ 394.470391][T16659] macvlan4: entered allmulticast mode [ 394.476025][T16659] hsr0: entered allmulticast mode [ 394.483111][T16659] hsr_slave_0: entered allmulticast mode [ 394.489487][T16659] hsr_slave_1: entered allmulticast mode [ 394.495155][T16659] hsr0: entered promiscuous mode [ 394.527931][T16660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2841'. [ 394.543275][T16660] macvlan5: entered allmulticast mode [ 396.534664][T16619] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 396.645476][T16673] netlink: 'syz.4.2844': attribute type 11 has an invalid length. [ 396.654456][T16673] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2844'. [ 396.671345][T16673] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2844'. [ 396.689318][T10608] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.712230][T10608] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.822858][T10608] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.843963][T10608] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.967690][T16684] syzkaller0: entered promiscuous mode [ 396.984448][T16684] syzkaller0: entered allmulticast mode [ 397.042566][T16684] IPv6: sit2: Disabled Multicast RS [ 397.246021][T16709] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2854'. [ 397.385204][T16721] Cannot find set identified by id 65534 to match [ 397.431841][T16729] xt_hashlimit: size too large, truncated to 1048576 [ 397.432284][T16728] xt_hashlimit: size too large, truncated to 1048576 [ 397.643382][T16740] openvswitch: netlink: IP tunnel TTL not specified. [ 397.651257][T16740] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 400.321949][T16716] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 400.502097][T16758] __nla_validate_parse: 5 callbacks suppressed [ 400.502116][T16758] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2865'. [ 400.527728][T16761] netlink: 'syz.0.2868': attribute type 12 has an invalid length. [ 400.604966][T16767] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2869'. [ 400.672750][T16761] bond15: option primary_reselect: invalid value (255) [ 400.684834][T16761] bond15 (unregistering): Released all slaves [ 400.714627][T16775] netlink: 71 bytes leftover after parsing attributes in process `syz.2.2870'. [ 401.093028][T16787] netlink: 'syz.0.2873': attribute type 1 has an invalid length. [ 401.186052][T16787] bond15: entered promiscuous mode [ 401.212131][T16787] 8021q: adding VLAN 0 to HW filter on device bond15 [ 401.320215][T16789] bond15: (slave bridge8): making interface the new active one [ 401.345112][T16792] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2874'. [ 401.349127][T16789] bridge8: entered promiscuous mode [ 401.380959][T16789] bond15: (slave bridge8): Enslaving as an active interface with an up link [ 401.635109][T16792] bond1: option xmit_hash_policy: invalid value (64) [ 401.676247][T16792] bond1 (unregistering): Released all slaves [ 401.719708][T16799] block nbd1: reconnected socket [ 401.761503][ T5627] block nbd1: Receive control failed (result -32) [ 401.775129][T16801] netlink: zone id is out of range [ 401.804335][T16801] netlink: zone id is out of range [ 401.833958][T16801] netlink: zone id is out of range [ 401.840345][T16801] netlink: zone id is out of range [ 401.845791][T16801] netlink: zone id is out of range [ 401.851493][T16801] netlink: zone id is out of range [ 401.856994][T16801] netlink: zone id is out of range [ 401.862592][T16801] netlink: set zone limit has 4 unknown bytes [ 402.015025][T16816] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.2878'. [ 402.025344][T16816] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 402.243141][T16823] netlink: 'syz.3.2881': attribute type 1 has an invalid length. [ 402.243471][T16821] netlink: 'syz.3.2881': attribute type 1 has an invalid length. [ 402.268332][T16821] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2881'. [ 402.271954][T16823] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2881'. [ 402.319546][T16825] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2882'. [ 402.421250][T16829] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2884'. [ 402.584591][T16834] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 402.999297][T16865] netlink: 372 bytes leftover after parsing attributes in process `syz.3.2892'. [ 404.885577][T16808] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 405.023599][T16875] ip6_vti0: entered allmulticast mode [ 405.069626][T16880] netlink: 'syz.1.2898': attribute type 1 has an invalid length. [ 405.155365][T16874] ip6_vti0: left allmulticast mode [ 405.160410][T16890] xt_hashlimit: size too large, truncated to 1048576 [ 405.202264][T16893] unsupported nlmsg_type 40 [ 405.250005][T16880] bond13: (slave bridge4): Enslaving as a backup interface with an up link [ 405.284627][T16895] netlink: 'syz.2.2901': attribute type 11 has an invalid length. [ 405.304091][T16897] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 405.314945][T16895] netlink: 'syz.2.2901': attribute type 11 has an invalid length. [ 405.329928][T16902] netlink: 'syz.4.2903': attribute type 29 has an invalid length. [ 405.340284][T16897] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 405.347789][T16902] netlink: 'syz.4.2903': attribute type 29 has an invalid length. [ 405.358539][T16902] netlink: 'syz.4.2903': attribute type 12 has an invalid length. [ 405.372524][T16902] netlink: 'syz.4.2903': attribute type 12 has an invalid length. [ 405.541343][T16907] __nla_validate_parse: 6 callbacks suppressed [ 405.541361][T16907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2904'. [ 405.620397][T16907] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2904'. [ 405.693934][T16907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2904'. [ 405.732040][T16907] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2904'. [ 405.801871][T16926] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.2908'. [ 405.866045][T16926] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 406.025491][T16946] netlink: 'syz.0.2912': attribute type 1 has an invalid length. [ 406.053024][T16940] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input6 [ 406.179955][T16946] 8021q: adding VLAN 0 to HW filter on device bond16 [ 406.327999][T16960] bond16: (slave ip6gretap1): making interface the new active one [ 406.338604][T16960] bond16: (slave ip6gretap1): Enslaving as an active interface with an up link [ 406.613733][T16988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2921'. [ 407.133419][ T5632] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 407.149044][ T5632] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 407.159507][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 407.169751][ T5632] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 407.181585][ T5632] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 407.201127][ T5627] [ 407.203504][ T5627] ====================================================== [ 407.210527][ T5627] WARNING: possible circular locking dependency detected [ 407.217588][ T5627] syzkaller #0 Not tainted [ 407.222013][ T5627] ------------------------------------------------------ [ 407.229038][ T5627] kworker/u9:2/5627 is trying to acquire lock: [ 407.235196][ T5627] ffff88801be8d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4ed/0x5c0 [ 407.245628][ T5627] [ 407.245628][ T5627] but task is already holding lock: [ 407.252984][ T5627] ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5c0 [ 407.262398][ T5627] [ 407.262398][ T5627] which lock already depends on the new lock. [ 407.262398][ T5627] [ 407.272796][ T5627] [ 407.272796][ T5627] the existing dependency chain (in reverse order) is: [ 407.281821][ T5627] [ 407.281821][ T5627] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 407.289818][ T5627] down_write+0x96/0x200 [ 407.294582][ T5627] kernfs_add_one+0x41/0x5c0 [ 407.299698][ T5627] kernfs_create_dir_ns+0xde/0x130 [ 407.305328][ T5627] internal_create_group+0x425/0x1180 [ 407.311473][ T5627] cpuhp_invoke_callback+0x445/0x860 [ 407.317274][ T5627] cpuhp_issue_call+0x430/0x7a0 [ 407.322639][ T5627] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 407.329304][ T5627] __cpuhp_setup_state+0x3f/0x60 [ 407.334765][ T5627] do_one_initcall+0x250/0x870 [ 407.340050][ T5627] do_initcall_level+0x104/0x190 [ 407.345496][ T5627] do_initcalls+0x59/0xa0 [ 407.350342][ T5627] kernel_init_freeable+0x2a6/0x3e0 [ 407.356140][ T5627] kernel_init+0x1d/0x1d0 [ 407.360988][ T5627] ret_from_fork+0x514/0xb70 [ 407.366102][ T5627] ret_from_fork_asm+0x1a/0x30 [ 407.371383][ T5627] [ 407.371383][ T5627] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 407.379203][ T5627] [ 407.379203][ T5627] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 407.386977][ T5627] cpus_read_lock+0x42/0x160 [ 407.392174][ T5627] static_key_slow_inc+0x12/0x30 [ 407.397833][ T5627] nbd_genl_reconfigure+0x132f/0x1ea0 [ 407.403813][ T5627] genl_family_rcv_msg_doit+0x22a/0x330 [ 407.409912][ T5627] genl_rcv_msg+0x61c/0x7a0 [ 407.414972][ T5627] netlink_rcv_skb+0x232/0x4b0 [ 407.420313][ T5627] genl_rcv+0x28/0x40 [ 407.424856][ T5627] netlink_unicast+0x75c/0x8e0 [ 407.430182][ T5627] netlink_sendmsg+0x813/0xb40 [ 407.435501][ T5627] ____sys_sendmsg+0x972/0x9f0 [ 407.440842][ T5627] ___sys_sendmsg+0x2a5/0x360 [ 407.446085][ T5627] __x64_sys_sendmsg+0x1bd/0x2a0 [ 407.451601][ T5627] do_syscall_64+0x15f/0xf80 [ 407.456846][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.463319][ T5627] [ 407.463319][ T5627] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 407.471081][ T5627] __mutex_lock+0x1a3/0x1550 [ 407.476285][ T5627] nbd_queue_rq+0x37b/0x1100 [ 407.481493][ T5627] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 407.487602][ T5627] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 407.494523][ T5627] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 407.501084][ T5627] blk_mq_run_hw_queue+0x348/0x4f0 [ 407.506759][ T5627] blk_mq_dispatch_list+0xd16/0xe10 [ 407.512556][ T5627] blk_mq_flush_plug_list+0x48d/0x570 [ 407.518486][ T5627] __blk_flush_plug+0x3ed/0x4d0 [ 407.523934][ T5627] __submit_bio+0x28d/0x580 [ 407.528962][ T5627] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 407.535178][ T5627] block_read_full_folio+0x599/0x830 [ 407.541011][ T5627] filemap_read_folio+0x137/0x3b0 [ 407.546615][ T5627] do_read_cache_folio+0x358/0x590 [ 407.552305][ T5627] read_part_sector+0xb6/0x2b0 [ 407.557627][ T5627] adfspart_check_ICS+0xb1/0x960 [ 407.563153][ T5627] bdev_disk_changed+0x817/0x1770 [ 407.568736][ T5627] blkdev_get_whole+0x380/0x510 [ 407.574166][ T5627] bdev_open+0x31e/0xd30 [ 407.578996][ T5627] blkdev_open+0x470/0x610 [ 407.584123][ T5627] do_dentry_open+0x785/0x14e0 [ 407.589438][ T5627] vfs_open+0x3b/0x340 [ 407.594069][ T5627] path_openat+0x2e08/0x3860 [ 407.599253][ T5627] do_file_open+0x23e/0x4a0 [ 407.604346][ T5627] do_sys_openat2+0x113/0x200 [ 407.609566][ T5627] __x64_sys_openat+0x138/0x170 [ 407.614973][ T5627] do_syscall_64+0x15f/0xf80 [ 407.620325][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.626773][ T5627] [ 407.626773][ T5627] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 407.634932][ T5627] __mutex_lock+0x1a3/0x1550 [ 407.640122][ T5627] nbd_queue_rq+0xc6/0x1100 [ 407.645257][ T5627] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 407.651374][ T5627] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 407.658277][ T5627] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 407.665016][ T5627] blk_mq_run_hw_queue+0x348/0x4f0 [ 407.670734][ T5627] blk_mq_dispatch_list+0xd16/0xe10 [ 407.676595][ T5627] blk_mq_flush_plug_list+0x48d/0x570 [ 407.682569][ T5627] __blk_flush_plug+0x3ed/0x4d0 [ 407.688021][ T5627] __submit_bio+0x28d/0x580 [ 407.693086][ T5627] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 407.699378][ T5627] block_read_full_folio+0x599/0x830 [ 407.705298][ T5627] filemap_read_folio+0x137/0x3b0 [ 407.711341][ T5627] do_read_cache_folio+0x358/0x590 [ 407.717080][ T5627] read_part_sector+0xb6/0x2b0 [ 407.722431][ T5627] adfspart_check_ICS+0xb1/0x960 [ 407.727980][ T5627] bdev_disk_changed+0x817/0x1770 [ 407.733633][ T5627] blkdev_get_whole+0x380/0x510 [ 407.739066][ T5627] bdev_open+0x31e/0xd30 [ 407.743910][ T5627] blkdev_open+0x470/0x610 [ 407.748901][ T5627] do_dentry_open+0x785/0x14e0 [ 407.754324][ T5627] vfs_open+0x3b/0x340 [ 407.758964][ T5627] path_openat+0x2e08/0x3860 [ 407.764113][ T5627] do_file_open+0x23e/0x4a0 [ 407.769190][ T5627] do_sys_openat2+0x113/0x200 [ 407.774426][ T5627] __x64_sys_openat+0x138/0x170 [ 407.779822][ T5627] do_syscall_64+0x15f/0xf80 [ 407.784972][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.791425][ T5627] [ 407.791425][ T5627] -> #4 (set->srcu){.+.+}-{0:0}: [ 407.798607][ T5627] __synchronize_srcu+0xca/0x300 [ 407.804085][ T5627] elevator_switch+0x1e8/0x7a0 [ 407.809441][ T5627] elevator_change+0x2cc/0x450 [ 407.814787][ T5627] elevator_set_default+0x36c/0x430 [ 407.820558][ T5627] blk_register_queue+0x3e9/0x4e0 [ 407.826127][ T5627] __add_disk+0x677/0xd50 [ 407.831006][ T5627] add_disk_fwnode+0xfb/0x480 [ 407.836218][ T5627] nbd_dev_add+0x72c/0xb50 [ 407.841175][ T5627] nbd_init+0x168/0x1f0 [ 407.845883][ T5627] do_one_initcall+0x250/0x870 [ 407.851202][ T5627] do_initcall_level+0x104/0x190 [ 407.856682][ T5627] do_initcalls+0x59/0xa0 [ 407.861551][ T5627] kernel_init_freeable+0x2a6/0x3e0 [ 407.867296][ T5627] kernel_init+0x1d/0x1d0 [ 407.872175][ T5627] ret_from_fork+0x514/0xb70 [ 407.877738][ T5627] ret_from_fork_asm+0x1a/0x30 [ 407.883063][ T5627] [ 407.883063][ T5627] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 407.890933][ T5627] __mutex_lock+0x1a3/0x1550 [ 407.896054][ T5627] elevator_change+0x1b3/0x450 [ 407.901330][ T5627] elevator_set_none+0xb5/0x140 [ 407.906696][ T5627] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 407.913009][ T5627] nbd_start_device+0x17f/0xb10 [ 407.918371][ T5627] nbd_genl_connect+0x165b/0x1cf0 [ 407.924001][ T5627] genl_family_rcv_msg_doit+0x22a/0x330 [ 407.930258][ T5627] genl_rcv_msg+0x61c/0x7a0 [ 407.935368][ T5627] netlink_rcv_skb+0x232/0x4b0 [ 407.940669][ T5627] genl_rcv+0x28/0x40 [ 407.945225][ T5627] netlink_unicast+0x75c/0x8e0 [ 407.950702][ T5627] netlink_sendmsg+0x813/0xb40 [ 407.956011][ T5627] ____sys_sendmsg+0x972/0x9f0 [ 407.961318][ T5627] ___sys_sendmsg+0x2a5/0x360 [ 407.966526][ T5627] __x64_sys_sendmsg+0x1bd/0x2a0 [ 407.971998][ T5627] do_syscall_64+0x15f/0xf80 [ 407.977113][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.983519][ T5627] [ 407.983519][ T5627] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 407.992146][ T5627] blk_alloc_queue+0x546/0x680 [ 407.997432][ T5627] __blk_mq_alloc_disk+0x197/0x390 [ 408.003054][ T5627] nbd_dev_add+0x499/0xb50 [ 408.007995][ T5627] nbd_init+0x168/0x1f0 [ 408.012666][ T5627] do_one_initcall+0x250/0x870 [ 408.017937][ T5627] do_initcall_level+0x104/0x190 [ 408.023383][ T5627] do_initcalls+0x59/0xa0 [ 408.028224][ T5627] kernel_init_freeable+0x2a6/0x3e0 [ 408.033943][ T5627] kernel_init+0x1d/0x1d0 [ 408.038789][ T5627] ret_from_fork+0x514/0xb70 [ 408.043993][ T5627] ret_from_fork_asm+0x1a/0x30 [ 408.049297][ T5627] [ 408.049297][ T5627] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 408.056522][ T5627] fs_reclaim_acquire+0x71/0x100 [ 408.062039][ T5627] kmem_cache_alloc_noprof+0x40/0x650 [ 408.068058][ T5627] __kernfs_iattrs+0xdf/0x320 [ 408.073271][ T5627] kernfs_iop_setattr+0xea/0x3f0 [ 408.078744][ T5627] notify_change+0xc1a/0xf40 [ 408.083850][ T5627] do_truncate+0x1c2/0x250 [ 408.088784][ T5627] path_openat+0x2f89/0x3860 [ 408.093890][ T5627] do_file_open+0x23e/0x4a0 [ 408.098909][ T5627] do_sys_openat2+0x113/0x200 [ 408.104098][ T5627] __x64_sys_openat+0x138/0x170 [ 408.109460][ T5627] do_syscall_64+0x15f/0xf80 [ 408.114573][ T5627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.120979][ T5627] [ 408.120979][ T5627] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 408.129499][ T5627] __lock_acquire+0x15a5/0x2cf0 [ 408.134886][ T5627] lock_acquire+0x106/0x350 [ 408.139902][ T5627] down_write+0x96/0x200 [ 408.144656][ T5627] kernfs_link_sibling+0x4ed/0x5c0 [ 408.150292][ T5627] kernfs_add_one+0x1ca/0x5c0 [ 408.155512][ T5627] kernfs_create_dir_ns+0xde/0x130 [ 408.161141][ T5627] sysfs_create_dir_ns+0x12f/0x2a0 [ 408.166853][ T5627] kobject_add_internal+0x62b/0xd00 [ 408.172559][ T5627] kobject_add+0x163/0x240 [ 408.177489][ T5627] device_add+0x408/0xbb0 [ 408.182325][ T5627] hci_conn_add_sysfs+0xd5/0x210 [ 408.187775][ T5627] hci_conn_complete_evt+0x84e/0x1290 [ 408.193664][ T5627] hci_event_packet+0x6ab/0xef0 [ 408.199027][ T5627] hci_rx_work+0x3ee/0x1040 [ 408.204044][ T5627] process_scheduled_works+0xb5d/0x1860 [ 408.210108][ T5627] worker_thread+0xa53/0xfc0 [ 408.215227][ T5627] kthread+0x388/0x470 [ 408.219842][ T5627] ret_from_fork+0x514/0xb70 [ 408.224952][ T5627] ret_from_fork_asm+0x1a/0x30 [ 408.230232][ T5627] [ 408.230232][ T5627] other info that might help us debug this: [ 408.230232][ T5627] [ 408.240442][ T5627] Chain exists of: [ 408.240442][ T5627] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 408.240442][ T5627] [ 408.254869][ T5627] Possible unsafe locking scenario: [ 408.254869][ T5627] [ 408.262310][ T5627] CPU0 CPU1 [ 408.267750][ T5627] ---- ---- [ 408.273101][ T5627] lock(&root->kernfs_rwsem); [ 408.277859][ T5627] lock(cpuhp_state_mutex); [ 408.284962][ T5627] lock(&root->kernfs_rwsem); [ 408.292232][ T5627] lock(&root->kernfs_iattr_rwsem); [ 408.297677][ T5627] [ 408.297677][ T5627] *** DEADLOCK *** [ 408.297677][ T5627] [ 408.305810][ T5627] 4 locks held by kworker/u9:2/5627: [ 408.311078][ T5627] #0: ffff888035cb8940 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 408.322303][ T5627] #1: ffffc9000459fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 408.334298][ T5627] #2: ffff88804ef3c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xcd/0x1290 [ 408.344143][ T5627] #3: ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5c0 [ 408.353978][ T5627] [ 408.353978][ T5627] stack backtrace: [ 408.359858][ T5627] CPU: 1 UID: 0 PID: 5627 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 408.359892][ T5627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 408.359912][ T5627] Workqueue: hci3 hci_rx_work [ 408.359958][ T5627] Call Trace: [ 408.359965][ T5627] [ 408.359973][ T5627] dump_stack_lvl+0xe8/0x150 [ 408.359992][ T5627] print_circular_bug+0x2e1/0x300 [ 408.360015][ T5627] check_noncircular+0x12e/0x150 [ 408.360038][ T5627] __lock_acquire+0x15a5/0x2cf0 [ 408.360058][ T5627] ? __lock_acquire+0x6b5/0x2cf0 [ 408.360079][ T5627] ? kernfs_link_sibling+0x4ed/0x5c0 [ 408.360100][ T5627] lock_acquire+0x106/0x350 [ 408.360116][ T5627] ? kernfs_link_sibling+0x4ed/0x5c0 [ 408.360159][ T5627] down_write+0x96/0x200 [ 408.360180][ T5627] ? kernfs_link_sibling+0x4ed/0x5c0 [ 408.360201][ T5627] ? __pfx_down_write+0x10/0x10 [ 408.360221][ T5627] ? kernfs_root+0x1c/0x230 [ 408.360248][ T5627] ? kernfs_root+0x1c/0x230 [ 408.360267][ T5627] ? kernfs_root+0x1ea/0x230 [ 408.360290][ T5627] kernfs_link_sibling+0x4ed/0x5c0 [ 408.360320][ T5627] kernfs_add_one+0x1ca/0x5c0 [ 408.360346][ T5627] kernfs_create_dir_ns+0xde/0x130 [ 408.360374][ T5627] sysfs_create_dir_ns+0x12f/0x2a0 [ 408.360395][ T5627] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 408.360415][ T5627] ? do_raw_spin_unlock+0xf5/0x210 [ 408.360439][ T5627] kobject_add_internal+0x62b/0xd00 [ 408.360457][ T5627] kobject_add+0x163/0x240 [ 408.360484][ T5627] ? __pfx_kobject_add+0x10/0x10 [ 408.360507][ T5627] ? _raw_spin_unlock+0x28/0x50 [ 408.360527][ T5627] ? get_device_parent+0x366/0x3a0 [ 408.360547][ T5627] device_add+0x408/0xbb0 [ 408.360565][ T5627] hci_conn_add_sysfs+0xd5/0x210 [ 408.360589][ T5627] hci_conn_complete_evt+0x84e/0x1290 [ 408.360629][ T5627] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 408.360664][ T5627] hci_event_packet+0x6ab/0xef0 [ 408.360693][ T5627] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 408.360716][ T5627] ? __pfx_hci_event_packet+0x10/0x10 [ 408.360750][ T5627] ? kcov_remote_start+0x49a/0x7a0 [ 408.360783][ T5627] ? hci_send_to_monitor+0xe2/0x590 [ 408.360807][ T5627] hci_rx_work+0x3ee/0x1040 [ 408.360836][ T5627] ? process_scheduled_works+0xa70/0x1860 [ 408.360859][ T5627] process_scheduled_works+0xb5d/0x1860 [ 408.360890][ T5627] ? __pfx_process_scheduled_works+0x10/0x10 [ 408.360912][ T5627] ? assign_work+0x3d5/0x5e0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 408.360929][ T5627] worker_thread+0xa53/0xfc0 [ 408.360956][ T5627] kthread+0x388/0x470 [ 408.360975][ T5627] ? __pfx_worker_thread+0x10/0x10 [ 408.360999][ T5627] ? __pfx_kthread+0x10/0x10 [ 408.361018][ T5627] ret_from_fork+0x514/0xb70 [ 408.361036][ T5627] ? __pfx_ret_from_fork+0x10/0x10 [ 408.361052][ T5627] ? __switch_to+0xc79/0x1410 [ 408.361075][ T5627] ? __pfx_kthread+0x10/0x10 [ 408.361095][ T5627] ret_from_fork_asm+0x1a/0x30 [ 408.361120][ T5627] [ 408.705082][T16919] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 409.601858][ T1345] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 409.652008][ T1345] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 409.699945][ T1345] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 409.751821][ T1345] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 409.828439][ T1345] bridge_slave_1: left allmulticast mode [ 409.834759][ T1345] bridge_slave_1: left promiscuous mode [ 409.840989][ T1345] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.850117][ T1345] bridge_slave_0: left allmulticast mode [ 409.855852][ T1345] bridge_slave_0: left promiscuous mode [ 409.862448][ T1345] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.969675][ T1345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 409.980330][ T1345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 409.991624][ T1345] bond0 (unregistering): Released all slaves [ 410.268998][ T5291] 8021q: adding VLAN 0 to HW filter on device eth1 [ 410.283809][ T1345] hsr_slave_0: left promiscuous mode [ 410.289935][ T1345] hsr_slave_1: left promiscuous mode [ 410.295876][ T1345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 410.303854][ T1345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 410.312724][ T1345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 410.321075][ T1345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 410.330892][ T1345] veth1_macvtap: left promiscuous mode [ 410.336447][ T1345] veth0_macvtap: left promiscuous mode [ 410.341980][ T1345] veth1_vlan: left promiscuous mode [ 410.347861][ T1345] veth0_vlan: left promiscuous mode [ 410.437922][ T1345] team0 (unregistering): Port device team_slave_1 removed [ 410.448500][ T1345] team0 (unregistering): Port device team_slave_0 removed [ 410.779957][ T5291] 8021q: adding VLAN 0 to HW filter on device eth2 [ 410.988042][ T5291] 8021q: adding VLAN 0 to HW filter on device eth3 [ 411.192381][ T5291] 8021q: adding VLAN 0 to HW filter on device eth4 [ 413.791910][ T4996] udevd[4996]: worker [5637] /devices/virtual/block/nbd3 is taking a long time [ 415.706651][ T11] block nbd3: Possible stuck request ffff8880273ce000: control (read@0,1024B). Runtime 150 seconds [ 415.717721][ T11] block nbd3: Possible stuck request ffff8880273ce1c0: control (read@1024,1024B). Runtime 150 seconds [ 415.729119][ T11] block nbd3: Possible stuck request ffff8880273ce380: control (read@2048,1024B). Runtime 150 seconds [ 415.740250][ T11] block nbd3: Possible stuck request ffff8880273ce540: control (read@3072,1024B). Runtime 150 seconds