last executing test programs: 2.508639681s ago: executing program 1 (id=1518): r0 = socket(0x1e, 0x805, 0x0) connect$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{}, 0x2}}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000001600)=""/175, &(0x7f00000016c0)=0xaf) (async, rerun: 64) getsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000380)={@empty, @dev, @local}, &(0x7f00000003c0)=0xc) (async, rerun: 64) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000000)={0x0, {{0xa, 0x4e20, 0x9, @ipv4={'\x00', '\xff\xff', @empty}, 0x5}}}, 0x88) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000006000000040000000000000e0400000000000000000000000100000d040000000400000004000000000000000000001004000000000000000000000a030000000000000061"], 0x0, 0x5a}, 0x20) (rerun: 32) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010005000900000001"], 0x48) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1900000000000000000000000020df0018110011", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x101, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) ioctl$F2FS_IOC_MOVE_RANGE(r6, 0xc020f509, &(0x7f0000000400)={r4, 0x99e, 0xfaec, 0x1}) (async, rerun: 64) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_pid(r8, &(0x7f0000000340), 0x12) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x18, 0x1d, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @btf_id={0x18, 0x2, 0x3, 0x0, 0x1}, @func, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r8}}, @generic={0x1, 0x4, 0x6, 0x3, 0x1}]}, &(0x7f0000000540)='syzkaller\x00', 0x8, 0xf3, &(0x7f0000000580)=""/243, 0x41000, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000680)={0x2, 0x9, 0x4, 0x4}, 0x10, 0x0, 0x0, 0x3, 0x0, &(0x7f00000006c0)=[{0x1, 0x2, 0xd, 0x2}, {0x5, 0x1, 0x4, 0x9}, {0x4, 0x5, 0xe, 0x6}], 0x10, 0x7}, 0x94) (async, rerun: 32) socket$kcm(0x29, 0x2, 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000300)={@mcast1, 0x4, r9}) r10 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r10, 0x89f2, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x0, 0x7f81, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) (async) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x8, 0x3, 0x208, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x98}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x15, 0x9, 0x6, 0x8, '\x00', 'syz0\x00', {0x4}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) 2.35926813s ago: executing program 1 (id=1521): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_generic(0x10, 0x3, 0x10) socket(0x29, 0x5, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs$namespace(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) accept(r0, 0x0, &(0x7f0000000200)) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2.244851598s ago: executing program 2 (id=1523): pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCSMRU(r2, 0x40047452, 0x0) write(r1, &(0x7f0000000340), 0x11000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000ad8000000060a010400000000000000000a0000010900010073797a3100000000ac00048020000180070001006374000014000280080002400000000d0800014000000009540001800a00010072656469720000084400028008f101400000001108000240000000170800034000000061080003400000000608000140000000000800024000000008080002400000000f08000340000000303400018011000100666c6f775f6f66666c6f616400ffff001c0002800900010057797a32000000000900010073797a31000000000900020073797a32"], 0x100}, 0x1, 0x0, 0x0, 0x8001}, 0x24000000) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7ffeffff}}}}]}, 0x44}}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400dc}, 0x24000080) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000040)={'syztnl1\x00', r7, 0x10, 0x700, 0x8, 0x4, {{0x5, 0x4, 0x3, 0x3e, 0x14, 0x64, 0x0, 0x0, 0x29, 0x0, @broadcast, @remote}}}}) vmsplice(r1, &(0x7f0000000280)=[{&(0x7f0000000680)="85", 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 2.032278721s ago: executing program 2 (id=1524): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) (async, rerun: 32) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x70bd2d, 0x0, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}}, 0x0) 1.813066613s ago: executing program 2 (id=1529): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056842bb002552da15f6", @ANYRES32=0x0, @ANYBLOB="000000293c000000280012800a00010076786c616e00000018000280140013"], 0x48}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f00000006c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x6d}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000980)={&(0x7f0000000940)='tlb_flush\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x15, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b7050000000b00006110200000000000d40500002000000095000000000000009abb1723bf2c203831c9545b21c751ee4024f479cbe4b89f9807836ea5847c95ffc926c2e182c7a3221481f5009edaf5f542a715b99fb3d2a73dd02584a54ee68c70dbfbcdcea76ee541e318cbe84cd4f5381f522e258a4d9aeb9b16feb66bf40fdf73be95633dc5de907f2ffdcc18494f09c327abd3a76fee11357181f05f7ac06d6a9078df8bc21f00cd8ac4109850ce4aa147beacafecd5c7ccdeecb146ca1e7611f8b3adb41b39029c1b9b59fbf1b4a80167ca6b113a1600000000000000000000cdb7fe6d684423596ee2bdad7787936c24c84d4721327a695ed24946de35ff5e000091e0610ac2d72b9b6f453f98e7b5a25941905bd564aac36dbe7d1db9f5561ad6f7c2e79fb80b6949d626024b5fb96e3da0d7113b1c826f49a2cbc18001d315aaf280a8a762689f8c6fee958836002f48815ad19ee99d81c9e3cda430cef4a75e5c4dd14c3cbb6af58e3f3b3f8cbd858532b02995d79ca5dac0fd49aa150f6e212e3f46e4f37f372ee43f136e4d3af6cc4a0ce2379cc1010d8483b82e54feeefa1e89d6a3b74fbb4b619c43984223674b40fbe29ea5752c76a5e6a44d95382a9e04f9a51881aedb6d6242d0fe2e7dcf1f8b22f46c37fb010f8e86c62a4c72327c7eaaf720aff72529429aed45219cb1b6476e53b650927d193b4062c4640de2781643edc5e59280c59332e92b52675a02009db11b3829d8424fdf33ccdb7f89bfa14f9c2a17f9183cb48222e685f49340891845efdac175d90c116eaa013315165865f9a3785e21b41fd4b5eda7eb5a7462307fe72a3fe53eb02c75867e6eeebfc3037683f66d407fc28c4735a221bb5b78a6f966474a98ceceb20f0d4757b8e81ab14d29bad2b19aa5aff53ee333009688b401064898f58f88226f0e675cc74f0adaf4b97315e12e88b5eabd519e523a7f0e839fe91774f85a65068de244a78687c12e4e6dffb556c8d30b8ee73faaac455701569da7ae1a4e44fdd2cf28965a9f5e09acf476e07e5ea768c558a5622601742b27b91724dde6a0f96d3e53e67db57bbd0d3f2dd8439192dfc71f9e5f289c7f519e8b794fb09b64fb3c1bcd46731051de09510ebd717eb57655d447753fd2ff052a9d6889ddb5a5f68564bd00a5ff58a75805eadb00000000000000006a9af2471aada1ad164502199e0a668ad4daa53e5658f82733b3c7f36fcf3146adf7025dfd79c5a67c27395f5ca5a90d45402e58b42946b5a977a56385f31083a4b65d61ec4991cd6c91a02bd788825a"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x4924b68, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) 1.668103339s ago: executing program 2 (id=1532): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x40, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_TX_RATES={0x24, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x14, 0x1, [0x1, 0x18, 0x18, 0x2, 0xb, 0x4, 0x1b, 0x1, 0x4, 0x2, 0x48, 0x1, 0x30, 0x30, 0x2e, 0x12]}, @NL80211_TXRATE_HT={0x6, 0x2, [{}, {0x0, 0x5}]}]}]}]}, 0x40}}, 0x0) 1.639570901s ago: executing program 2 (id=1533): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x20044004) write$tun(r0, &(0x7f0000000680)={@val={0xa, 0x6002}, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x4, 0x0, 0x2}, {0x8100, 0x0, 0x0, 0x4}}, {@ipv6={0x86dd, @tipc_packet={0x1, 0x6, "3b0de4", 0x18, 0x6, 0xff, @empty, @mcast2, {[], @payload_conn={{{0x18, 0x0, 0x1, 0x1, 0x0, 0x6, 0x2, 0x2, 0x5, 0x0, 0x3, 0x3, 0x3, 0x0, 0x3, 0x9, 0x0, 0x4e24, 0x4e22}}}}}}}}}, 0x5a) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910900000000000630000dd000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) recvmmsg(r1, &(0x7f00000025c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/48, 0x30}], 0x1, &(0x7f0000000300)=""/192, 0xc0}, 0x2}, {{&(0x7f0000000240)=@x25={0x9, @remote}, 0x80, &(0x7f0000000640)=[{&(0x7f00000003c0)=""/132, 0x84}, {&(0x7f0000000480)=""/179, 0xb3}, {&(0x7f0000000540)=""/208, 0xd0}], 0x3, &(0x7f0000000700)=""/111, 0x6f}}, {{&(0x7f0000000780)=@pppol2tp, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000800)=""/201, 0xc9}, {&(0x7f0000000900)=""/145, 0x91}, {&(0x7f00000009c0)=""/247, 0xf7}, {&(0x7f0000000ac0)=""/83, 0x53}, {&(0x7f0000000b40)=""/6, 0x6}, {&(0x7f0000000b80)=""/172, 0xac}], 0x6, &(0x7f0000000cc0)=""/29, 0x1d}}, {{&(0x7f0000000d00)=@generic, 0x80, &(0x7f0000001f00)=[{&(0x7f0000000d80)=""/108, 0x6c}, {&(0x7f0000000e00)=""/134, 0x86}, {&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f0000001ec0)=""/43, 0x2b}], 0x4, &(0x7f0000001f40)=""/209, 0xd1}, 0x80000000}, {{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000002040)=""/128, 0x80}, {&(0x7f00000020c0)=""/17, 0x11}, {&(0x7f0000002100)=""/89, 0x59}, {&(0x7f0000002180)=""/143, 0x8f}], 0x4, &(0x7f0000002280)=""/111, 0x6f}, 0xffffffff}, {{&(0x7f0000002300)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000002480)=[{&(0x7f0000002380)=""/228, 0xe4}], 0x1, &(0x7f00000024c0)=""/243, 0xf3}, 0xfffffffb}], 0x6, 0x2180, 0x0) 1.410170633s ago: executing program 0 (id=1537): r0 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x1d, r2}, 0x10, &(0x7f0000000380)={&(0x7f0000000280)=@canfd={{0x3, 0x1}, 0x29, 0x0, 0x0, 0x0, "a689ea5aa85f645b262a63965fd956c9bb8902de66ab1fc91ce89ebb69bacde95b372fcd94b88fa304f638384892fcb1287e7385d6112eeef07dedeee7035c77"}, 0x48}, 0x1, 0x0, 0x0, 0x48840}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7c, 0x0, &(0x7f0000000300)="b8c1d1d54dec8a17f3cdefb6f9e98f07481ad404f5c560b035c97143b9930e68d4a2f2fe2d421ab0ce0f9978ca55eb72e50c356bb0985cb88bbe48f2c302c2692d676db5020c58125bf945bf75e0cf0ec592fe5b425a94b420a8f02921295e886d8e01a6e0386fc01be53902b6c7fd5ec8f3be2d8ea8fa5bb796141b", 0x2, 0x0, 0xb45}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) r3 = socket$can_raw(0x1d, 0x3, 0x1) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) r6 = socket(0x1, 0x2, 0x0) bind$unix(r6, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$SIOCGETMIFCNT_IN6(r6, 0x89e0, 0x0) bind$can_raw(r3, &(0x7f0000000480)={0x1d, r5}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x1d, r5}, 0x10, &(0x7f00000001c0)={&(0x7f0000000100)={0x7, 0x102, 0xee, {}, {0x77359400}, {0x2, 0x0, 0x0, 0x1}, 0x1, @canfd={{0x4, 0x0, 0x1}, 0x10, 0x2, 0x0, 0x0, "912d81eb0c039130b982ca68a7cbb6013e276addf1f3b753a22e6822b42650746fccc5193876bf13c02165139e5ba5480c57cf528a38bf8ca9984afed4041ce6"}}, 0x80}, 0x1, 0x0, 0x0, 0x24000014}, 0x40d2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000000000000000000a54000000090a010400000000000000000000000008000600000000000000020073797a31000000020900010073797a3000000800080005400000000c080003400000000808000740000000000800064000000000140000001000010000000000000000000084000a000000000000000000"], 0x7c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) read(r6, &(0x7f0000000540), 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_RT_KEY={0x8}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd4}}, 0x0) 1.409716665s ago: executing program 1 (id=1538): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x34, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r5, {}, {0xfff2, 0xffff}, {0xffff, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) (fail_nth: 5) 1.340669241s ago: executing program 3 (id=1539): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000440)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000100000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="25003300d0000000080211000001080211000000505050505050"], 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1.275971617s ago: executing program 0 (id=1540): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0x1802, 0x4) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfd, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8084) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="02000000040000000100000022"], 0x50) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r4, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) sendmsg$inet6(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000600)="e5f1fddfe175759743a2d6055bef6ad67f4806ff6ac3a93555c1b5b84294df29b09e92680ca8bd3dc842c3147716237f0ad0c3ab59f41083aeb894e76f", 0x3d}], 0x1}, 0x20000044) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb0100180000e3000000000c0000000c00000003000000020000000000000902000000006f00"], &(0x7f00000000c0)=""/57, 0x27, 0x39, 0x3, 0x2, 0x10000}, 0x28) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140), 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e0000000101000005000000fdffff1700010000", @ANYRES32=r3, @ANYBLOB="00000000000000000000000000372cb6a20f0000", @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0000000000000000000000000f00"/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r6, &(0x7f00000001c0), &(0x7f00000003c0)=@buf="f24619bd0208e903ad51fe90f3595f85d60c7bc8362e02d51bec8f047147c54a76dd000edef8f2e908", 0x1}, 0x20) r7 = socket(0x11, 0x800000003, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000007600090b000000000000000003000200000000000800050000000eb5"], 0x20}}, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x378, 0x160, 0x1170, 0x1398, 0x160, 0x1170, 0x2a8, 0x1398, 0x1398, 0x2a8, 0x1398, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x21}}, @common=@inet=@socket3={{0x28}, 0x5}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0x100, 0x148, 0x0, {}, [@common=@srh={{0x30}, {0x73, 0x5, 0x1, 0xe, 0x81, 0x420}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d8) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r10, 0x84, 0x66, &(0x7f0000000980)={r11, 0x9}, &(0x7f00000009c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f00000000c0)={r11, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2, 0x40000002, 0x0, 0xa17433da3c5d69a5, 0x2, 0x81}, 0x9c) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001a80)=@newqdisc={0x48, 0x24, 0xf0b, 0x3fff, 0x25dfdbfc, {0x0, 0x0, 0x12, r12, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000}]}}]}, 0x48}}, 0x4c094) 1.275704069s ago: executing program 4 (id=1541): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@ipv4_newrule={0x34, 0x20, 0x1, 0x0, 0x0, {0x2, 0x0, 0x14}, [@FRA_SRC={0x8, 0x2, @multicast2}, @FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e22, 0x4e24}}, @FRA_FLOW={0x8}]}, 0x34}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r3, 0x80, 0x7f, 0xa}, [@NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@ipv4_newrule={0x34, 0x20, 0x1, 0x0, 0x0, {0x2, 0x0, 0x14}, [@FRA_SRC={0x8, 0x2, @multicast2}, @FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e22, 0x4e24}}, @FRA_FLOW={0x8}]}, 0x34}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) (async) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r3, 0x80, 0x7f, 0xa}, [@NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) (async) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) (async) 934.373608ms ago: executing program 1 (id=1542): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff0100deffffff00000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 934.161897ms ago: executing program 3 (id=1543): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x40, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_TX_RATES={0x24, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x14, 0x1, [0x1, 0x18, 0x18, 0x2, 0xb, 0x4, 0x1b, 0x1, 0x4, 0x2, 0x48, 0x1, 0x30, 0x30, 0x2e, 0x12]}, @NL80211_TXRATE_HT={0x6, 0x2, [{}, {0x0, 0x5}]}]}]}]}, 0x40}}, 0x0) 933.86581ms ago: executing program 4 (id=1544): r0 = socket$kcm(0x2, 0xa, 0x2) (async) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, 0x0, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000200)=ANY=[@ANYBLOB="440000001000370400000000efffffff00000000", @ANYRES32=r4, @ANYBLOB="8704050044800000240012800b000100677265746170000014000280060010004e21000008000700ac"], 0x44}}, 0x20008884) (async) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000001c0)=[{{&(0x7f0000000240)={0xa, 0x4e22, 0x6, @local, 0xa}, 0x1c, 0x0}}], 0x1, 0x2008c0c0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {}, {0x5, 0xf}}}, 0x24}}, 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000400)={&(0x7f0000000080), 0xc, &(0x7f00000003c0)={&(0x7f0000000140)={0x40, r5, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r3}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xd}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xe5}]}, 0x40}}, 0x8840) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_dump={0x3e, 0x2, 0x5}}) 825.672645ms ago: executing program 4 (id=1545): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) syz_emit_ethernet(0x82, &(0x7f0000000240)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0x2000000, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@multicast1=0xe0000089}, {@private}, {@local}, {@remote}, {@private}, {@dev}, {@private}]}]}}}}}}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) write(r5, &(0x7f00000000c0)="240000001e005f0214f6fffffffffff8070000000000000000000000080001000d000000", 0x24) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYRES16=r1, @ANYRES8=r0, @ANYRES32=0x0, @ANYRES64=r0, @ANYRES64=r3, @ANYRES16=r0, @ANYRES16=r5], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) r6 = socket$vsock_stream(0x28, 0x1, 0x0) r7 = socket(0x15, 0x5, 0x0) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r8, 0x6, 0x25, &(0x7f0000000040), 0x4) sendto$x25(r7, &(0x7f0000000140)="d46b228498d3753b3afd1845983cfbdcabcb906814745048a937a3bde8a579760b1dec7f081920719d614823ac4990d90319306559d1fd77e40a8bd98b137a103a78c5a267f77a87f2cfbb74878818ef926feda913d9c2bb7a1c997149cbc5b1db6309d30d3de733be90a6a723a7d5633b93", 0x72, 0x44880, &(0x7f0000000080)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) getsockname$llc(r7, 0x0, &(0x7f00000002c0)) bind$vsock_stream(r6, &(0x7f0000000440), 0x10) connect$vsock_stream(r6, &(0x7f0000000000), 0x10) listen(r6, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) accept4$unix(r6, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00), 0x7fffffffffffd33, 0x20000890) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @remote}, 0x10) 740.174324ms ago: executing program 1 (id=1546): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000002c0)={r1, 0x3}, &(0x7f00000003c0)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r2, 0x2}, &(0x7f0000000500)=0x8) 739.943861ms ago: executing program 3 (id=1547): socket$igmp(0x2, 0x3, 0x2) write$tun(0xffffffffffffffff, &(0x7f0000000280)={@val={0x0, 0xa4122012acb6c684}, @void, @llc={@llc={0x4e, 0x7e, "fee2", "a8c174727accf0cee11d83746480be8546eeab4b718de5532ab09c92c68c4eb168e5d1e83484561a9917a0d5ceb78225daf747e17dcecd209ab019133997054ea301d5"}}}, 0x4b) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB], 0x6f4}}, 0x20000090) 646.399937ms ago: executing program 1 (id=1548): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) socket$nl_generic(0x10, 0x3, 0x10) socket(0x29, 0x5, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_procfs$namespace(0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) accept(r0, 0x0, &(0x7f0000000200)) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 539.566933ms ago: executing program 0 (id=1549): r0 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, 0x0, 0x20000000) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82000000000", @ANYRES32=r0, @ANYBLOB], 0x38}, 0x1, 0x300, 0x0, 0xc090}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00m'], 0x38}, 0x1, 0x300}, 0x0) 462.820068ms ago: executing program 0 (id=1550): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x510, 0x138, 0x210, 0x210, 0x3a8, 0x3a8, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x11001002, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@private=0xa010100, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x9, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570) 399.870924ms ago: executing program 3 (id=1551): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x5, 0x636d) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e21, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0xff}, 0x1c) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, r4, 0xcc071acbf25dbf8f, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000040)={'security\x00', 0x0, [0x8, 0x27b9758b, 0x5, 0x1034, 0x6]}, &(0x7f00000000c0)=0x54) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380), r3) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000200)=@name={0x1e, 0x2, 0x2, {{0x42, 0x4}}}, 0x10) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0x4}}, 0x10) sendmsg$tipc(r5, &(0x7f00000006c0)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20044094}, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000940)=ANY=[], 0xd0}, 0x1, 0x0, 0x0, 0x48018}, 0x800) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af1f5ac}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT={0x8}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) ioctl$INCFS_IOC_FILL_BLOCKS(r3, 0x80106720, &(0x7f0000000640)={0x6, &(0x7f0000000580)=[{0x2, 0xe3, &(0x7f0000000240)="32a04fa93be4d3e397686d70917eec572599a6abae31c7e6633affdc06932c304332d1f775516a77e60deb5bc9759de285f8153b61d241f8c48ff5893c0df330190b57c64b9a27764562731f090a9eb94ab2a35f6f44df073e98b17ac4296f91d691fdace0f162856c9145ffcea61fc326a22a39d465610764bdc8069e54578bfc190c3b91779317a212b5e24aecd357968a256fbf06d2bb96d2eb1e25c40c1f4d8689c47e56687fd6cefbdb8185dee7154d0a297a333604cfabbf30bf0d63bbd99a3ddb4bb7ebd66b3745c41acf37483fc3e33910420453b5fd635486bb23919ee09f", 0x1, 0x1}, {0x17c2315b, 0x5e, &(0x7f0000000100)="d2033531097afcf4fa84a6c32b63d0bf19175d5c34fd9eb4a214b2918b0d9628b5728686464e182efdcf425f6e73070408ea533a5339ae9eca824576628221df4d776a6d0cac9b8aea829cab0bf7c58ca6622bcc02090d2717dac4fcb2eb", 0x1, 0x1}, {0x0, 0x83, &(0x7f0000000880)="783b27cd3436ba5de22db36dc0e26133f1526dbb652da1d62ce13561b42144ca47ed23cdb2e86a9e683117069e3cf98b51248f7e5b1ee90a7fc2573124d7451d4f69216e53bbd2cf7875e47e94e2e3ca1a051905fb7c8de9bdf9a7bca1b82172d3b757e58fa1f8395452c98023283cb2e0c994f798d5f00e44a72296aa486c2b92ed17059b237596555ad6636a1a08b071fe24b7", 0x1, 0x1}, {0x412e, 0x1c7, &(0x7f0000000680)="af09032832a2e46877d3e4e90750b16c27f8e279fc38a7b305f5700f5bcb92922cc95a098bd3d5b163bcdb06203b1584baf7942355d94b474d384207bd23e9ea1fce16c96058d99468d39cc2078615804316456d05b2b98dc1555ee54162a39ae7efd77f2363150d38947eef5a41754d959be613ce2f03e788673bacaafe27945f4c5b3509a275c76f13bcc7c48da8c698bd41fc8ba5a14f8ee24550f43a4165709e04270856cc5e82dd570912b541f1f459003769c3ed4286bd0b561e4b879ea7089713bef58f61f79a2275420bb48a77494cc89b20bf6fb2d20a95e27202deca6d72fcb623ada1b8929573ff1da0e6c314422b36ae3bed790e57dabd688207af4b8366c176540a1e5f536b63e0e4b9fce4ffb3b2b87107c7a941ecf61120bff055011f26ad921c351031d2dc707d426e6dc5db1ea7dfb2c6f095f91986bdcd6255f425113ac6d8d969def69865461c98fe58c515a1aad932b398811fbe330939b39cf810ba780f98bc7d0da031b32057b2a724dd2988e65b73a2a73018adfaca20b158918b33a271d5730570d38903edd09820fdf859549ef817582c2ee55a02682de267e7bf0470edb85b15feb49be0bf4c24f3e9d543877c5b9e9c924cb10cfbb79cea3a6f", 0x0, 0x1}, {0x4, 0xf6, &(0x7f0000000440)="31e4821a08bce20a7da2eeef4a10dfce05ee4303968529529a24c3b170813cb2b8804facf1469a2a79156cfed48e35210e4f0a4a7a13a5edcf47700ddd06c11d4a7ef6e398491ce5e1357adc7526aa3bc9e68e256084643533ccabd76059162fa23fb9b2da4a9c16f385c30b7c1956eef55ecf813d6fcce9d620019687029d642988c4ca74fa90931b24248e01d3e817e442604f06e22b74d4455086975e04ca23acade49cd2f6761e837a377520ec2df550c5516bd5bcb59fcfc982dc4ad9e2c2c465da3247056a4f3ee729bf0323c0e882b6a3e05f28e970712f47cd1f92d5b1b82a77fc213a1efce82525064079c98a78a3f1d88d"}, {0x8, 0xf, &(0x7f0000000540)="5a8bf7523f99f3ebb1557520fba76e", 0x0, 0x1}]}) r6 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r6, 0x0, 0x48c, &(0x7f0000000080)={0x1, 'veth1_to_hsr\x00', 0x4}, 0x18) getsockname$inet6(r1, &(0x7f0000001000)={0xa, 0x0, 0x0, @local}, &(0x7f0000001040)=0x1c) preadv(r3, &(0x7f0000000f80)=[{&(0x7f0000000a40)=""/210, 0xd2}, {&(0x7f0000000b40)=""/238, 0xee}, {0xffffffffffffffff}, {&(0x7f0000000c40)=""/205, 0xcd}, {&(0x7f0000000d40)=""/26, 0x1a}, {&(0x7f0000000d80)=""/132, 0x84}, {&(0x7f0000000e40)=""/101, 0x65}, {&(0x7f0000000ec0)=""/149, 0x95}], 0x8, 0x0, 0x0) 399.631611ms ago: executing program 4 (id=1552): r0 = socket(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x620, 0x2c8, 0x1d0, 0x468, 0x468, 0x1d0, 0x550, 0x550, 0x550, 0x550, 0x550, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [0x0, 0x0, 0x6804], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'macvlan1\x00', {}, {}, 0x2b}, 0x0, 0xd0, 0xf8, 0x7400, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x1, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680) 399.382165ms ago: executing program 2 (id=1553): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x5, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x14, 0x3a, 0x229, 0x0, 0x25dfdbfc, {0xa}}, 0x14}}, 0x8000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 395.094742ms ago: executing program 0 (id=1554): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@delchain={0x34, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r5, {}, {0xfff2, 0xffff}, {0xffff, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) (fail_nth: 6) 290.861832ms ago: executing program 4 (id=1555): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000200a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003"], 0xfc}}, 0x0) 204.31785ms ago: executing program 3 (id=1556): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) 169.503309ms ago: executing program 0 (id=1557): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x1d, &(0x7f0000000000), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f0000000100)=0xe, 0x80800) getsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0xc) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$SMC_PNETID_ADD(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010027bd7068dad3df2501000000090001"], 0x34}, 0x1, 0x0, 0x0, 0x44004}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x20, 0x3, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x8}]}]}, 0x20}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1d}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xd0}}, 0x0) 105.84981ms ago: executing program 3 (id=1558): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20008003}, 0x8800) 0s ago: executing program 4 (id=1559): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000880), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb01001800004a664f3a001400000014002d2446a8a3a18100000200c5569069000000000000000000000060ba163fd76fa799829fa1f83c67f59e3423548884b1a7231ccc5ac31f700c0f9f2f4748"], &(0x7f00000005c0)=""/96, 0x2e, 0x60, 0x1}, 0x1e) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)}, &(0x7f0000000180)=0x10) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000540)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0101000000000000000004000000300001801400030000000000000000000000000000000000000000060001000a00"/62], 0x44}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200008000000000000000000000060000000000", @ANYRES32=0x1, @ANYBLOB="bc9000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000010000000400"/28], 0x50) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000080)={'ip_vti0\x00', 0x0, 0x40, 0x40, 0x4ffff, 0x7, {{0x7, 0x4, 0x3, 0x7, 0x1c, 0x67, 0x0, 0xf6, 0x4, 0x0, @local, @local, {[@generic={0x86, 0x8, "248a13d9971a"}]}}}}}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r3, &(0x7f0000000280), 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x1) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000100)=""/120, 0x78}], 0x1, 0x4, 0x0) close(r3) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) socket$inet6(0xa, 0x2, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x0, 0xb870cb50772e38c8}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) kernel console output (not intermixed with test programs): promiscuous mode [ 71.184863][ T5836] hsr_slave_1: entered promiscuous mode [ 71.191150][ T5836] debugfs: 'hsr0' already exists in 'hsr' [ 71.196934][ T5836] Cannot create hsr debugfs directory [ 71.203220][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.210397][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.236613][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.248315][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.255264][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.282189][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.392142][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.398648][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.440972][ T5823] hsr_slave_0: entered promiscuous mode [ 71.447261][ T5823] hsr_slave_1: entered promiscuous mode [ 71.453656][ T5823] debugfs: 'hsr0' already exists in 'hsr' [ 71.459522][ T5823] Cannot create hsr debugfs directory [ 71.571362][ T5825] hsr_slave_0: entered promiscuous mode [ 71.577779][ T5825] hsr_slave_1: entered promiscuous mode [ 71.583887][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 71.589692][ T5825] Cannot create hsr debugfs directory [ 71.950351][ T5832] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.964217][ T5832] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.975971][ T5832] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.996749][ T5832] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.059984][ T5822] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.070578][ T5822] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.099154][ T5822] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.112378][ T5822] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.198451][ T5836] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 72.208973][ T5836] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 72.239188][ T5836] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 72.249247][ T5836] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 72.327087][ T5823] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.340868][ T5823] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.371025][ T5823] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.381229][ T5823] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 72.433446][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.454698][ T5825] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 72.477586][ T5825] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 72.488065][ T5825] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 72.498479][ T5825] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 72.557332][ T5832] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.578495][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.592932][ T4945] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.600280][ T4945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.642510][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.653881][ T4945] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.661022][ T4945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.739583][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.746759][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.747522][ T5837] Bluetooth: hci1: command tx timeout [ 72.788683][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.795905][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.827183][ T5837] Bluetooth: hci0: command tx timeout [ 72.828398][ T5840] Bluetooth: hci3: command tx timeout [ 72.832625][ T5837] Bluetooth: hci2: command tx timeout [ 72.838244][ T52] Bluetooth: hci4: command tx timeout [ 72.854025][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.891276][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.913716][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.963075][ T1095] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.970290][ T1095] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.998291][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.018005][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.025184][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.052817][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.077796][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.084960][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.121612][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.128797][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.184340][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.209929][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.242328][ T3507] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.249536][ T3507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.281514][ T3507] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.288721][ T3507] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.492160][ T5823] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.527701][ T5832] veth0_vlan: entered promiscuous mode [ 73.574285][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.631579][ T5832] veth1_vlan: entered promiscuous mode [ 73.789409][ T5832] veth0_macvtap: entered promiscuous mode [ 73.817845][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.859237][ T5832] veth1_macvtap: entered promiscuous mode [ 73.888090][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.945243][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.984444][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.999078][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.034859][ T4945] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.049401][ T5825] veth0_vlan: entered promiscuous mode [ 74.069405][ T4945] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.078778][ T4945] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.101223][ T4945] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.124958][ T5825] veth1_vlan: entered promiscuous mode [ 74.164240][ T5836] veth0_vlan: entered promiscuous mode [ 74.212645][ T5836] veth1_vlan: entered promiscuous mode [ 74.235651][ T5825] veth0_macvtap: entered promiscuous mode [ 74.271295][ T5822] veth0_vlan: entered promiscuous mode [ 74.281159][ T5823] veth0_vlan: entered promiscuous mode [ 74.298499][ T5825] veth1_macvtap: entered promiscuous mode [ 74.317133][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.330258][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.344160][ T5822] veth1_vlan: entered promiscuous mode [ 74.358690][ T5823] veth1_vlan: entered promiscuous mode [ 74.397590][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.407776][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.416127][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.419676][ T5836] veth0_macvtap: entered promiscuous mode [ 74.451267][ T5836] veth1_macvtap: entered promiscuous mode [ 74.460427][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.493223][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.503266][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.538536][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.548069][ T5832] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 74.562160][ T5822] veth0_macvtap: entered promiscuous mode [ 74.570721][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.582669][ T5823] veth0_macvtap: entered promiscuous mode [ 74.602451][ T5822] veth1_macvtap: entered promiscuous mode [ 74.610497][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.623441][ T5823] veth1_macvtap: entered promiscuous mode [ 74.653349][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.700703][ T3507] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.712017][ T3507] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.742333][ T3507] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.751484][ T3507] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.773272][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.794030][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.797948][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.813128][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.828253][ T52] Bluetooth: hci1: command tx timeout [ 74.838845][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.862561][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.889488][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.899335][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.908955][ T52] Bluetooth: hci2: command tx timeout [ 74.916716][ T52] Bluetooth: hci4: command tx timeout [ 74.916740][ T5827] Bluetooth: hci0: command tx timeout [ 74.927697][ T5837] Bluetooth: hci3: command tx timeout [ 74.948612][ T5941] warning: `syz.0.6' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 74.965077][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.983369][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.997670][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.050961][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.091381][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.101802][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.159828][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.187566][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.243066][ T1095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.281553][ T1095] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.320904][ T5951] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 75.334318][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.349227][ T5951] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4'. [ 75.377548][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.457439][ T1095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.467685][ T1095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.474580][ T5953] netlink: 'syz.3.4': attribute type 10 has an invalid length. [ 75.511278][ T5953] veth0_virt_wifi: entered allmulticast mode [ 75.538128][ T5953] team0: Port device veth0_virt_wifi added [ 75.559337][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.578047][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.656041][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.694646][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.733537][ T5960] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 75.768931][ T1095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.809035][ T1095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.833967][ T5962] syzkaller0: entered promiscuous mode [ 75.850323][ T5962] syzkaller0: entered allmulticast mode [ 75.855138][ T5964] netlink: 'syz.3.12': attribute type 1 has an invalid length. [ 75.897171][ T5964] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12'. [ 76.118611][ T5973] netlink: 'syz.0.14': attribute type 1 has an invalid length. [ 76.151306][ T5973] netlink: 'syz.0.14': attribute type 3 has an invalid length. [ 76.197625][ T5973] netlink: 224 bytes leftover after parsing attributes in process `syz.0.14'. [ 76.374546][ T5984] FAULT_INJECTION: forcing a failure. [ 76.374546][ T5984] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 76.418624][ T5984] CPU: 0 UID: 0 PID: 5984 Comm: syz.3.18 Not tainted syzkaller #0 PREEMPT(full) [ 76.418646][ T5984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 76.418661][ T5984] Call Trace: [ 76.418668][ T5984] [ 76.418674][ T5984] dump_stack_lvl+0x189/0x250 [ 76.418705][ T5984] ? __pfx____ratelimit+0x10/0x10 [ 76.418724][ T5984] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.418743][ T5984] ? __pfx__printk+0x10/0x10 [ 76.418757][ T5984] ? __might_fault+0xb0/0x130 [ 76.418788][ T5984] should_fail_ex+0x414/0x560 [ 76.418813][ T5984] _copy_from_user+0x2d/0xb0 [ 76.418834][ T5984] ___sys_sendmsg+0x158/0x2a0 [ 76.418855][ T5984] ? __pfx____sys_sendmsg+0x10/0x10 [ 76.418902][ T5984] ? __fget_files+0x2a/0x420 [ 76.418916][ T5984] ? __fget_files+0x3a0/0x420 [ 76.418941][ T5984] __x64_sys_sendmsg+0x19b/0x260 [ 76.418960][ T5984] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 76.418985][ T5984] ? __pfx_ksys_write+0x10/0x10 [ 76.419009][ T5984] ? do_syscall_64+0xbe/0xfa0 [ 76.419034][ T5984] do_syscall_64+0xfa/0xfa0 [ 76.419051][ T5984] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.419082][ T5984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.419098][ T5984] ? clear_bhb_loop+0x60/0xb0 [ 76.419117][ T5984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.419132][ T5984] RIP: 0033:0x7f2e1938f6c9 [ 76.419155][ T5984] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.419168][ T5984] RSP: 002b:00007f2e1a313038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 76.419185][ T5984] RAX: ffffffffffffffda RBX: 00007f2e195e5fa0 RCX: 00007f2e1938f6c9 [ 76.419197][ T5984] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000004 [ 76.419207][ T5984] RBP: 00007f2e1a313090 R08: 0000000000000000 R09: 0000000000000000 [ 76.419217][ T5984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 76.419227][ T5984] R13: 00007f2e195e6038 R14: 00007f2e195e5fa0 R15: 00007ffdd06f79f8 [ 76.419254][ T5984] [ 76.751313][ T5995] netlink: 40 bytes leftover after parsing attributes in process `syz.3.23'. [ 76.790767][ T5988] syzkaller0: entered promiscuous mode [ 76.801875][ T5988] syzkaller0: entered allmulticast mode [ 76.842910][ T6000] netlink: 24 bytes leftover after parsing attributes in process `syz.0.24'. [ 76.882812][ T6000] xt_hashlimit: size too large, truncated to 1048576 [ 76.917729][ T5837] Bluetooth: hci1: command tx timeout [ 76.934379][ T5996] pim6reg1: entered promiscuous mode [ 76.950426][ T5996] pim6reg1: entered allmulticast mode [ 76.964641][ T6003] netlink: 2 bytes leftover after parsing attributes in process `syz.3.25'. [ 76.987398][ T5837] Bluetooth: hci3: command tx timeout [ 76.990415][ T5827] Bluetooth: hci0: command tx timeout [ 76.995418][ T5837] Bluetooth: hci4: command tx timeout [ 76.998397][ T5827] Bluetooth: hci2: command tx timeout [ 77.142798][ T6013] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 77.435065][ T6022] netlink: 24 bytes leftover after parsing attributes in process `syz.2.31'. [ 77.504719][ T6025] netlink: 24 bytes leftover after parsing attributes in process `syz.2.31'. [ 77.554696][ T6030] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 77.582522][ T6032] netlink: 40 bytes leftover after parsing attributes in process `syz.3.35'. [ 77.997102][ T6048] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 78.105119][ T6057] netem: change failed [ 78.168270][ T6048] netlink: 12 bytes leftover after parsing attributes in process `syz.0.40'. [ 78.205532][ T6048] xfrm1: entered promiscuous mode [ 78.216193][ T6048] xfrm1: entered allmulticast mode [ 78.258450][ T6060] syzkaller0: entered promiscuous mode [ 78.263977][ T6060] syzkaller0: entered allmulticast mode [ 78.447686][ T6070] Zero length message leads to an empty skb [ 78.615755][ T6080] syzkaller1: entered promiscuous mode [ 78.638297][ T6080] syzkaller1: entered allmulticast mode [ 78.819804][ T4945] nci: nci_rx_work: unknown MT 0x1 [ 78.828178][ T6100] vcan0: entered allmulticast mode [ 79.272100][ T6118] syzkaller0: entered promiscuous mode [ 79.280253][ T6118] syzkaller0: entered allmulticast mode [ 79.333165][ T6125] FAULT_INJECTION: forcing a failure. [ 79.333165][ T6125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.347474][ T6125] CPU: 1 UID: 0 PID: 6125 Comm: syz.1.65 Not tainted syzkaller #0 PREEMPT(full) [ 79.347500][ T6125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 79.347509][ T6125] Call Trace: [ 79.347516][ T6125] [ 79.347524][ T6125] dump_stack_lvl+0x189/0x250 [ 79.347550][ T6125] ? __pfx____ratelimit+0x10/0x10 [ 79.347571][ T6125] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.347592][ T6125] ? __pfx__printk+0x10/0x10 [ 79.347610][ T6125] ? __might_fault+0xb0/0x130 [ 79.347644][ T6125] should_fail_ex+0x414/0x560 [ 79.347673][ T6125] _copy_from_iter+0x1de/0x1790 [ 79.347698][ T6125] ? rcu_is_watching+0x15/0xb0 [ 79.347721][ T6125] ? kmalloc_reserve+0xbd/0x290 [ 79.347738][ T6125] ? __pfx__copy_from_iter+0x10/0x10 [ 79.347756][ T6125] ? __build_skb_around+0x262/0x3f0 [ 79.347782][ T6125] ? netlink_sendmsg+0x642/0xb30 [ 79.347797][ T6125] ? skb_put+0x11b/0x210 [ 79.347815][ T6125] netlink_sendmsg+0x6b2/0xb30 [ 79.347841][ T6125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.347861][ T6125] ? aa_sock_msg_perm+0xf1/0x1d0 [ 79.347885][ T6125] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 79.347902][ T6125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.347918][ T6125] __sock_sendmsg+0x21c/0x270 [ 79.347939][ T6125] ____sys_sendmsg+0x505/0x830 [ 79.347961][ T6125] ? __pfx_____sys_sendmsg+0x10/0x10 [ 79.347986][ T6125] ? import_iovec+0x74/0xa0 [ 79.348007][ T6125] ___sys_sendmsg+0x21f/0x2a0 [ 79.348026][ T6125] ? __pfx____sys_sendmsg+0x10/0x10 [ 79.348076][ T6125] ? __fget_files+0x2a/0x420 [ 79.348091][ T6125] ? __fget_files+0x3a0/0x420 [ 79.348122][ T6125] __x64_sys_sendmsg+0x19b/0x260 [ 79.348143][ T6125] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 79.348171][ T6125] ? __pfx_ksys_write+0x10/0x10 [ 79.348196][ T6125] ? do_syscall_64+0xbe/0xfa0 [ 79.348221][ T6125] do_syscall_64+0xfa/0xfa0 [ 79.348239][ T6125] ? lockdep_hardirqs_on+0x9c/0x150 [ 79.348260][ T6125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.348277][ T6125] ? clear_bhb_loop+0x60/0xb0 [ 79.348298][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.348313][ T6125] RIP: 0033:0x7f9ed6b8f6c9 [ 79.348329][ T6125] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.348342][ T6125] RSP: 002b:00007f9ed7a16038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.348360][ T6125] RAX: ffffffffffffffda RBX: 00007f9ed6de6090 RCX: 00007f9ed6b8f6c9 [ 79.348372][ T6125] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000004 [ 79.348381][ T6125] RBP: 00007f9ed7a16090 R08: 0000000000000000 R09: 0000000000000000 [ 79.348390][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.348399][ T6125] R13: 00007f9ed6de6128 R14: 00007f9ed6de6090 R15: 00007ffd240ae618 [ 79.348428][ T6125] [ 79.845704][ T6133] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 79.863035][ T6134] openvswitch: netlink: IP tunnel dst address not specified [ 79.883442][ T6136] netlink: 'syz.0.71': attribute type 10 has an invalid length. [ 79.892136][ T6136] bridge0: port 3(team0) entered blocking state [ 79.898843][ T6136] bridge0: port 3(team0) entered disabled state [ 79.905388][ T6136] team0: entered allmulticast mode [ 79.911254][ T6136] team_slave_0: entered allmulticast mode [ 79.917252][ T6136] team_slave_1: entered allmulticast mode [ 79.925266][ T6136] team0: entered promiscuous mode [ 79.930381][ T6136] team_slave_0: entered promiscuous mode [ 79.937118][ T6136] team_slave_1: entered promiscuous mode [ 79.943711][ T6136] bridge0: port 3(team0) entered blocking state [ 79.950287][ T6136] bridge0: port 3(team0) entered forwarding state [ 80.071733][ T6151] netlink: 'syz.2.72': attribute type 2 has an invalid length. [ 80.079651][ T6150] netlink: 'syz.2.72': attribute type 2 has an invalid length. [ 80.401315][ T6169] __nla_validate_parse: 11 callbacks suppressed [ 80.401332][ T6169] netlink: 48 bytes leftover after parsing attributes in process `syz.0.77'. [ 80.448277][ T6163] tc_dump_action: action bad kind [ 80.690432][ T6178] netlink: 40 bytes leftover after parsing attributes in process `syz.3.80'. [ 80.754673][ T6183] netlink: 60 bytes leftover after parsing attributes in process `syz.0.82'. [ 80.963409][ T6195] netlink: 40 bytes leftover after parsing attributes in process `syz.4.87'. [ 81.142542][ T6203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.90'. [ 81.204132][ T6209] netlink: 4 bytes leftover after parsing attributes in process `syz.2.92'. [ 81.243278][ T6209] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 81.266162][ T6209] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 81.360877][ T6215] netlink: 'syz.3.93': attribute type 9 has an invalid length. [ 81.377953][ T6218] netlink: 'syz.3.93': attribute type 9 has an invalid length. [ 81.388190][ T6215] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.93'. [ 81.416367][ T6218] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.93'. [ 81.646677][ T6230] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 81.752742][ T6241] netlink: 40 bytes leftover after parsing attributes in process `syz.4.100'. [ 81.777295][ T6240] netlink: 36 bytes leftover after parsing attributes in process `syz.2.97'. [ 83.032139][ T6264] syz_tun: entered allmulticast mode [ 83.050272][ T6255] syz_tun: left allmulticast mode [ 83.350415][ T6285] tipc: Trying to set illegal importance in message [ 83.879351][ T3507] nci: nci_rsp_packet: unknown rsp opcode 0x123 [ 84.864998][ T6309] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 84.889399][ T6321] syzkaller0: entered promiscuous mode [ 84.895006][ T6321] syzkaller0: entered allmulticast mode [ 85.033802][ T6346] lo: entered promiscuous mode [ 85.044383][ T6346] netlink: 'syz.4.127': attribute type 2 has an invalid length. [ 85.073682][ T6346] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 85.707190][ T6383] netlink: 'syz.3.140': attribute type 1 has an invalid length. [ 85.740224][ T6386] __nla_validate_parse: 12 callbacks suppressed [ 85.740242][ T6386] netlink: 4 bytes leftover after parsing attributes in process `syz.2.141'. [ 85.809252][ T6387] bond1: (slave bridge2): making interface the new active one [ 85.820011][ T6387] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 86.456219][ T6419] netlink: 40 bytes leftover after parsing attributes in process `syz.2.151'. [ 86.560013][ T6421] netlink: 'syz.2.152': attribute type 83 has an invalid length. [ 86.759267][ T10] cfg80211: failed to load regulatory.db [ 87.110354][ T6393] macvtap1: entered promiscuous mode [ 87.115766][ T6393] macvtap1: entered allmulticast mode [ 87.276324][ T6428] netlink: 4 bytes leftover after parsing attributes in process `syz.4.153'. [ 87.321312][ T6430] sch_fq: defrate 0 ignored. [ 87.556031][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.564094][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.572057][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.579997][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.587947][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.595914][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.603821][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.611787][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.619840][ T6446] ICMPv6: RA: ndisc_router_discovery failed to add default route [ 87.678688][ T6450] netlink: 40 bytes leftover after parsing attributes in process `syz.2.162'. [ 87.862090][ T6466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.166'. [ 87.965741][ T6475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.168'. [ 88.045561][ T6482] netlink: 32 bytes leftover after parsing attributes in process `syz.4.170'. [ 89.093501][ T6496] syzkaller0: entered promiscuous mode [ 89.110860][ T6496] syzkaller0: entered allmulticast mode [ 89.248869][ T6514] xt_ecn: cannot match TCP bits for non-tcp packets [ 89.273738][ T6512] netlink: 8 bytes leftover after parsing attributes in process `syz.3.176'. [ 89.425242][ T6517] netlink: 28 bytes leftover after parsing attributes in process `syz.4.178'. [ 89.442863][ T6522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.178'. [ 89.801973][ T6546] netlink: 'syz.2.188': attribute type 1 has an invalid length. [ 89.856908][ T6546] bond1: (slave gretap1): making interface the new active one [ 89.869747][ T6546] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 91.109810][ T6569] __nla_validate_parse: 2 callbacks suppressed [ 91.109828][ T6569] netlink: 40 bytes leftover after parsing attributes in process `syz.2.192'. [ 91.135412][ T6561] syzkaller0: entered promiscuous mode [ 91.142581][ T6561] syzkaller0: entered allmulticast mode [ 91.179682][ T6571] netlink: 'syz.4.193': attribute type 1 has an invalid length. [ 91.237116][ T6572] netlink: 4 bytes leftover after parsing attributes in process `syz.4.193'. [ 91.285277][ T6576] trusted_key: syz.0.195 sent an empty control message without MSG_MORE. [ 91.298466][ T6571] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 91.302754][ T6576] netlink: 8 bytes leftover after parsing attributes in process `syz.0.195'. [ 91.368926][ T6576] netlink: 80 bytes leftover after parsing attributes in process `syz.0.195'. [ 91.525253][ T6596] veth0: entered promiscuous mode [ 91.543348][ T6588] Illegal XDP return value 4294967274 on prog (id 39) dev syz_tun, expect packet loss! [ 91.559961][ T6596] netlink: 4 bytes leftover after parsing attributes in process `syz.1.199'. [ 91.753290][ T6604] netlink: 60 bytes leftover after parsing attributes in process `syz.0.203'. [ 92.098624][ T6615] bridge: RTM_NEWNEIGH with invalid ether address [ 92.151676][ T6620] tipc: Started in network mode [ 92.164025][ T6620] tipc: Node identity b230370b5b69, cluster identity 4711 [ 92.184761][ T6620] tipc: Enabled bearer , priority 0 [ 92.226100][ T6618] syzkaller0: entered promiscuous mode [ 92.245648][ T6618] syzkaller0: entered allmulticast mode [ 92.295666][ T6618] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 92.328190][ T6628] syzkaller0: entered promiscuous mode [ 92.345770][ T6628] syzkaller0: entered allmulticast mode [ 92.380310][ T6620] tipc: Resetting bearer [ 92.421556][ T6620] tipc: Disabling bearer [ 92.529767][ T6631] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 92.851074][ T6648] netlink: 40 bytes leftover after parsing attributes in process `syz.4.216'. [ 93.074714][ T6661] netlink: 496 bytes leftover after parsing attributes in process `syz.4.221'. [ 93.152026][ T5827] block nbd0: Receive control failed (result -32) [ 93.379483][ T6675] syzkaller0: entered promiscuous mode [ 93.426408][ T6675] syzkaller0: entered allmulticast mode [ 93.514359][ T6685] netlink: 24 bytes leftover after parsing attributes in process `syz.0.229'. [ 93.568310][ T6690] netlink: 'syz.3.230': attribute type 4 has an invalid length. [ 93.898630][ T6708] macvtap1: entered promiscuous mode [ 93.934080][ T6708] macvtap1: entered allmulticast mode [ 94.180842][ T6724] netlink: 60 bytes leftover after parsing attributes in process `syz.0.242'. [ 94.357442][ T6726] syzkaller0: entered promiscuous mode [ 94.362995][ T6726] syzkaller0: entered allmulticast mode [ 94.678319][ T6745] netlink: 'syz.2.248': attribute type 2 has an invalid length. [ 94.719863][ T6745] 9: entered promiscuous mode [ 94.780665][ T6751] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 94.887061][ T6754] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-tlb(5) [ 94.970535][ T6754] bond1 (unregistering): Released all slaves [ 95.172743][ T6770] net_ratelimit: 46 callbacks suppressed [ 95.172761][ T6770] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.547273][ T6781] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.718437][ T6795] netlink: 'syz.0.263': attribute type 10 has an invalid length. [ 95.885663][ T6809] netlink: 'syz.4.265': attribute type 3 has an invalid length. [ 95.938051][ T6814] netlink: 'syz.4.265': attribute type 15 has an invalid length. [ 95.983868][ T6816] netlink: 'syz.0.267': attribute type 142 has an invalid length. [ 96.013899][ T6816] netlink: 'syz.0.267': attribute type 1 has an invalid length. [ 96.136210][ T6822] __nla_validate_parse: 7 callbacks suppressed [ 96.136226][ T6822] netlink: 60 bytes leftover after parsing attributes in process `syz.1.269'. [ 96.254245][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.289184][ T12] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.325649][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.347146][ T12] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.401290][ T6834] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 96.429778][ T6839] netlink: 256 bytes leftover after parsing attributes in process `syz.0.272'. [ 96.439142][ T6839] netlink: 'syz.0.272': attribute type 9 has an invalid length. [ 96.467644][ T6841] netlink: 24 bytes leftover after parsing attributes in process `syz.4.275'. [ 96.572877][ T6844] netlink: 40 bytes leftover after parsing attributes in process `syz.3.277'. [ 96.656682][ T6852] syzkaller0: entered promiscuous mode [ 96.665483][ T6852] syzkaller0: entered allmulticast mode [ 96.789605][ T6864] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 96.792071][ T6856] syzkaller0: entered promiscuous mode [ 96.804432][ T6856] syzkaller0: entered allmulticast mode [ 96.861496][ T6855] tipc: Enabled bearer , priority 0 [ 96.981350][ T6855] tipc: Resetting bearer [ 97.162169][ T6885] FAULT_INJECTION: forcing a failure. [ 97.162169][ T6885] name failslab, interval 1, probability 0, space 0, times 0 [ 97.185409][ T6885] CPU: 1 UID: 0 PID: 6885 Comm: syz.3.289 Not tainted syzkaller #0 PREEMPT(full) [ 97.185433][ T6885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 97.185442][ T6885] Call Trace: [ 97.185450][ T6885] [ 97.185457][ T6885] dump_stack_lvl+0x189/0x250 [ 97.185485][ T6885] ? __pfx____ratelimit+0x10/0x10 [ 97.185506][ T6885] ? __pfx_dump_stack_lvl+0x10/0x10 [ 97.185528][ T6885] ? __pfx__printk+0x10/0x10 [ 97.185552][ T6885] ? __pfx___might_resched+0x10/0x10 [ 97.185568][ T6885] ? fs_reclaim_acquire+0x7d/0x100 [ 97.185597][ T6885] should_fail_ex+0x414/0x560 [ 97.185624][ T6885] should_failslab+0xa8/0x100 [ 97.185642][ T6885] kmem_cache_alloc_node_noprof+0x77/0x710 [ 97.185665][ T6885] ? __alloc_skb+0x112/0x2d0 [ 97.185687][ T6885] __alloc_skb+0x112/0x2d0 [ 97.185706][ T6885] alloc_skb_with_frags+0xca/0x890 [ 97.185731][ T6885] ? apparmor_capable+0x137/0x1b0 [ 97.185752][ T6885] sock_alloc_send_pskb+0x84d/0x980 [ 97.185789][ T6885] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 97.185810][ T6885] ? sock_omalloc+0x126/0x1e0 [ 97.185828][ T6885] ? msg_zerocopy_realloc+0x2b3/0x850 [ 97.185846][ T6885] ? is_bpf_text_address+0x292/0x2b0 [ 97.185869][ T6885] ? is_bpf_text_address+0x26/0x2b0 [ 97.185889][ T6885] __ip6_append_data+0x2b43/0x3f30 [ 97.185936][ T6885] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 97.185957][ T6885] ? __ip6_append_data+0xe31/0x3f30 [ 97.185997][ T6885] ? __pfx___ip6_append_data+0x10/0x10 [ 97.186020][ T6885] ? ip6_setup_cork+0xa1c/0x10e0 [ 97.186045][ T6885] ip6_make_skb+0x2ce/0x410 [ 97.186067][ T6885] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 97.186092][ T6885] ? __pfx_ip6_make_skb+0x10/0x10 [ 97.186128][ T6885] ? ip6_dst_hoplimit+0x65/0x3e0 [ 97.186146][ T6885] ? ip6_dst_hoplimit+0x65/0x3e0 [ 97.186168][ T6885] udpv6_sendmsg+0x1d1a/0x2510 [ 97.186201][ T6885] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 97.186228][ T6885] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 97.186256][ T6885] ? __pfx___might_resched+0x10/0x10 [ 97.186292][ T6885] ? aa_sk_perm+0x81e/0x950 [ 97.186328][ T6885] ? inet_send_prepare+0x5c/0x270 [ 97.186348][ T6885] ? inet6_sendmsg+0xe4/0x120 [ 97.186369][ T6885] __sock_sendmsg+0xe5/0x270 [ 97.186395][ T6885] ____sys_sendmsg+0x52d/0x830 [ 97.186419][ T6885] ? __pfx_____sys_sendmsg+0x10/0x10 [ 97.186447][ T6885] ? import_iovec+0x74/0xa0 [ 97.186471][ T6885] ___sys_sendmsg+0x21f/0x2a0 [ 97.186492][ T6885] ? __pfx____sys_sendmsg+0x10/0x10 [ 97.186546][ T6885] ? __fget_files+0x2a/0x420 [ 97.186562][ T6885] ? __fget_files+0x3a0/0x420 [ 97.186589][ T6885] __sys_sendmmsg+0x227/0x430 [ 97.186611][ T6885] ? __pfx___sys_sendmmsg+0x10/0x10 [ 97.186639][ T6885] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 97.186681][ T6885] ? ksys_write+0x22a/0x250 [ 97.186705][ T6885] ? __pfx_ksys_write+0x10/0x10 [ 97.186733][ T6885] __x64_sys_sendmmsg+0xa0/0xc0 [ 97.186754][ T6885] do_syscall_64+0xfa/0xfa0 [ 97.186775][ T6885] ? lockdep_hardirqs_on+0x9c/0x150 [ 97.186797][ T6885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.186814][ T6885] ? clear_bhb_loop+0x60/0xb0 [ 97.186834][ T6885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.186850][ T6885] RIP: 0033:0x7f2e1938f6c9 [ 97.186872][ T6885] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 97.186885][ T6885] RSP: 002b:00007f2e1a313038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 97.186904][ T6885] RAX: ffffffffffffffda RBX: 00007f2e195e5fa0 RCX: 00007f2e1938f6c9 [ 97.186917][ T6885] RDX: 0400000000000172 RSI: 0000200000003cc0 RDI: 0000000000000003 [ 97.186928][ T6885] RBP: 00007f2e1a313090 R08: 0000000000000000 R09: 0000000000000000 [ 97.186938][ T6885] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.186949][ T6885] R13: 00007f2e195e6038 R14: 00007f2e195e5fa0 R15: 00007ffdd06f79f8 [ 97.186979][ T6885] [ 97.636025][ T6892] netlink: 'syz.3.291': attribute type 27 has an invalid length. [ 97.979301][ T48] tipc: Node number set to 3914938123 [ 98.332091][ T6855] tipc: Disabling bearer [ 98.343890][ T6882] tipc: Enabling of bearer rejected, failed to enable media [ 98.458608][ T6901] netlink: 24 bytes leftover after parsing attributes in process `syz.0.292'. [ 98.499630][ T6904] netlink: 44 bytes leftover after parsing attributes in process `syz.1.295'. [ 98.698009][ T6919] syzkaller0: entered promiscuous mode [ 98.706932][ T6919] syzkaller0: entered allmulticast mode [ 98.975437][ T6927] netlink: 14544 bytes leftover after parsing attributes in process `syz.2.302'. [ 99.051785][ T6934] netlink: 288 bytes leftover after parsing attributes in process `syz.1.304'. [ 99.188776][ T6936] netlink: 'syz.0.305': attribute type 6 has an invalid length. [ 99.207951][ T6939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.306'. [ 99.249955][ T6939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.306'. [ 99.250672][ T6947] netlink: 'syz.3.308': attribute type 4 has an invalid length. [ 99.365384][ T6939] erspan0: entered promiscuous mode [ 99.383950][ T6939] batadv_slave_1: entered promiscuous mode [ 99.391731][ T6939] batadv_slave_1: left promiscuous mode [ 99.401426][ T6939] erspan0: left promiscuous mode [ 99.554659][ T6963] FAULT_INJECTION: forcing a failure. [ 99.554659][ T6963] name failslab, interval 1, probability 0, space 0, times 0 [ 99.594023][ T6963] CPU: 0 UID: 0 PID: 6963 Comm: syz.1.312 Not tainted syzkaller #0 PREEMPT(full) [ 99.594043][ T6963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 99.594050][ T6963] Call Trace: [ 99.594056][ T6963] [ 99.594062][ T6963] dump_stack_lvl+0x189/0x250 [ 99.594085][ T6963] ? __pfx____ratelimit+0x10/0x10 [ 99.594103][ T6963] ? __pfx_dump_stack_lvl+0x10/0x10 [ 99.594118][ T6963] ? __pfx__printk+0x10/0x10 [ 99.594129][ T6963] ? ip6t_do_table+0x1db/0x1560 [ 99.594149][ T6963] ? __pfx_ip6t_do_table+0x10/0x10 [ 99.594172][ T6963] should_fail_ex+0x414/0x560 [ 99.594196][ T6963] should_failslab+0xa8/0x100 [ 99.594211][ T6963] __kmalloc_noprof+0xcb/0x7f0 [ 99.594228][ T6963] ? ___neigh_create+0x6d5/0x2260 [ 99.594250][ T6963] ___neigh_create+0x6d5/0x2260 [ 99.594274][ T6963] ? __ipv6_neigh_lookup_noref+0x531/0x710 [ 99.594303][ T6963] ip6_finish_output2+0x1175/0x1480 [ 99.594334][ T6963] ? __pfx_ip6_finish_output2+0x10/0x10 [ 99.594354][ T6963] ? ip6_mtu+0x7d/0x490 [ 99.594371][ T6963] ? ip6_mtu+0x38c/0x490 [ 99.594388][ T6963] ? ip6_finish_output+0x2ef/0x4e0 [ 99.594406][ T6963] ? ip6_output+0x126/0x550 [ 99.594421][ T6963] ip6_output+0x340/0x550 [ 99.594438][ T6963] ? ip6_send_skb+0x10f/0x390 [ 99.594468][ T6963] ip6_send_skb+0x1d5/0x390 [ 99.594490][ T6963] udp_v6_send_skb+0xc17/0x1830 [ 99.594525][ T6963] udpv6_sendmsg+0x1d62/0x2510 [ 99.594552][ T6963] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 99.594580][ T6963] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 99.594607][ T6963] ? __pfx___might_resched+0x10/0x10 [ 99.594642][ T6963] ? aa_sk_perm+0x81e/0x950 [ 99.594674][ T6963] ? inet_send_prepare+0x5c/0x270 [ 99.594691][ T6963] ? inet6_sendmsg+0xe4/0x120 [ 99.594715][ T6963] __sock_sendmsg+0xe5/0x270 [ 99.594740][ T6963] ____sys_sendmsg+0x52d/0x830 [ 99.594763][ T6963] ? __pfx_____sys_sendmsg+0x10/0x10 [ 99.594788][ T6963] ? import_iovec+0x74/0xa0 [ 99.594810][ T6963] ___sys_sendmsg+0x21f/0x2a0 [ 99.594829][ T6963] ? __pfx____sys_sendmsg+0x10/0x10 [ 99.594881][ T6963] ? __fget_files+0x2a/0x420 [ 99.594896][ T6963] ? __fget_files+0x3a0/0x420 [ 99.594921][ T6963] __sys_sendmmsg+0x227/0x430 [ 99.594946][ T6963] ? __pfx___sys_sendmmsg+0x10/0x10 [ 99.594975][ T6963] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 99.595019][ T6963] ? ksys_write+0x22a/0x250 [ 99.595044][ T6963] ? __pfx_ksys_write+0x10/0x10 [ 99.595072][ T6963] __x64_sys_sendmmsg+0xa0/0xc0 [ 99.595093][ T6963] do_syscall_64+0xfa/0xfa0 [ 99.595114][ T6963] ? lockdep_hardirqs_on+0x9c/0x150 [ 99.595135][ T6963] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.595152][ T6963] ? clear_bhb_loop+0x60/0xb0 [ 99.595172][ T6963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.595189][ T6963] RIP: 0033:0x7f9ed6b8f6c9 [ 99.595205][ T6963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 99.595218][ T6963] RSP: 002b:00007f9ed7a37038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 99.595237][ T6963] RAX: ffffffffffffffda RBX: 00007f9ed6de5fa0 RCX: 00007f9ed6b8f6c9 [ 99.595249][ T6963] RDX: 0400000000000172 RSI: 0000200000003cc0 RDI: 0000000000000003 [ 99.595261][ T6963] RBP: 00007f9ed7a37090 R08: 0000000000000000 R09: 0000000000000000 [ 99.595271][ T6963] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.595282][ T6963] R13: 00007f9ed6de6038 R14: 00007f9ed6de5fa0 R15: 00007ffd240ae618 [ 99.595314][ T6963] [ 99.951131][ T6965] syzkaller0: entered promiscuous mode [ 99.956688][ T6965] syzkaller0: entered allmulticast mode [ 99.974382][ T6967] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 100.283170][ T6974] tipc: Started in network mode [ 100.288164][ T6974] tipc: Node identity , cluster identity 4711 [ 100.294979][ T6974] tipc: Failed to obtain node identity [ 100.302872][ T6974] tipc: Enabling of bearer rejected, failed to enable media [ 100.316519][ T6974] syzkaller0: entered promiscuous mode [ 100.322675][ T6974] syzkaller0: entered allmulticast mode [ 100.333554][ T6985] tipc: Enabled bearer , priority 0 [ 100.341727][ T6985] syzkaller0: entered promiscuous mode [ 100.361761][ T6985] syzkaller0: entered allmulticast mode [ 100.448741][ T6985] tipc: Resetting bearer [ 100.466246][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.474690][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.483439][ T6985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.491860][ T6985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.557585][ T7001] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 100.626414][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.896490][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 100.904835][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 101.089604][ T6984] tipc: Resetting bearer [ 101.137657][ T6984] tipc: Disabling bearer [ 101.198496][ T7027] syzkaller0: entered promiscuous mode [ 101.204149][ T7027] syzkaller0: entered allmulticast mode [ 101.342629][ T7036] syzkaller0: entered promiscuous mode [ 101.356276][ T7036] syzkaller0: entered allmulticast mode [ 101.526766][ T7048] __nla_validate_parse: 9 callbacks suppressed [ 101.526784][ T7048] netlink: 28 bytes leftover after parsing attributes in process `syz.4.339'. [ 101.885392][ T7068] bond2: entered promiscuous mode [ 101.890636][ T7068] bond2: entered allmulticast mode [ 101.904983][ T7068] 8021q: adding VLAN 0 to HW filter on device bond2 [ 102.090939][ T7077] netlink: 'syz.2.347': attribute type 1 has an invalid length. [ 102.098967][ T7077] netlink: 4 bytes leftover after parsing attributes in process `syz.2.347'. [ 102.106554][ T7089] syzkaller0: entered promiscuous mode [ 102.113271][ T7089] syzkaller0: entered allmulticast mode [ 102.123827][ T7077] netlink: 116 bytes leftover after parsing attributes in process `syz.2.347'. [ 102.410355][ T7096] netlink: 28 bytes leftover after parsing attributes in process `syz.1.354'. [ 102.417174][ T7097] syzkaller0: entered promiscuous mode [ 102.434323][ T7097] syzkaller0: entered allmulticast mode [ 102.886999][ T7127] pim6reg1: entered promiscuous mode [ 102.893355][ T7127] pim6reg1: entered allmulticast mode [ 102.914200][ T7133] netlink: 'syz.1.368': attribute type 21 has an invalid length. [ 102.937482][ T7133] netlink: 'syz.1.368': attribute type 6 has an invalid length. [ 102.945246][ T7133] netlink: 132 bytes leftover after parsing attributes in process `syz.1.368'. [ 103.115297][ T7141] netlink: 'syz.2.371': attribute type 1 has an invalid length. [ 103.118915][ T7144] netlink: 28 bytes leftover after parsing attributes in process `syz.1.369'. [ 103.203992][ T7143] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 103.230629][ T7140] tun0: tun_chr_ioctl cmd 1074025675 [ 103.236511][ T7140] tun0: persist disabled [ 103.501972][ T7172] netlink: 'syz.4.375': attribute type 1 has an invalid length. [ 103.733679][ T7180] syzkaller0: entered promiscuous mode [ 103.749278][ T7180] syzkaller0: entered allmulticast mode [ 103.959967][ T7198] netlink: 4 bytes leftover after parsing attributes in process `syz.0.382'. [ 104.094018][ T7204] pimreg3: entered allmulticast mode [ 104.235661][ T7206] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 104.285353][ T7214] netlink: 12 bytes leftover after parsing attributes in process `syz.2.388'. [ 104.767991][ T7246] netlink: 44 bytes leftover after parsing attributes in process `syz.2.395'. [ 105.246502][ T7273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 105.582839][ T7290] syzkaller0: entered promiscuous mode [ 105.589635][ T7290] syzkaller0: entered allmulticast mode [ 108.391090][ T7316] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 108.451678][ T7324] tipc: Enabled bearer , priority 0 [ 108.490555][ T7325] syzkaller0: entered promiscuous mode [ 108.517035][ T7325] syzkaller0: entered allmulticast mode [ 108.702327][ T7328] tipc: Resetting bearer [ 108.762822][ T7328] tipc: Disabling bearer [ 109.003822][ T7367] netlink: 'syz.0.425': attribute type 21 has an invalid length. [ 109.012522][ T7367] netlink: 132 bytes leftover after parsing attributes in process `syz.0.425'. [ 109.027109][ T7367] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.425'. [ 109.056208][ T7367] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 109.225634][ T7374] netlink: 12 bytes leftover after parsing attributes in process `syz.0.427'. [ 109.353109][ T7374] 8021q: adding VLAN 0 to HW filter on device bond1 [ 109.543071][ T7386] netlink: 'syz.3.434': attribute type 1 has an invalid length. [ 109.608914][ T7392] netlink: 'syz.4.435': attribute type 10 has an invalid length. [ 109.641004][ T7392] netlink: 4 bytes leftover after parsing attributes in process `syz.4.435'. [ 109.690848][ T7386] 8021q: adding VLAN 0 to HW filter on device bond3 [ 109.833138][ T7393] 8021q: adding VLAN 0 to HW filter on device bond3 [ 109.844080][ T7393] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 109.857988][ T7393] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 109.921713][ T7400] vlan2: entered allmulticast mode [ 109.929465][ T7400] bond3: entered allmulticast mode [ 110.005245][ T7411] tc_dump_action: action bad kind [ 110.079456][ T7422] netlink: 292 bytes leftover after parsing attributes in process `syz.0.442'. [ 110.200030][ T7428] netlink: 80 bytes leftover after parsing attributes in process `syz.1.444'. [ 110.298145][ T7433] netlink: 32 bytes leftover after parsing attributes in process `syz.0.446'. [ 110.454048][ T7443] netlink: 'syz.2.449': attribute type 10 has an invalid length. [ 110.482611][ T7443] netlink: 4 bytes leftover after parsing attributes in process `syz.2.449'. [ 110.506939][ T7449] netlink: 60 bytes leftover after parsing attributes in process `syz.0.452'. [ 110.803727][ T7463] netlink: 4 bytes leftover after parsing attributes in process `syz.1.458'. [ 110.816152][ T7463] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 110.850446][ T7463] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 110.907665][ T7470] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.915999][ T7470] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.589606][ T7506] xt_TCPMSS: Only works on TCP SYN packets [ 111.801022][ T7525] netlink: 'syz.2.476': attribute type 10 has an invalid length. [ 112.316647][ T7551] ip6gre1: entered promiscuous mode [ 112.351366][ T7551] ip6gre1: entered allmulticast mode [ 112.466408][ T7562] netlink: 'syz.1.488': attribute type 10 has an invalid length. [ 112.656599][ T7573] block nbd1: NBD_DISCONNECT [ 112.907947][ T13] wlan1: Trigger new scan to find an IBSS to join [ 112.951886][ T7592] netlink: 'syz.0.498': attribute type 1 has an invalid length. [ 112.978846][ T7592] netlink: 'syz.0.498': attribute type 7 has an invalid length. [ 113.010639][ T7592] netlink: 'syz.0.498': attribute type 8 has an invalid length. [ 113.054773][ T7594] tipc: Started in network mode [ 113.095992][ T7594] tipc: Node identity 9af14e168a1f, cluster identity 4711 [ 113.134420][ T7594] tipc: Enabled bearer , priority 0 [ 113.149888][ T7588] tipc: Resetting bearer [ 114.158359][ T24] tipc: Node number set to 284053014 [ 114.503938][ T7588] tipc: Disabling bearer [ 114.541795][ T7604] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 114.546742][ T7606] lo speed is unknown, defaulting to 1000 [ 114.629334][ T7606] lo speed is unknown, defaulting to 1000 [ 114.655446][ T7606] lo speed is unknown, defaulting to 1000 [ 114.940349][ T7646] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 114.968628][ T7646] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 115.106150][ T7656] netlink: 'syz.0.518': attribute type 4 has an invalid length. [ 115.125171][ T7658] netlink: 'syz.4.519': attribute type 15 has an invalid length. [ 115.146389][ T7658] __nla_validate_parse: 9 callbacks suppressed [ 115.146405][ T7658] netlink: 4 bytes leftover after parsing attributes in process `syz.4.519'. [ 115.187368][ T7656] netlink: 240 bytes leftover after parsing attributes in process `syz.0.518'. [ 115.240590][ T4945] netdevsim netdevsim4 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 115.240733][ T7658] netlink: 'syz.4.519': attribute type 15 has an invalid length. [ 115.272144][ T4945] netdevsim netdevsim4 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 115.278848][ T7658] netlink: 4 bytes leftover after parsing attributes in process `syz.4.519'. [ 115.315677][ T4945] netdevsim netdevsim4 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 115.329552][ T4945] netdevsim netdevsim4 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 115.403548][ T7606] infiniband sz1: set active [ 115.409901][ T9] lo speed is unknown, defaulting to 1000 [ 115.439382][ T7606] infiniband sz1: added lo [ 115.449910][ T7606] sz1: rxe_create_cq: returned err = -12 [ 115.465700][ T7606] infiniband sz1: Couldn't create ib_mad CQ [ 115.487388][ T7606] infiniband sz1: Couldn't open port 1 [ 115.517070][ T7673] netlink: 20 bytes leftover after parsing attributes in process `syz.4.525'. [ 115.566069][ T7673] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 115.577887][ T7606] RDS/IB: sz1: added [ 115.582405][ T7606] smc: adding ib device sz1 with port count 1 [ 115.593636][ T7677] netlink: 64985 bytes leftover after parsing attributes in process `syz.4.525'. [ 115.606333][ T7606] smc: ib device sz1 port 1 has no pnetid [ 115.631763][ T9] lo speed is unknown, defaulting to 1000 [ 115.659462][ T7606] lo speed is unknown, defaulting to 1000 [ 115.838135][ T7692] bond1: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 115.866377][ T60] wlan1: Trigger new scan to find an IBSS to join [ 115.877804][ T7697] netlink: 24 bytes leftover after parsing attributes in process `syz.2.529'. [ 115.885415][ T7692] bond1 (unregistering): Released all slaves [ 115.953834][ T7700] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 116.082042][ T7702] FAULT_INJECTION: forcing a failure. [ 116.082042][ T7702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.126410][ T7704] tipc: Enabling of bearer rejected, failed to enable media [ 116.139336][ T7702] CPU: 0 UID: 0 PID: 7702 Comm: syz.0.533 Not tainted syzkaller #0 PREEMPT(full) [ 116.139359][ T7702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 116.139369][ T7702] Call Trace: [ 116.139376][ T7702] [ 116.139384][ T7702] dump_stack_lvl+0x189/0x250 [ 116.139409][ T7702] ? __pfx____ratelimit+0x10/0x10 [ 116.139429][ T7702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 116.139447][ T7702] ? __pfx__printk+0x10/0x10 [ 116.139472][ T7702] should_fail_ex+0x414/0x560 [ 116.139499][ T7702] _copy_from_user+0x2d/0xb0 [ 116.139519][ T7702] copy_from_sockptr_offset+0x66/0xa0 [ 116.139543][ T7702] do_ipt_set_ctl+0x8ae/0xcd0 [ 116.139564][ T7702] ? rcu_is_watching+0x15/0xb0 [ 116.139583][ T7702] ? trace_contention_end+0x39/0x120 [ 116.139603][ T7702] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 116.139644][ T7702] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 116.139676][ T7702] ? __pfx_aa_sk_perm+0x10/0x10 [ 116.139704][ T7702] nf_setsockopt+0x26f/0x290 [ 116.139725][ T7702] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 116.139749][ T7702] do_sock_setsockopt+0x17c/0x1b0 [ 116.139771][ T7702] __x64_sys_setsockopt+0x13f/0x1b0 [ 116.139793][ T7702] do_syscall_64+0xfa/0xfa0 [ 116.139812][ T7702] ? lockdep_hardirqs_on+0x9c/0x150 [ 116.139833][ T7702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.139848][ T7702] ? clear_bhb_loop+0x60/0xb0 [ 116.139868][ T7702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.139883][ T7702] RIP: 0033:0x7f040c98f6c9 [ 116.139898][ T7702] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 116.139911][ T7702] RSP: 002b:00007f040d8a3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 116.139929][ T7702] RAX: ffffffffffffffda RBX: 00007f040cbe5fa0 RCX: 00007f040c98f6c9 [ 116.139942][ T7702] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 116.139952][ T7702] RBP: 00007f040d8a3090 R08: 0000000000000570 R09: 0000000000000000 [ 116.139963][ T7702] R10: 0000200000001640 R11: 0000000000000246 R12: 0000000000000001 [ 116.139973][ T7702] R13: 00007f040cbe6038 R14: 00007f040cbe5fa0 R15: 00007ffeeca1bc28 [ 116.139999][ T7702] [ 116.160964][ T7708] sctp: [Deprecated]: syz.3.536 (pid 7708) Use of int in max_burst socket option. [ 116.160964][ T7708] Use struct sctp_assoc_value instead [ 116.498584][ T7606] lo speed is unknown, defaulting to 1000 [ 116.637096][ T7728] netlink: 40 bytes leftover after parsing attributes in process `syz.2.541'. [ 116.721855][ T7737] netlink: 'syz.3.543': attribute type 1 has an invalid length. [ 116.747106][ T7737] x_tables: duplicate underflow at hook 1 [ 117.078952][ T7606] lo speed is unknown, defaulting to 1000 [ 117.160591][ T7756] netlink: 24 bytes leftover after parsing attributes in process `syz.0.549'. [ 117.275001][ T7763] syz_tun: entered allmulticast mode [ 117.318329][ T7767] netlink: 60 bytes leftover after parsing attributes in process `syz.4.554'. [ 117.633077][ T7606] lo speed is unknown, defaulting to 1000 [ 117.643362][ T7781] netlink: 12 bytes leftover after parsing attributes in process `syz.3.559'. [ 118.008279][ T7800] netlink: 'syz.0.564': attribute type 1 has an invalid length. [ 118.121456][ T7807] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 118.123398][ T7800] 8021q: adding VLAN 0 to HW filter on device bond2 [ 118.318916][ T7810] bond2: option mode: invalid value (133) [ 118.346944][ T7810] bond2 (unregistering): Released all slaves [ 118.397418][ T7813] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 118.400713][ T7606] lo speed is unknown, defaulting to 1000 [ 118.758568][ T7830] mac80211_hwsim hwsim11 ÿ: renamed from wlan1 (while UP) [ 118.825657][ T7833] netlink: 'syz.2.575': attribute type 29 has an invalid length. [ 118.856742][ T7833] netlink: 'syz.2.575': attribute type 29 has an invalid length. [ 118.908274][ T3507] wlan1: Trigger new scan to find an IBSS to join [ 119.047449][ T7845] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 119.650335][ T7878] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 119.754902][ T7869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 119.784458][ T7869] delete_channel: no stack [ 119.963260][ T13] wlan1: Creating new IBSS network, BSSID 2a:ee:c6:a1:ca:92 [ 120.520275][ T7926] __nla_validate_parse: 7 callbacks suppressed [ 120.520291][ T7926] netlink: 12 bytes leftover after parsing attributes in process `syz.1.599'. [ 120.582753][ T7928] syzkaller0: entered promiscuous mode [ 120.583476][ T7926] netlink: 8 bytes leftover after parsing attributes in process `syz.1.599'. [ 120.597008][ T7928] syzkaller0: entered allmulticast mode [ 120.615325][ T7926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.599'. [ 120.660759][ T7926] netlink: 'syz.1.599': attribute type 11 has an invalid length. [ 120.736398][ T7935] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge0 [ 120.832523][ T7937] lo: left promiscuous mode [ 121.227667][ T7937] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.235396][ T7937] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.558378][ T7937] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.604613][ T7937] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.008858][ T7985] pimreg: entered allmulticast mode [ 122.014745][ T69] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 122.048802][ T69] netdevsim netdevsim4 netdevsim0: unset [0, 1] type 1 family 0 port 2816 - 0 [ 122.060578][ T69] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.094362][ T69] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 122.114191][ T69] netdevsim netdevsim4 netdevsim1: unset [0, 1] type 1 family 0 port 2816 - 0 [ 122.140743][ T69] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.163834][ T69] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 122.189252][ T69] netdevsim netdevsim4 netdevsim2: unset [0, 1] type 1 family 0 port 2816 - 0 [ 122.200511][ T69] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.227967][ T69] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 122.239507][ T69] netdevsim netdevsim4 netdevsim3: unset [0, 1] type 1 family 0 port 2816 - 0 [ 122.249354][ T69] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.750898][ T8050] FAULT_INJECTION: forcing a failure. [ 122.750898][ T8050] name failslab, interval 1, probability 0, space 0, times 0 [ 122.777542][ T8050] CPU: 1 UID: 0 PID: 8050 Comm: syz.2.623 Not tainted syzkaller #0 PREEMPT(full) [ 122.777585][ T8050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 122.777605][ T8050] Call Trace: [ 122.777619][ T8050] [ 122.777631][ T8050] dump_stack_lvl+0x189/0x250 [ 122.777681][ T8050] ? __pfx____ratelimit+0x10/0x10 [ 122.777705][ T8050] ? __pfx_dump_stack_lvl+0x10/0x10 [ 122.777725][ T8050] ? __pfx__printk+0x10/0x10 [ 122.777744][ T8050] ? __pfx___might_resched+0x10/0x10 [ 122.777763][ T8050] ? fs_reclaim_acquire+0x7d/0x100 [ 122.777793][ T8050] should_fail_ex+0x414/0x560 [ 122.777821][ T8050] should_failslab+0xa8/0x100 [ 122.777840][ T8050] __kvmalloc_node_noprof+0x158/0x910 [ 122.777860][ T8050] ? __nf_register_net_hook+0x232/0x930 [ 122.777875][ T8050] ? nf_hook_entries_grow+0x281/0x720 [ 122.777897][ T8050] nf_hook_entries_grow+0x281/0x720 [ 122.777927][ T8050] __nf_register_net_hook+0x2c9/0x930 [ 122.777955][ T8050] nf_register_net_hook+0xb2/0x190 [ 122.777975][ T8050] nf_register_net_hooks+0x44/0x1b0 [ 122.777994][ T8050] nf_ct_netns_do_get+0x3bf/0x5a0 [ 122.778012][ T8050] ? rcu_is_watching+0x15/0xb0 [ 122.778031][ T8050] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 122.778046][ T8050] ? trace_contention_end+0x39/0x120 [ 122.778081][ T8050] connlimit_mt_check+0x7f/0x240 [ 122.778116][ T8050] xt_check_match+0x3d1/0xab0 [ 122.778139][ T8050] ? __pfx_xt_check_match+0x10/0x10 [ 122.778162][ T8050] ? pcpu_alloc_noprof+0xfdd/0x1720 [ 122.778196][ T8050] ? xt_find_match+0x1f7/0x250 [ 122.778222][ T8050] translate_table+0x150b/0x2000 [ 122.778265][ T8050] ? __pfx_translate_table+0x10/0x10 [ 122.778284][ T8050] ? __might_fault+0xb0/0x130 [ 122.778325][ T8050] ? _copy_from_user+0x94/0xb0 [ 122.778350][ T8050] do_ipt_set_ctl+0x967/0xcd0 [ 122.778372][ T8050] ? rcu_is_watching+0x15/0xb0 [ 122.778389][ T8050] ? trace_contention_end+0x39/0x120 [ 122.778408][ T8050] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 122.778448][ T8050] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 122.778478][ T8050] ? __pfx_aa_sk_perm+0x10/0x10 [ 122.778505][ T8050] nf_setsockopt+0x26f/0x290 [ 122.778528][ T8050] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 122.778552][ T8050] do_sock_setsockopt+0x17c/0x1b0 [ 122.778572][ T8050] __x64_sys_setsockopt+0x13f/0x1b0 [ 122.778595][ T8050] do_syscall_64+0xfa/0xfa0 [ 122.778615][ T8050] ? lockdep_hardirqs_on+0x9c/0x150 [ 122.778636][ T8050] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.778653][ T8050] ? clear_bhb_loop+0x60/0xb0 [ 122.778673][ T8050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.778689][ T8050] RIP: 0033:0x7fa5e118f6c9 [ 122.778705][ T8050] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 122.778718][ T8050] RSP: 002b:00007fa5e2016038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 122.778737][ T8050] RAX: ffffffffffffffda RBX: 00007fa5e13e5fa0 RCX: 00007fa5e118f6c9 [ 122.778749][ T8050] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 122.778759][ T8050] RBP: 00007fa5e2016090 R08: 0000000000000570 R09: 0000000000000000 [ 122.778770][ T8050] R10: 0000200000001640 R11: 0000000000000246 R12: 0000000000000002 [ 122.778780][ T8050] R13: 00007fa5e13e6038 R14: 00007fa5e13e5fa0 R15: 00007fffa24d45b8 [ 122.778812][ T8050] [ 122.779126][ T8050] xt_connlimit: cannot load conntrack support for proto=2 [ 122.995141][ T52] Bluetooth: hci4: command 0x0405 tx timeout [ 123.386337][ T8074] pim6reg: entered allmulticast mode [ 123.439137][ T8074] pim6reg: left allmulticast mode [ 123.444331][ T8074] vcan0: left allmulticast mode [ 123.512145][ T8079] netlink: 'syz.4.631': attribute type 12 has an invalid length. [ 123.801527][ T8103] netlink: 8 bytes leftover after parsing attributes in process `syz.0.640'. [ 123.856295][ T8103] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 123.928980][ T8103] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 123.944808][ T8111] xt_bpf: check failed: parse error [ 123.950398][ T8103] gretap1: entered promiscuous mode [ 123.975429][ T8103] gretap1: entered allmulticast mode [ 124.088728][ T8120] netlink: 120 bytes leftover after parsing attributes in process `syz.1.646'. [ 124.146803][ T30] audit: type=1107 audit(1762573483.734:2): pid=8117 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 124.415209][ T8133] 8021q: adding VLAN 0 to HW filter on device bond3 [ 124.524770][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.557144][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.573173][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.585035][ T8134] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 124.627243][ T8134] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 124.727636][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.735745][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.770527][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.778691][ T8134] wg1 speed is unknown, defaulting to 1000 [ 124.786590][ T8134] wg1 speed is unknown, defaulting to 1000 [ 125.098797][ T8171] netlink: 'syz.1.664': attribute type 18 has an invalid length. [ 125.175246][ T8171] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 125.275514][ T8180] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 125.288286][ T8180] FAULT_INJECTION: forcing a failure. [ 125.288286][ T8180] name failslab, interval 1, probability 0, space 0, times 0 [ 125.304291][ T8180] CPU: 1 UID: 0 PID: 8180 Comm: syz.0.666 Not tainted syzkaller #0 PREEMPT(full) [ 125.304315][ T8180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 125.304324][ T8180] Call Trace: [ 125.304331][ T8180] [ 125.304338][ T8180] dump_stack_lvl+0x189/0x250 [ 125.304364][ T8180] ? __pfx____ratelimit+0x10/0x10 [ 125.304387][ T8180] ? __pfx_dump_stack_lvl+0x10/0x10 [ 125.304409][ T8180] ? __pfx__printk+0x10/0x10 [ 125.304432][ T8180] ? __pfx___might_resched+0x10/0x10 [ 125.304450][ T8180] ? fs_reclaim_acquire+0x7d/0x100 [ 125.304479][ T8180] should_fail_ex+0x414/0x560 [ 125.304507][ T8180] should_failslab+0xa8/0x100 [ 125.304526][ T8180] __kvmalloc_node_noprof+0x158/0x910 [ 125.304550][ T8180] ? __nf_hook_entries_try_shrink+0x31b/0x6f0 [ 125.304583][ T8180] __nf_hook_entries_try_shrink+0x31b/0x6f0 [ 125.304615][ T8180] __nf_unregister_net_hook+0x4f6/0x700 [ 125.304642][ T8180] nf_unregister_net_hooks+0xcb/0x140 [ 125.304662][ T8180] nf_ct_netns_put+0x3b9/0x520 [ 125.304679][ T8180] ? __pfx_connlimit_mt_destroy+0x10/0x10 [ 125.304700][ T8180] cleanup_entry+0x136/0x310 [ 125.304721][ T8180] ? __pfx_cleanup_entry+0x10/0x10 [ 125.304747][ T8180] ? xt_find_target+0x1f3/0x240 [ 125.304775][ T8180] translate_table+0x1e00/0x2000 [ 125.304811][ T8180] ? __pfx_translate_table+0x10/0x10 [ 125.304830][ T8180] ? __might_fault+0xb0/0x130 [ 125.304867][ T8180] ? _copy_from_user+0x94/0xb0 [ 125.304893][ T8180] do_ipt_set_ctl+0x967/0xcd0 [ 125.304914][ T8180] ? rcu_is_watching+0x15/0xb0 [ 125.304934][ T8180] ? trace_contention_end+0x39/0x120 [ 125.304954][ T8180] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 125.304996][ T8180] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 125.305030][ T8180] ? __pfx_aa_sk_perm+0x10/0x10 [ 125.305056][ T8180] nf_setsockopt+0x26f/0x290 [ 125.305078][ T8180] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 125.305102][ T8180] do_sock_setsockopt+0x17c/0x1b0 [ 125.305124][ T8180] __x64_sys_setsockopt+0x13f/0x1b0 [ 125.305147][ T8180] do_syscall_64+0xfa/0xfa0 [ 125.305168][ T8180] ? lockdep_hardirqs_on+0x9c/0x150 [ 125.305188][ T8180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.305205][ T8180] ? clear_bhb_loop+0x60/0xb0 [ 125.305224][ T8180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.305240][ T8180] RIP: 0033:0x7f040c98f6c9 [ 125.305255][ T8180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 125.305268][ T8180] RSP: 002b:00007f040d8a3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 125.305286][ T8180] RAX: ffffffffffffffda RBX: 00007f040cbe5fa0 RCX: 00007f040c98f6c9 [ 125.305299][ T8180] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 125.305309][ T8180] RBP: 00007f040d8a3090 R08: 0000000000000570 R09: 0000000000000000 [ 125.305328][ T8180] R10: 0000200000001640 R11: 0000000000000246 R12: 0000000000000002 [ 125.305338][ T8180] R13: 00007f040cbe6038 R14: 00007f040cbe5fa0 R15: 00007ffeeca1bc28 [ 125.305368][ T8180] [ 125.808519][ T8200] FAULT_INJECTION: forcing a failure. [ 125.808519][ T8200] name failslab, interval 1, probability 0, space 0, times 0 [ 125.829631][ T8200] CPU: 1 UID: 0 PID: 8200 Comm: syz.0.671 Not tainted syzkaller #0 PREEMPT(full) [ 125.829655][ T8200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 125.829665][ T8200] Call Trace: [ 125.829672][ T8200] [ 125.829679][ T8200] dump_stack_lvl+0x189/0x250 [ 125.829706][ T8200] ? __pfx____ratelimit+0x10/0x10 [ 125.829729][ T8200] ? __pfx_dump_stack_lvl+0x10/0x10 [ 125.829750][ T8200] ? __pfx__printk+0x10/0x10 [ 125.829772][ T8200] ? __pfx___might_resched+0x10/0x10 [ 125.829789][ T8200] ? fs_reclaim_acquire+0x7d/0x100 [ 125.829815][ T8200] should_fail_ex+0x414/0x560 [ 125.829841][ T8200] should_failslab+0xa8/0x100 [ 125.829859][ T8200] kmem_cache_alloc_node_noprof+0x77/0x710 [ 125.829880][ T8200] ? __alloc_skb+0x112/0x2d0 [ 125.829894][ T8200] ? netlink_autobind+0xdb/0x300 [ 125.829913][ T8200] __alloc_skb+0x112/0x2d0 [ 125.829930][ T8200] netlink_sendmsg+0x5c6/0xb30 [ 125.829952][ T8200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.829969][ T8200] ? aa_sock_msg_perm+0xf1/0x1d0 [ 125.829992][ T8200] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 125.830006][ T8200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.830020][ T8200] __sock_sendmsg+0x21c/0x270 [ 125.830042][ T8200] ____sys_sendmsg+0x505/0x830 [ 125.830062][ T8200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 125.830084][ T8200] ? import_iovec+0x74/0xa0 [ 125.830112][ T8200] ___sys_sendmsg+0x21f/0x2a0 [ 125.830130][ T8200] ? __pfx____sys_sendmsg+0x10/0x10 [ 125.830171][ T8200] ? __fget_files+0x2a/0x420 [ 125.830184][ T8200] ? __fget_files+0x3a0/0x420 [ 125.830204][ T8200] __x64_sys_sendmsg+0x19b/0x260 [ 125.830223][ T8200] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 125.830246][ T8200] ? __pfx_ksys_write+0x10/0x10 [ 125.830270][ T8200] ? do_syscall_64+0xbe/0xfa0 [ 125.830294][ T8200] do_syscall_64+0xfa/0xfa0 [ 125.830312][ T8200] ? lockdep_hardirqs_on+0x9c/0x150 [ 125.830332][ T8200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.830347][ T8200] ? clear_bhb_loop+0x60/0xb0 [ 125.830365][ T8200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.830379][ T8200] RIP: 0033:0x7f040c98f6c9 [ 125.830394][ T8200] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 125.830406][ T8200] RSP: 002b:00007f040d8a3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.830422][ T8200] RAX: ffffffffffffffda RBX: 00007f040cbe5fa0 RCX: 00007f040c98f6c9 [ 125.830432][ T8200] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000003 [ 125.830442][ T8200] RBP: 00007f040d8a3090 R08: 0000000000000000 R09: 0000000000000000 [ 125.830451][ T8200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.830461][ T8200] R13: 00007f040cbe6038 R14: 00007f040cbe5fa0 R15: 00007ffeeca1bc28 [ 125.830486][ T8200] [ 126.239856][ T8206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.676'. [ 126.287921][ T8206] vlan2: entered allmulticast mode [ 126.314998][ T8206] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 126.362472][ T8217] netlink: 148 bytes leftover after parsing attributes in process `syz.4.677'. [ 126.376741][ T8217] netlink: 40 bytes leftover after parsing attributes in process `syz.4.677'. [ 126.469018][ T8221] netlink: 104 bytes leftover after parsing attributes in process `syz.4.681'. [ 126.481330][ T8224] netlink: 24 bytes leftover after parsing attributes in process `syz.4.681'. [ 126.687585][ T8222] syz.3.679 (8222) used greatest stack depth: 17832 bytes left [ 126.827228][ T8245] netlink: 'syz.3.685': attribute type 10 has an invalid length. [ 126.840150][ T8245] netlink: 4 bytes leftover after parsing attributes in process `syz.3.685'. [ 126.875185][ T8248] xt_NFQUEUE: number of total queues is 0 [ 127.479373][ T8283] netlink: 12 bytes leftover after parsing attributes in process `syz.3.694'. [ 127.577455][ T8288] !€ÿ: renamed from bond_slave_0 [ 127.786386][ T8301] netlink: 'syz.0.699': attribute type 10 has an invalid length. [ 127.887882][ T8301] netlink: 4 bytes leftover after parsing attributes in process `syz.0.699'. [ 128.061448][ T8307] sch_tbf: burst 0 is lower than device lo mtu (81) ! [ 128.186456][ T8318] netlink: 28 bytes leftover after parsing attributes in process `syz.2.703'. [ 128.212510][ T8318] netlink: 'syz.2.703': attribute type 7 has an invalid length. [ 128.242468][ T8318] netlink: 'syz.2.703': attribute type 8 has an invalid length. [ 128.285629][ T8318] netlink: 4 bytes leftover after parsing attributes in process `syz.2.703'. [ 128.578288][ T8341] netlink: 'syz.2.709': attribute type 1 has an invalid length. [ 128.797162][ T8359] netlink: 'syz.4.712': attribute type 7 has an invalid length. [ 128.839470][ T8359] netlink: 'syz.4.712': attribute type 7 has an invalid length. [ 129.308756][ T8390] FAULT_INJECTION: forcing a failure. [ 129.308756][ T8390] name failslab, interval 1, probability 0, space 0, times 0 [ 129.366046][ T8390] CPU: 1 UID: 0 PID: 8390 Comm: syz.2.721 Not tainted syzkaller #0 PREEMPT(full) [ 129.366071][ T8390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 129.366082][ T8390] Call Trace: [ 129.366089][ T8390] [ 129.366097][ T8390] dump_stack_lvl+0x189/0x250 [ 129.366125][ T8390] ? __pfx____ratelimit+0x10/0x10 [ 129.366148][ T8390] ? __pfx_dump_stack_lvl+0x10/0x10 [ 129.366170][ T8390] ? __pfx__printk+0x10/0x10 [ 129.366194][ T8390] ? __pfx___might_resched+0x10/0x10 [ 129.366217][ T8390] should_fail_ex+0x414/0x560 [ 129.366248][ T8390] should_failslab+0xa8/0x100 [ 129.366267][ T8390] kmem_cache_alloc_node_noprof+0x77/0x710 [ 129.366291][ T8390] ? __alloc_skb+0x112/0x2d0 [ 129.366312][ T8390] __alloc_skb+0x112/0x2d0 [ 129.366332][ T8390] netlink_ack+0x146/0xa50 [ 129.366375][ T8390] netlink_rcv_skb+0x28c/0x470 [ 129.366389][ T8390] ? lockdep_hardirqs_on+0x9c/0x150 [ 129.366414][ T8390] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 129.366439][ T8390] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 129.366474][ T8390] ? bpf_lsm_capable+0x9/0x20 [ 129.366493][ T8390] ? security_capable+0x7e/0x2e0 [ 129.366528][ T8390] nfnetlink_rcv+0x282/0x2590 [ 129.366560][ T8390] ? __dev_queue_xmit+0x27b/0x3b50 [ 129.366581][ T8390] ? __dev_queue_xmit+0x1d79/0x3b50 [ 129.366599][ T8390] ? kasan_save_track+0x3e/0x80 [ 129.366619][ T8390] ? __kasan_slab_alloc+0x6c/0x80 [ 129.366651][ T8390] ? __dev_queue_xmit+0x27b/0x3b50 [ 129.366683][ T8390] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 129.366705][ T8390] ? __pfx___dev_queue_xmit+0x10/0x10 [ 129.366739][ T8390] ? ref_tracker_free+0x63a/0x7d0 [ 129.366756][ T8390] ? __asan_memcpy+0x40/0x70 [ 129.366777][ T8390] ? __pfx_ref_tracker_free+0x10/0x10 [ 129.366810][ T8390] ? skb_clone+0x246/0x3a0 [ 129.366832][ T8390] ? __netlink_deliver_tap+0x807/0x850 [ 129.366849][ T8390] ? netlink_deliver_tap+0x2e/0x1b0 [ 129.366872][ T8390] ? netlink_deliver_tap+0x2e/0x1b0 [ 129.366897][ T8390] netlink_unicast+0x82f/0x9e0 [ 129.366929][ T8390] ? __pfx_netlink_unicast+0x10/0x10 [ 129.366954][ T8390] ? netlink_sendmsg+0x642/0xb30 [ 129.366969][ T8390] ? skb_put+0x11b/0x210 [ 129.366989][ T8390] netlink_sendmsg+0x805/0xb30 [ 129.367016][ T8390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.367037][ T8390] ? aa_sock_msg_perm+0xf1/0x1d0 [ 129.367063][ T8390] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 129.367083][ T8390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.367101][ T8390] __sock_sendmsg+0x21c/0x270 [ 129.367127][ T8390] ____sys_sendmsg+0x505/0x830 [ 129.367152][ T8390] ? __pfx_____sys_sendmsg+0x10/0x10 [ 129.367180][ T8390] ? import_iovec+0x74/0xa0 [ 129.367203][ T8390] ___sys_sendmsg+0x21f/0x2a0 [ 129.367222][ T8390] ? __pfx____sys_sendmsg+0x10/0x10 [ 129.367277][ T8390] ? __fget_files+0x2a/0x420 [ 129.367293][ T8390] ? __fget_files+0x3a0/0x420 [ 129.367318][ T8390] __x64_sys_sendmsg+0x19b/0x260 [ 129.367339][ T8390] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 129.367368][ T8390] ? __pfx_ksys_write+0x10/0x10 [ 129.367394][ T8390] ? do_syscall_64+0xbe/0xfa0 [ 129.367420][ T8390] do_syscall_64+0xfa/0xfa0 [ 129.367441][ T8390] ? lockdep_hardirqs_on+0x9c/0x150 [ 129.367462][ T8390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.367479][ T8390] ? clear_bhb_loop+0x60/0xb0 [ 129.367500][ T8390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.367517][ T8390] RIP: 0033:0x7fa5e118f6c9 [ 129.367532][ T8390] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 129.367546][ T8390] RSP: 002b:00007fa5e2016038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 129.367569][ T8390] RAX: ffffffffffffffda RBX: 00007fa5e13e5fa0 RCX: 00007fa5e118f6c9 [ 129.367582][ T8390] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000003 [ 129.367593][ T8390] RBP: 00007fa5e2016090 R08: 0000000000000000 R09: 0000000000000000 [ 129.367604][ T8390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.367614][ T8390] R13: 00007fa5e13e6038 R14: 00007fa5e13e5fa0 R15: 00007fffa24d45b8 [ 129.367645][ T8390] [ 129.801846][ T8384] netlink: 'syz.0.719': attribute type 13 has an invalid length. [ 129.861141][ T8397] netlink: 'syz.3.723': attribute type 58 has an invalid length. [ 129.973001][ T8384] veth0_macvtap: left promiscuous mode [ 129.991697][ T8384] macvtap0: entered allmulticast mode [ 130.003913][ T8384] macvtap0: refused to change device tx_queue_len [ 130.049459][ T8405] netlink: 'syz.1.724': attribute type 11 has an invalid length. [ 130.338344][ T8421] netlink: 'syz.2.726': attribute type 10 has an invalid length. [ 130.615551][ T8440] IPVS: set_ctl: invalid protocol: 41 127.0.0.1:0 [ 131.069084][ T8455] syzkaller0: entered promiscuous mode [ 131.074601][ T8455] syzkaller0: entered allmulticast mode [ 131.149676][ T8458] bond1: entered promiscuous mode [ 131.157802][ T8458] 8021q: adding VLAN 0 to HW filter on device bond1 [ 131.232979][ T8463] bond1: (slave bridge1): making interface the new active one [ 131.246411][ T8463] bridge1: entered promiscuous mode [ 131.259303][ T8463] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 131.382722][ T8477] __nla_validate_parse: 8 callbacks suppressed [ 131.382738][ T8477] netlink: 64 bytes leftover after parsing attributes in process `syz.4.744'. [ 131.401128][ T8478] netlink: 64 bytes leftover after parsing attributes in process `syz.4.744'. [ 131.650296][ T8490] netlink: 12 bytes leftover after parsing attributes in process `syz.1.748'. [ 131.770073][ T8498] netlink: 20 bytes leftover after parsing attributes in process `syz.2.751'. [ 131.787838][ T8499] tunl0: entered promiscuous mode [ 131.836870][ T8498] netlink: 28 bytes leftover after parsing attributes in process `syz.2.751'. [ 131.846035][ T8498] validate_nla: 1 callbacks suppressed [ 131.846051][ T8498] netlink: 'syz.2.751': attribute type 7 has an invalid length. [ 131.876098][ T8498] netlink: 'syz.2.751': attribute type 8 has an invalid length. [ 131.905143][ T8498] netlink: 4 bytes leftover after parsing attributes in process `syz.2.751'. [ 131.944442][ T8506] netlink: 40 bytes leftover after parsing attributes in process `syz.3.755'. [ 131.955265][ T8509] tipc: Can't bind to reserved service type 0 [ 132.115577][ T8518] netlink: 12 bytes leftover after parsing attributes in process `syz.3.759'. [ 132.204942][ T8526] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 132.288965][ T8530] openvswitch: netlink: IP tunnel dst address not specified [ 132.297810][ T8532] netlink: 'syz.3.764': attribute type 2 has an invalid length. [ 132.313530][ T8532] netlink: 12 bytes leftover after parsing attributes in process `syz.3.764'. [ 132.468044][ T8541] bond2: option min_links: invalid value (18446744073709551614) [ 132.476296][ T8541] bond2: option min_links: allowed values 0 - 2147483647 [ 132.505701][ T8541] bond2 (unregistering): Released all slaves [ 132.831455][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.837927][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.902906][ T8572] netlink: 'syz.0.775': attribute type 21 has an invalid length. [ 132.903292][ T8571] netlink: 'syz.0.775': attribute type 21 has an invalid length. [ 132.963806][ T8564] netlink: 8 bytes leftover after parsing attributes in process `syz.2.774'. [ 133.078768][ T8583] x_tables: duplicate underflow at hook 1 [ 133.262548][ T8592] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 133.500730][ T8606] netlink: 'syz.0.789': attribute type 1 has an invalid length. [ 133.519723][ T8602] lo speed is unknown, defaulting to 1000 [ 133.736394][ T8610] syzkaller0: entered promiscuous mode [ 133.741909][ T8610] syzkaller0: entered allmulticast mode [ 133.984138][ T8625] netlink: 'syz.1.795': attribute type 6 has an invalid length. [ 134.139099][ T8602] wg1 speed is unknown, defaulting to 1000 [ 134.221997][ T8639] IPv6: addrconf: prefix option has invalid lifetime [ 134.724522][ T8656] netlink: 'syz.2.803': attribute type 2 has an invalid length. [ 134.872807][ T8680] netlink: 'syz.1.811': attribute type 10 has an invalid length. [ 134.982974][ T52] Bluetooth: hci4: link tx timeout [ 134.989108][ T52] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 135.005211][ T8683] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 135.527755][ T8727] netlink: 'syz.3.826': attribute type 10 has an invalid length. [ 135.901126][ T8744] tipc: Enabling of bearer rejected, failed to enable media [ 136.046577][ T8749] tipc: Enabled bearer , priority 0 [ 136.080126][ T8753] pim6reg1: entered promiscuous mode [ 136.085708][ T8753] pim6reg1: entered allmulticast mode [ 136.095525][ T8749] tipc: Resetting bearer [ 136.134962][ T8747] tipc: Disabling bearer [ 136.349950][ T8770] ip6t_srh: unknown srh match flags 4000 [ 136.933058][ T8808] ipt_REJECT: TCP_RESET invalid for non-tcp [ 137.065918][ T5827] Bluetooth: hci4: command 0x0405 tx timeout [ 137.333068][ T8830] __nla_validate_parse: 12 callbacks suppressed [ 137.333084][ T8830] netlink: 132 bytes leftover after parsing attributes in process `syz.4.858'. [ 137.645631][ T8854] validate_nla: 1 callbacks suppressed [ 137.645650][ T8854] netlink: 'syz.4.866': attribute type 10 has an invalid length. [ 137.661819][ T8854] netlink: 4 bytes leftover after parsing attributes in process `syz.4.866'. [ 137.705232][ T8856] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 137.825366][ T8868] netlink: 244 bytes leftover after parsing attributes in process `syz.3.872'. [ 138.049570][ T8882] xt_TCPMSS: Only works on TCP SYN packets [ 138.349828][ T8902] netlink: 'syz.3.880': attribute type 1 has an invalid length. [ 138.375115][ T8904] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 138.379891][ T8907] netlink: 52 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.394278][ T8902] netlink: 'syz.3.880': attribute type 1 has an invalid length. [ 138.408491][ T8907] netlink: 15 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.465963][ T8907] netlink: 52 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.478550][ T8907] netlink: 15 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.489413][ T8910] netlink: 4 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.501386][ T8907] netlink: 52 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.538689][ T8910] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 138.551980][ T8901] netlink: 'syz.4.881': attribute type 11 has an invalid length. [ 138.813806][ T5833] IPVS: starting estimator thread 0... [ 138.834965][ T8932] netlink: 32 bytes leftover after parsing attributes in process `syz.0.890'. [ 138.868682][ T8932] netlink: 'syz.0.890': attribute type 2 has an invalid length. [ 138.927777][ T8931] IPVS: using max 26 ests per chain, 62400 per kthread [ 138.959281][ T8938] netlink: 'syz.4.892': attribute type 10 has an invalid length. [ 139.237540][ T8951] netlink: zone id is out of range [ 139.242724][ T8951] netlink: zone id is out of range [ 139.260576][ T8951] netlink: zone id is out of range [ 139.265729][ T8951] netlink: zone id is out of range [ 139.296743][ T8951] netlink: zone id is out of range [ 139.301906][ T8951] netlink: zone id is out of range [ 139.346041][ T8951] netlink: zone id is out of range [ 139.351199][ T8951] netlink: zone id is out of range [ 139.353238][ T8964] netlink: 'syz.2.902': attribute type 2 has an invalid length. [ 139.376153][ T8951] netlink: zone id is out of range [ 139.378552][ T8964] netlink: 'syz.2.902': attribute type 8 has an invalid length. [ 139.617682][ T8977] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 139.753241][ T8985] syzkaller0: entered promiscuous mode [ 139.760441][ T8985] syzkaller0: entered allmulticast mode [ 139.969380][ T8999] syzkaller0: entered allmulticast mode [ 140.536432][ T9028] sctp: [Deprecated]: syz.4.922 (pid 9028) Use of int in maxseg socket option. [ 140.536432][ T9028] Use struct sctp_assoc_value instead [ 140.582824][ T9028] netlink: 'syz.4.922': attribute type 2 has an invalid length. [ 140.596220][ T9032] bond1 (unregistering): Released all slaves [ 140.641392][ T9028] : entered promiscuous mode [ 140.719102][ T9034] ip6tnl1: entered promiscuous mode [ 140.731496][ T9034] ip6tnl1: entered allmulticast mode [ 140.803830][ T9042] batadv1: entered allmulticast mode [ 140.972075][ T9047] tipc: Started in network mode [ 140.982910][ T9050] netlink: 'syz.0.928': attribute type 10 has an invalid length. [ 140.986902][ T9047] tipc: Node identity aaa6ca9a2f15, cluster identity 4711 [ 141.020649][ T9047] tipc: Enabled bearer , priority 0 [ 141.039223][ T9047] syzkaller0: MTU too low for tipc bearer [ 141.044982][ T9047] tipc: Disabling bearer [ 141.362483][ T9071] tipc: Started in network mode [ 141.376130][ T9071] tipc: Node identity ac14140f, cluster identity 4711 [ 141.391242][ T9071] tipc: New replicast peer: 255.255.255.255 [ 141.398161][ T9071] tipc: Enabled bearer , priority 10 [ 141.547772][ T9082] x_tables: duplicate underflow at hook 1 [ 142.515928][ T5833] tipc: Node number set to 2886997007 [ 142.588355][ T9134] __nla_validate_parse: 7 callbacks suppressed [ 142.588371][ T9134] netlink: 16 bytes leftover after parsing attributes in process `syz.1.948'. [ 142.926360][ T9158] macsec0: entered promiscuous mode [ 142.931612][ T9158] macsec0: entered allmulticast mode [ 143.004423][ T9161] xt_hashlimit: size too large, truncated to 1048576 [ 143.219743][ T9174] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 143.525459][ T9192] netlink: 36 bytes leftover after parsing attributes in process `syz.3.969'. [ 143.676071][ T9202] netlink: 8 bytes leftover after parsing attributes in process `syz.3.969'. [ 143.800198][ T9206] netlink: 'syz.2.972': attribute type 6 has an invalid length. [ 143.800225][ T9207] netlink: 12 bytes leftover after parsing attributes in process `syz.4.973'. [ 144.237211][ T9219] netlink: 'syz.3.975': attribute type 1 has an invalid length. [ 144.254970][ T9221] netlink: 40 bytes leftover after parsing attributes in process `syz.4.976'. [ 144.308320][ T9224] nftables ruleset with unbound set [ 144.359625][ T9219] bond4: (slave gretap1): making interface the new active one [ 144.414478][ T9219] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 144.697238][ T9251] tipc: Enabling of bearer rejected, failed to enable media [ 145.059001][ T9278] netlink: 24 bytes leftover after parsing attributes in process `syz.1.992'. [ 145.110729][ T9280] netlink: 24 bytes leftover after parsing attributes in process `syz.1.992'. [ 145.383936][ T9294] lo: entered allmulticast mode [ 145.473017][ T9298] macvtap1: entered promiscuous mode [ 145.494672][ T9298] macvtap1: entered allmulticast mode [ 145.526360][ T9303] netlink: 'syz.2.1001': attribute type 10 has an invalid length. [ 145.534488][ T9303] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1001'. [ 145.614127][ T9307] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1002'. [ 145.741597][ T9314] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1004'. [ 146.077399][ T9327] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 146.322106][ T9342] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 147.296691][ T9391] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 147.450243][ T9398] netlink: 'syz.1.1026': attribute type 39 has an invalid length. [ 147.577754][ T9404] veth0_to_bond: entered allmulticast mode [ 147.595476][ T9406] batadv_slave_1: entered promiscuous mode [ 147.620761][ T9405] batadv_slave_1: left promiscuous mode [ 147.657549][ T9411] __nla_validate_parse: 6 callbacks suppressed [ 147.657626][ T9411] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1033'. [ 147.763371][ T9417] netlink: 'syz.3.1035': attribute type 2 has an invalid length. [ 148.024247][ T9428] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 148.341840][ T9439] tipc: Enabled bearer , priority 0 [ 148.472221][ T9439] syzkaller0: entered promiscuous mode [ 148.475087][ T9447] tipc: Failed to remove unknown binding: 66,1,1/284053014:198838830/198838832 [ 148.477910][ T9439] syzkaller0: entered allmulticast mode [ 148.494159][ T9439] tipc: Resetting bearer [ 148.586422][ T3507] tipc: Resetting bearer [ 148.646828][ T9464] tipc: Started in network mode [ 148.653411][ T9464] tipc: Node identity 3af76598dd94, cluster identity 4711 [ 148.687421][ T9464] tipc: Enabled bearer , priority 0 [ 148.710683][ T9453] tipc: Resetting bearer [ 148.741182][ T9468] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1048'. [ 149.171659][ T9477] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 149.697869][ T7964] tipc: Node number set to 3882050968 [ 149.859269][ T9453] tipc: Disabling bearer [ 149.886135][ T9463] syzkaller0: entered promiscuous mode [ 149.891648][ T9463] syzkaller0: entered allmulticast mode [ 150.003273][ T1095] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 150.019696][ T9463] tipc: Resetting bearer [ 150.087830][ T9463] tipc: Disabling bearer [ 150.121368][ T9494] syzkaller0: entered promiscuous mode [ 150.133431][ T9494] syzkaller0: entered allmulticast mode [ 150.146903][ T9492] syzkaller0: entered promiscuous mode [ 150.153104][ T9492] syzkaller0: entered allmulticast mode [ 150.389786][ T9502] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1060'. [ 150.601213][ T9508] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 150.868040][ T9518] net_ratelimit: 2 callbacks suppressed [ 150.868057][ T9518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 151.240289][ T9536] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1073'. [ 151.273182][ T9538] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 151.584481][ T9560] netlink: 'syz.2.1078': attribute type 10 has an invalid length. [ 151.610128][ T9560] team0: Failed to send options change via netlink (err -105) [ 151.617981][ T9560] team0: Port device dummy0 added [ 151.623849][ T9556] syzkaller0: entered promiscuous mode [ 151.630068][ T9556] syzkaller0: entered allmulticast mode [ 151.637767][ T9560] netlink: 'syz.2.1078': attribute type 10 has an invalid length. [ 151.671437][ T9560] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 151.690524][ T9560] team0: Failed to send options change via netlink (err -105) [ 151.699094][ T9560] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 151.709824][ T9560] team0: Port device dummy0 removed [ 151.758900][ T9560] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 151.779056][ T9571] IPv6: sit1: Disabled Multicast RS [ 151.785653][ T9571] sit1: entered allmulticast mode [ 151.993766][ T9582] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1085'. [ 152.054811][ T9585] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 152.489338][ T9613] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 152.549982][ T50] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 152.620337][ T9620] netlink: 'syz.4.1096': attribute type 10 has an invalid length. [ 152.628532][ T9620] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1096'. [ 152.679012][ T9622] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1097'. [ 152.704387][ T9624] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1098'. [ 152.792602][ T9626] netlink: 'syz.0.1099': attribute type 10 has an invalid length. [ 152.801542][ T9626] bridge0: port 3(team0) entered disabled state [ 152.808311][ T9626] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.839556][ T9626] bridge0: port 3(team0) entered blocking state [ 152.846203][ T9626] bridge0: port 3(team0) entered forwarding state [ 152.852981][ T9626] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.860188][ T9626] bridge0: port 1(bridge_slave_0) entered forwarding state [ 152.874705][ T9626] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 152.959793][ T9635] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1102'. [ 153.268189][ T9650] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1109'. [ 153.371244][ T9653] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 153.393129][ T9655] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1111'. [ 153.396252][ T9650] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1109'. [ 153.913645][ T9692] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.1125'. [ 154.211704][ T9710] netlink: 'syz.0.1128': attribute type 10 has an invalid length. [ 154.221273][ T9710] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1128'. [ 154.317231][ T9716] Cannot find add_set index 0 as target [ 154.578109][ T9736] netlink: 'syz.3.1139': attribute type 32 has an invalid length. [ 154.692579][ T9742] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1141'. [ 155.054086][ T9761] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1145'. [ 155.064735][ T9761] openvswitch: netlink: Flow actions attr not present in new flow. [ 155.084103][ T9763] netlink: 'syz.1.1146': attribute type 10 has an invalid length. [ 155.119833][ T9766] netlink: 'syz.3.1148': attribute type 30 has an invalid length. [ 155.185373][ T9768] Timeout policy `syz1' can only be used by L3 protocol number 33011 [ 155.195450][ T9771] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 155.208840][ T9766] bond5: option arp_missed_max: invalid value (0) [ 155.215400][ T9766] bond5: option arp_missed_max: allowed values 1 - 255 [ 155.244225][ T9766] bond5 (unregistering): Released all slaves [ 155.286187][ T9777] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 155.321190][ T9773] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 155.539143][ T9792] netlink: 'syz.3.1156': attribute type 5 has an invalid length. [ 155.824899][ T9809] netlink: 'syz.4.1161': attribute type 32 has an invalid length. [ 155.828688][ T9810] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 155.980474][ T9813] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 155.994896][ T9813] bond1 (unregistering): Released all slaves [ 156.020656][ T9815] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 156.030809][ T9824] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 156.068566][ T9824] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 156.333592][ T9840] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 156.381921][ T9840] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 156.401226][ T9840] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 156.412123][ T9840] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 156.628440][ T9859] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 156.656953][ T9860] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 156.848866][ T9876] syzkaller0: entered promiscuous mode [ 156.854379][ T9876] syzkaller0: entered allmulticast mode [ 157.180804][ T9893] validate_nla: 2 callbacks suppressed [ 157.180821][ T9893] netlink: 'syz.4.1189': attribute type 10 has an invalid length. [ 157.199111][ T9893] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 157.410628][ T9908] lo speed is unknown, defaulting to 1000 [ 157.516282][ T9914] netlink: 'syz.4.1194': attribute type 1 has an invalid length. [ 157.647531][ T9917] netlink: 'syz.3.1195': attribute type 1 has an invalid length. [ 157.754451][ T9917] 8021q: adding VLAN 0 to HW filter on device bond5 [ 157.772728][ T9927] __nla_validate_parse: 19 callbacks suppressed [ 157.772746][ T9927] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1198'. [ 157.811713][ T9908] wg1 speed is unknown, defaulting to 1000 [ 157.922899][ T9936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1200'. [ 157.935720][ T9936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1200'. [ 157.987810][ T9939] netlink: 'syz.1.1199': attribute type 1 has an invalid length. [ 158.123625][ T9945] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1203'. [ 158.131293][ T9944] bond1: (slave gretap1): making interface the new active one [ 158.153895][ T9944] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 158.403421][ T9958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1209'. [ 158.920120][ T9978] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 158.951149][ T9983] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1220'. [ 158.957501][ T9978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1218'. [ 158.967755][ T9981] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1215'. [ 158.984402][ T9978] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1218'. [ 159.016105][ T9985] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 159.019314][ T9978] netlink: 'syz.3.1218': attribute type 15 has an invalid length. [ 159.467426][T10014] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 159.662125][T10031] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 159.673652][T10027] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 160.349665][ T117] lo speed is unknown, defaulting to 1000 [ 160.379846][ T117] sz1: Port: 1 Link DOWN [ 160.389634][T10058] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1245'. [ 160.426027][ T117] lo speed is unknown, defaulting to 1000 [ 160.733551][T10086] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 160.920454][T10106] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 161.254001][T10134] netlink: 'syz.0.1269': attribute type 1 has an invalid length. [ 161.312288][T10140] xt_nat: multiple ranges no longer supported [ 161.384959][T10144] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 161.599856][T10152] netlink: 'syz.0.1275': attribute type 1 has an invalid length. [ 161.774714][T10163] netlink: 'syz.2.1279': attribute type 21 has an invalid length. [ 161.952679][T10174] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 161.953567][T10172] gretap0: entered promiscuous mode [ 161.966704][T10172] vlan3: entered promiscuous mode [ 162.030886][T10170] tunl0: entered promiscuous mode [ 162.036348][T10170] netlink: 'syz.2.1283': attribute type 3 has an invalid length. [ 162.453041][T10199] tipc: Enabled bearer , priority 0 [ 162.474642][T10199] syzkaller0: entered promiscuous mode [ 162.480558][T10199] syzkaller0: entered allmulticast mode [ 162.510725][T10205] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 162.556444][T10205] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 162.582371][T10199] tipc: Resetting bearer [ 162.618417][T10198] tipc: Resetting bearer [ 162.667155][T10198] tipc: Disabling bearer [ 162.856876][T10223] syzkaller0: entered promiscuous mode [ 162.862969][T10225] __nla_validate_parse: 13 callbacks suppressed [ 162.862985][T10225] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1300'. [ 162.878696][T10223] syzkaller0: entered allmulticast mode [ 162.887121][T10223] netlink: 'syz.2.1299': attribute type 10 has an invalid length. [ 162.905636][T10223] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 162.929720][T10223] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 163.009037][T10236] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1304'. [ 163.145645][T10244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1307'. [ 163.201333][T10246] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1309'. [ 163.252709][T10250] xt_TCPMSS: Only works on TCP SYN packets [ 163.286595][T10251] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1308'. [ 163.401484][T10257] dvmrp1: entered allmulticast mode [ 163.409131][T10261] netlink: 'syz.1.1315': attribute type 23 has an invalid length. [ 163.483103][T10267] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1312'. [ 163.503033][T10267] netlink: 43 bytes leftover after parsing attributes in process `syz.0.1312'. [ 163.541937][T10267] netlink: 43 bytes leftover after parsing attributes in process `syz.0.1312'. [ 163.572881][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.605019][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.729688][T10276] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1320'. [ 163.743541][T10277] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 163.782412][T10279] netlink: 412 bytes leftover after parsing attributes in process `syz.3.1321'. [ 163.807022][T10276] tipc: Enabled bearer , priority 0 [ 163.830833][T10276] tipc: Resetting bearer [ 163.841275][T10276] sch_tbf: burst 127 is lower than device bridge2 mtu (1514) ! [ 164.042164][T10296] netlink: 'syz.2.1327': attribute type 2 has an invalid length. [ 164.296523][T10315] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 164.389968][T10320] nbd: must specify a size in bytes for the device [ 164.756613][ T7972] wg1 speed is unknown, defaulting to 1000 [ 165.127390][T10359] tipc: Enabled bearer , priority 0 [ 165.139043][T10359] veth0_to_team: entered allmulticast mode [ 165.244380][T10363] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 165.265186][T10354] tipc: Disabling bearer [ 165.565117][T10385] netlink: 'syz.4.1359': attribute type 22 has an invalid length. [ 165.983095][T10419] netlink: 'syz.3.1364': attribute type 10 has an invalid length. [ 165.993285][T10419] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.001010][T10419] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.078253][T10419] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.085586][T10419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.093138][T10419] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.100361][T10419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.122472][T10419] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 166.172299][T10428] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 166.211334][T10429] bond2: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 166.227263][T10429] bond2 (unregistering): Released all slaves [ 166.682111][T10455] netlink: 'syz.0.1378': attribute type 1 has an invalid length. [ 166.709965][T10455] bond7 (unregistering): Released all slaves [ 166.806281][T10457] ip6tnl2: entered promiscuous mode [ 166.823178][T10457] ip6tnl2: entered allmulticast mode [ 166.865211][T10459] lo: entered allmulticast mode [ 166.883130][T10463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 166.914194][T10463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 166.935683][T10466] netlink: 'syz.2.1382': attribute type 11 has an invalid length. [ 167.074844][T10474] wg2: entered promiscuous mode [ 167.090674][T10474] wg2: entered allmulticast mode [ 167.333576][T10496] netlink: 'syz.4.1391': attribute type 1 has an invalid length. [ 167.473051][T10502] 8021q: adding VLAN 0 to HW filter on device bond3 [ 167.483915][T10502] bond2: (slave bond3): making interface the new active one [ 167.494676][T10502] bond2: (slave bond3): Enslaving as an active interface with an up link [ 167.550892][T10496] bond2: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 167.563766][T10496] bond2: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 167.862409][T10522] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 167.887856][T10524] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 167.901363][T10524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 167.934587][T10528] geneve3: entered promiscuous mode [ 167.985172][T10534] __nla_validate_parse: 18 callbacks suppressed [ 167.985189][T10534] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1405'. [ 168.002059][T10528] geneve3: entered allmulticast mode [ 168.017350][ T3507] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 168.033652][ T3507] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 168.071221][ T3507] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 168.072506][T10541] xt_TCPMSS: Only works on TCP SYN packets [ 168.096025][ T3507] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 168.149487][T10531] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.163669][T10531] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 168.340717][T10531] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.357317][T10531] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 168.378898][T10558] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1412'. [ 168.526446][T10531] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.544181][T10531] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 168.605600][T10557] netlink: 'syz.1.1411': attribute type 4 has an invalid length. [ 168.680186][T10531] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.705733][T10531] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 168.725227][T10580] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 168.808429][T10585] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1419'. [ 168.882046][T10588] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1417'. [ 168.917491][T10588] veth7: entered allmulticast mode [ 168.958784][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 168.971052][ T12] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 169.113948][T10604] netlink: 'syz.3.1426': attribute type 1 has an invalid length. [ 169.156706][ T3507] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 169.167486][ T3507] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 169.183190][T10604] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 169.192213][T10605] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 169.229809][ T69] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 169.258346][ T69] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 169.298419][ T3507] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 169.312397][ T3507] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 169.322289][T10620] tipc: Enabled bearer , priority 0 [ 169.343023][T10618] syzkaller0: entered promiscuous mode [ 169.370182][T10618] syzkaller0: entered allmulticast mode [ 169.380609][T10624] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 169.416270][T10625] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1430'. [ 169.462573][T10618] tipc: Resetting bearer [ 169.525280][T10634] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1434'. [ 169.536164][T10618] tipc: Disabling bearer [ 169.588746][T10630] bond2: invalid ARP target 0.0.0.0 specified for addition [ 169.601319][T10630] bond2: option arp_ip_target: invalid value (0) [ 169.613400][T10630] bond2 (unregistering): Released all slaves [ 170.154244][T10680] Bluetooth: MGMT ver 1.23 [ 170.218637][T10683] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1447'. [ 170.254387][T10685] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1445'. [ 170.328483][T10690] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1446'. [ 170.392771][T10695] netlink: 'syz.4.1450': attribute type 1 has an invalid length. [ 170.431958][T10695] bond4: entered promiscuous mode [ 170.437922][T10695] 8021q: adding VLAN 0 to HW filter on device bond4 [ 170.463489][T10695] bond4: (slave bridge3): making interface the new active one [ 170.472206][T10695] bridge3: entered promiscuous mode [ 170.479193][T10695] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 170.494754][T10695] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1450'. [ 170.619641][T10708] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 171.234615][T10759] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 171.244838][T10756] Cannot find add_set index 65532 as target [ 171.347229][T10763] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 171.398159][T10765] FAULT_INJECTION: forcing a failure. [ 171.398159][T10765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 171.413401][T10765] CPU: 0 UID: 0 PID: 10765 Comm: syz.1.1474 Not tainted syzkaller #0 PREEMPT(full) [ 171.413425][T10765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 171.413435][T10765] Call Trace: [ 171.413442][T10765] [ 171.413449][T10765] dump_stack_lvl+0x189/0x250 [ 171.413477][T10765] ? __pfx____ratelimit+0x10/0x10 [ 171.413500][T10765] ? __pfx_dump_stack_lvl+0x10/0x10 [ 171.413522][T10765] ? __pfx__printk+0x10/0x10 [ 171.413540][T10765] ? __might_fault+0xb0/0x130 [ 171.413581][T10765] should_fail_ex+0x414/0x560 [ 171.413611][T10765] _copy_from_user+0x2d/0xb0 [ 171.413632][T10765] ___sys_sendmsg+0x158/0x2a0 [ 171.413654][T10765] ? __pfx____sys_sendmsg+0x10/0x10 [ 171.413709][T10765] ? __fget_files+0x2a/0x420 [ 171.413724][T10765] ? __fget_files+0x3a0/0x420 [ 171.413751][T10765] __x64_sys_sendmsg+0x19b/0x260 [ 171.413773][T10765] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 171.413801][T10765] ? __pfx_ksys_write+0x10/0x10 [ 171.413828][T10765] ? do_syscall_64+0xbe/0xfa0 [ 171.413854][T10765] do_syscall_64+0xfa/0xfa0 [ 171.413874][T10765] ? lockdep_hardirqs_on+0x9c/0x150 [ 171.413897][T10765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.413914][T10765] ? clear_bhb_loop+0x60/0xb0 [ 171.413934][T10765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.413951][T10765] RIP: 0033:0x7f9ed6b8f6c9 [ 171.413967][T10765] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.413980][T10765] RSP: 002b:00007f9ed7a37038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 171.413999][T10765] RAX: ffffffffffffffda RBX: 00007f9ed6de5fa0 RCX: 00007f9ed6b8f6c9 [ 171.414012][T10765] RDX: 0000000000004010 RSI: 0000200000000280 RDI: 0000000000000005 [ 171.414023][T10765] RBP: 00007f9ed7a37090 R08: 0000000000000000 R09: 0000000000000000 [ 171.414034][T10765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 171.414044][T10765] R13: 00007f9ed6de6038 R14: 00007f9ed6de5fa0 R15: 00007ffd240ae618 [ 171.414075][T10765] [ 171.829043][T10784] tipc: Resetting bearer [ 171.950247][T10785] tipc: Resetting bearer [ 171.986889][ T13] tipc: Resetting bearer [ 172.489430][T10823] netlink: 'syz.2.1497': attribute type 1 has an invalid length. [ 172.503119][T10823] netlink: 'syz.2.1497': attribute type 1 has an invalid length. [ 172.554024][T10830] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 172.732165][T10836] netlink: 'syz.3.1501': attribute type 23 has an invalid length. [ 172.743567][T10840] Cannot find set identified by id 4 to match [ 173.017815][T10867] __nla_validate_parse: 12 callbacks suppressed [ 173.017833][T10867] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1510'. [ 173.054285][T10867] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 173.124372][T10877] lo: entered allmulticast mode [ 173.564688][T10900] bridge0: port 3(veth0_to_bridge) entered blocking state [ 173.581058][T10900] bridge0: port 3(veth0_to_bridge) entered disabled state [ 173.616322][T10900] veth0_to_bridge: entered allmulticast mode [ 173.631210][T10900] veth0_to_bridge: entered promiscuous mode [ 173.678421][T10905] syzkaller0: entered promiscuous mode [ 173.683936][T10905] syzkaller0: entered allmulticast mode [ 173.754666][T10911] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1523'. [ 174.234026][T10930] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1530'. [ 174.253807][T10930] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 174.261472][T10930] IPv6: NLM_F_CREATE should be set when creating new route [ 174.388993][T10939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1533'. [ 174.405727][T10943] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1535'. [ 174.444493][T10946] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1536'. [ 174.476623][T10946] unsupported nlmsg_type 40 [ 174.488508][T10946] openvswitch: netlink: IP tunnel dst address not specified [ 174.565927][T10954] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1538'. [ 174.649509][T10954] FAULT_INJECTION: forcing a failure. [ 174.649509][T10954] name failslab, interval 1, probability 0, space 0, times 0 [ 174.670711][T10963] netlink: 'syz.0.1540': attribute type 10 has an invalid length. [ 174.679329][T10954] CPU: 1 UID: 0 PID: 10954 Comm: syz.1.1538 Not tainted syzkaller #0 PREEMPT(full) [ 174.679353][T10954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 174.679364][T10954] Call Trace: [ 174.679372][T10954] [ 174.679379][T10954] dump_stack_lvl+0x189/0x250 [ 174.679411][T10954] ? __pfx____ratelimit+0x10/0x10 [ 174.679434][T10954] ? __pfx_dump_stack_lvl+0x10/0x10 [ 174.679454][T10954] ? __pfx__printk+0x10/0x10 [ 174.679475][T10954] ? __lock_acquire+0xab9/0xd20 [ 174.679499][T10954] should_fail_ex+0x414/0x560 [ 174.679529][T10954] should_failslab+0xa8/0x100 [ 174.679549][T10954] kmem_cache_alloc_noprof+0x74/0x6e0 [ 174.679572][T10954] ? skb_clone+0x212/0x3a0 [ 174.679596][T10954] skb_clone+0x212/0x3a0 [ 174.679619][T10954] __netlink_deliver_tap+0x404/0x850 [ 174.679650][T10954] ? netlink_deliver_tap+0x2e/0x1b0 [ 174.679669][T10954] netlink_deliver_tap+0x19c/0x1b0 [ 174.679687][T10954] netlink_unicast+0x7fa/0x9e0 [ 174.679720][T10954] ? __pfx_netlink_unicast+0x10/0x10 [ 174.679745][T10954] ? netlink_sendmsg+0x642/0xb30 [ 174.679760][T10954] ? skb_put+0x11b/0x210 [ 174.679781][T10954] netlink_sendmsg+0x805/0xb30 [ 174.679808][T10954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 174.679829][T10954] ? aa_sock_msg_perm+0xf1/0x1d0 [ 174.679854][T10954] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 174.679872][T10954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 174.679890][T10954] __sock_sendmsg+0x21c/0x270 [ 174.679916][T10954] ____sys_sendmsg+0x505/0x830 [ 174.679940][T10954] ? __pfx_____sys_sendmsg+0x10/0x10 [ 174.679969][T10954] ? import_iovec+0x74/0xa0 [ 174.679994][T10954] ___sys_sendmsg+0x21f/0x2a0 [ 174.680016][T10954] ? __pfx____sys_sendmsg+0x10/0x10 [ 174.680079][T10954] ? __fget_files+0x2a/0x420 [ 174.680095][T10954] ? __fget_files+0x3a0/0x420 [ 174.680127][T10954] __x64_sys_sendmsg+0x19b/0x260 [ 174.680148][T10954] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 174.680177][T10954] ? __pfx_ksys_write+0x10/0x10 [ 174.680205][T10954] ? do_syscall_64+0xbe/0xfa0 [ 174.680231][T10954] do_syscall_64+0xfa/0xfa0 [ 174.680252][T10954] ? lockdep_hardirqs_on+0x9c/0x150 [ 174.680274][T10954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.680292][T10954] ? clear_bhb_loop+0x60/0xb0 [ 174.680312][T10954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.680329][T10954] RIP: 0033:0x7f9ed6b8f6c9 [ 174.680345][T10954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 174.680359][T10954] RSP: 002b:00007f9ed7a37038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 174.680379][T10954] RAX: ffffffffffffffda RBX: 00007f9ed6de5fa0 RCX: 00007f9ed6b8f6c9 [ 174.680392][T10954] RDX: 0000000000004010 RSI: 0000200000000280 RDI: 0000000000000005 [ 174.680403][T10954] RBP: 00007f9ed7a37090 R08: 0000000000000000 R09: 0000000000000000 [ 174.680414][T10954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.680424][T10954] R13: 00007f9ed6de6038 R14: 00007f9ed6de5fa0 R15: 00007ffd240ae618 [ 174.680456][T10954] [ 175.003274][T10965] netlink: 'syz.0.1540': attribute type 10 has an invalid length. [ 175.041240][T10963] dummy0: entered promiscuous mode [ 175.048382][T10963] dummy0: entered allmulticast mode [ 175.054470][T10963] team0: Failed to send options change via netlink (err -105) [ 175.062234][T10963] team0: Port device dummy0 added [ 175.068985][T10965] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 175.093943][T10965] dummy0: left promiscuous mode [ 175.117957][T10976] netlink: 'syz.4.1545': attribute type 1 has an invalid length. [ 175.131788][T10965] dummy0: left allmulticast mode [ 175.159129][T10965] team0: Failed to send options change via netlink (err -105) [ 175.174731][T10965] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 175.202402][T10981] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.1547'. [ 175.204509][T10963] xt_CT: No such helper "syz1" [ 175.214253][T10965] team0: Port device dummy0 removed [ 175.227068][T10965] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 175.415083][T10990] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1549'. [ 175.425093][T10990] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1549'. [ 175.485487][T10992] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 175.583437][T11000] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 175.591560][T11001] netlink: 'syz.2.1553': attribute type 15 has an invalid length. [ 175.649045][ T3507] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 175.651361][T11001] netlink: 'syz.2.1553': attribute type 15 has an invalid length. [ 175.667940][T10998] FAULT_INJECTION: forcing a failure. [ 175.667940][T10998] name failslab, interval 1, probability 0, space 0, times 0 [ 175.674244][ T3507] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 175.681625][T10998] CPU: 1 UID: 0 PID: 10998 Comm: syz.0.1554 Not tainted syzkaller #0 PREEMPT(full) [ 175.681647][T10998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 175.681657][T10998] Call Trace: [ 175.681665][T10998] [ 175.681674][T10998] dump_stack_lvl+0x189/0x250 [ 175.681700][T10998] ? __pfx____ratelimit+0x10/0x10 [ 175.681723][T10998] ? __pfx_dump_stack_lvl+0x10/0x10 [ 175.681743][T10998] ? __pfx__printk+0x10/0x10 [ 175.681767][T10998] ? __pfx___might_resched+0x10/0x10 [ 175.681789][T10998] should_fail_ex+0x414/0x560 [ 175.681818][T10998] should_failslab+0xa8/0x100 [ 175.681837][T10998] __kmalloc_cache_noprof+0x6f/0x6f0 [ 175.681861][T10998] ? tcf_chain_create+0xb0/0x310 [ 175.681884][T10998] tcf_chain_create+0xb0/0x310 [ 175.681906][T10998] __tcf_chain_get+0x111/0x3c0 [ 175.681933][T10998] tc_new_tfilter+0x753/0x15b0 [ 175.681961][T10998] ? __local_bh_enable_ip+0x12d/0x1c0 [ 175.681992][T10998] ? __pfx_tc_new_tfilter+0x10/0x10 [ 175.682007][T10998] ? __dev_queue_xmit+0x1d79/0x3b50 [ 175.682067][T10998] ? __pfx_tc_new_tfilter+0x10/0x10 [ 175.682084][T10998] rtnetlink_rcv_msg+0x7cf/0xb70 [ 175.682112][T10998] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 175.682134][T10998] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 175.682154][T10998] ? ref_tracker_free+0x63a/0x7d0 [ 175.682171][T10998] ? __asan_memcpy+0x40/0x70 [ 175.682193][T10998] ? __pfx_ref_tracker_free+0x10/0x10 [ 175.682219][T10998] netlink_rcv_skb+0x208/0x470 [ 175.682237][T10998] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 175.682261][T10998] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 175.682297][T10998] ? netlink_deliver_tap+0x2e/0x1b0 [ 175.682321][T10998] netlink_unicast+0x82f/0x9e0 [ 175.682351][T10998] ? __pfx_netlink_unicast+0x10/0x10 [ 175.682375][T10998] ? netlink_sendmsg+0x642/0xb30 [ 175.682389][T10998] ? skb_put+0x11b/0x210 [ 175.682409][T10998] netlink_sendmsg+0x805/0xb30 [ 175.682435][T10998] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.682454][T10998] ? aa_sock_msg_perm+0xf1/0x1d0 [ 175.682479][T10998] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 175.682496][T10998] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.682513][T10998] __sock_sendmsg+0x21c/0x270 [ 175.682537][T10998] ____sys_sendmsg+0x505/0x830 [ 175.682560][T10998] ? __pfx_____sys_sendmsg+0x10/0x10 [ 175.682588][T10998] ? import_iovec+0x74/0xa0 [ 175.682611][T10998] ___sys_sendmsg+0x21f/0x2a0 [ 175.682631][T10998] ? __pfx____sys_sendmsg+0x10/0x10 [ 175.682684][T10998] ? __fget_files+0x2a/0x420 [ 175.682699][T10998] ? __fget_files+0x3a0/0x420 [ 175.682724][T10998] __x64_sys_sendmsg+0x19b/0x260 [ 175.682744][T10998] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 175.682772][T10998] ? __pfx_ksys_write+0x10/0x10 [ 175.682798][T10998] ? do_syscall_64+0xbe/0xfa0 [ 175.682823][T10998] do_syscall_64+0xfa/0xfa0 [ 175.682843][T10998] ? lockdep_hardirqs_on+0x9c/0x150 [ 175.682864][T10998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.682881][T10998] ? clear_bhb_loop+0x60/0xb0 [ 175.682901][T10998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.682917][T10998] RIP: 0033:0x7f040c98f6c9 [ 175.682932][T10998] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 175.682947][T10998] RSP: 002b:00007f040d8a3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 175.682965][T10998] RAX: ffffffffffffffda RBX: 00007f040cbe5fa0 RCX: 00007f040c98f6c9 [ 175.682977][T10998] RDX: 0000000000004010 RSI: 0000200000000280 RDI: 0000000000000005 [ 175.682988][T10998] RBP: 00007f040d8a3090 R08: 0000000000000000 R09: 0000000000000000 [ 175.682998][T10998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 175.683008][T10998] R13: 00007f040cbe6038 R14: 00007f040cbe5fa0 R15: 00007ffeeca1bc28 [ 175.683048][T10998] [ 176.061145][ T3507] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 176.082489][ T3507] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 176.114436][ T3507] ------------[ cut here ]------------ [ 176.120208][ T3507] wlan1: Dropped data frame as no usable bitrate found while scanning and associated. Target station: 08:02:11:00:00:00 on 5 GHz band [ 176.134763][ T3507] WARNING: CPU: 1 PID: 3507 at net/mac80211/tx.c:758 ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.144813][ T3507] Modules linked in: [ 176.149022][ T3507] CPU: 1 UID: 0 PID: 3507 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 176.158509][ T3507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 176.168633][ T3507] Workqueue: events_unbound cfg80211_wiphy_work [ 176.174897][ T3507] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.181387][ T3507] Code: 31 f6 83 e6 07 41 0f 95 c6 31 ff e8 70 9f fa f6 43 8d 0c 76 83 c1 02 48 c7 c7 60 b9 89 8c 48 89 de 4c 89 e2 e8 17 b5 bd f6 90 <0f> 0b 90 90 41 be 01 00 00 00 e9 92 03 00 00 e8 02 9b fa f6 e9 6f [ 176.201047][ T3507] RSP: 0018:ffffc9000c1573a0 EFLAGS: 00010246 [ 176.207169][ T3507] RAX: cc192082ee2e6b00 RBX: ffff8880583bd7c8 RCX: ffff888030511e40 [ 176.215151][ T3507] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 176.223174][ T3507] RBP: ffffc9000c157508 R08: 0000000000000003 R09: 0000000000000004 [ 176.231188][ T3507] R10: dffffc0000000000 R11: fffffbfff1bba680 R12: ffff88806bc16dc4 [ 176.239227][ T3507] R13: 1ffff9200182ae88 R14: 0000000000000001 R15: dffffc0000000000 [ 176.247239][ T3507] FS: 0000000000000000(0000) GS:ffff88812623b000(0000) knlGS:0000000000000000 [ 176.256231][ T3507] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 176.262825][ T3507] CR2: 00002000000012c0 CR3: 000000000dd38000 CR4: 00000000003526f0 [ 176.270835][ T3507] Call Trace: [ 176.274121][ T3507] [ 176.277095][ T3507] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 176.283180][ T3507] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 176.289398][ T3507] invoke_tx_handlers_late+0xba/0x18a0 [ 176.294884][ T3507] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 176.300748][ T3507] ieee80211_tx+0x2ac/0x460 [ 176.305266][ T3507] ? __pfx_ieee80211_tx+0x10/0x10 [ 176.310380][ T3507] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 176.316395][ T3507] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 176.322228][ T3507] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 176.328619][ T3507] ieee80211_scan_state_send_probe+0x594/0xa00 [ 176.334815][ T3507] ieee80211_scan_work+0x65f/0x1c50 [ 176.340105][ T3507] cfg80211_wiphy_work+0x2bb/0x470 [ 176.345244][ T3507] ? process_scheduled_works+0x9ef/0x17b0 [ 176.351034][ T3507] process_scheduled_works+0xae1/0x17b0 [ 176.356648][ T3507] ? __pfx_process_scheduled_works+0x10/0x10 [ 176.362661][ T3507] worker_thread+0x8a0/0xda0 [ 176.367322][ T3507] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 176.373689][ T3507] ? __kthread_parkme+0x7b/0x200 [ 176.378702][ T3507] kthread+0x711/0x8a0 [ 176.382791][ T3507] ? __pfx_worker_thread+0x10/0x10 [ 176.387989][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.392597][ T3507] ? _raw_spin_unlock_irq+0x23/0x50 [ 176.397863][ T3507] ? lockdep_hardirqs_on+0x9c/0x150 [ 176.403072][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.407723][ T3507] ret_from_fork+0x4bc/0x870 [ 176.412326][ T3507] ? __pfx_ret_from_fork+0x10/0x10 [ 176.417513][ T3507] ? __switch_to_asm+0x39/0x70 [ 176.422290][ T3507] ? __switch_to_asm+0x33/0x70 [ 176.427119][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.431737][ T3507] ret_from_fork_asm+0x1a/0x30 [ 176.436559][ T3507] [ 176.439587][ T3507] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 176.446872][ T3507] CPU: 1 UID: 0 PID: 3507 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 176.456323][ T3507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 176.466374][ T3507] Workqueue: events_unbound cfg80211_wiphy_work [ 176.472614][ T3507] Call Trace: [ 176.475884][ T3507] [ 176.478803][ T3507] dump_stack_lvl+0x99/0x250 [ 176.483383][ T3507] ? __asan_memcpy+0x40/0x70 [ 176.487966][ T3507] ? __pfx_dump_stack_lvl+0x10/0x10 [ 176.493173][ T3507] ? __pfx__printk+0x10/0x10 [ 176.498211][ T3507] vpanic+0x237/0x6d0 [ 176.502200][ T3507] ? __pfx_vpanic+0x10/0x10 [ 176.506740][ T3507] panic+0xb9/0xc0 [ 176.510456][ T3507] ? __pfx_panic+0x10/0x10 [ 176.514878][ T3507] __warn+0x31b/0x4b0 [ 176.518871][ T3507] ? ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.524684][ T3507] ? ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.530484][ T3507] report_bug+0x2be/0x4f0 [ 176.534813][ T3507] ? ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.540607][ T3507] ? ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.546402][ T3507] ? ieee80211_tx_h_rate_ctrl+0xc4c/0x1750 [ 176.552202][ T3507] handle_bug+0x84/0x160 [ 176.556436][ T3507] exc_invalid_op+0x1a/0x50 [ 176.560928][ T3507] asm_exc_invalid_op+0x1a/0x20 [ 176.565765][ T3507] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc4a/0x1750 [ 176.572177][ T3507] Code: 31 f6 83 e6 07 41 0f 95 c6 31 ff e8 70 9f fa f6 43 8d 0c 76 83 c1 02 48 c7 c7 60 b9 89 8c 48 89 de 4c 89 e2 e8 17 b5 bd f6 90 <0f> 0b 90 90 41 be 01 00 00 00 e9 92 03 00 00 e8 02 9b fa f6 e9 6f [ 176.591774][ T3507] RSP: 0018:ffffc9000c1573a0 EFLAGS: 00010246 [ 176.597837][ T3507] RAX: cc192082ee2e6b00 RBX: ffff8880583bd7c8 RCX: ffff888030511e40 [ 176.605797][ T3507] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 176.613763][ T3507] RBP: ffffc9000c157508 R08: 0000000000000003 R09: 0000000000000004 [ 176.621718][ T3507] R10: dffffc0000000000 R11: fffffbfff1bba680 R12: ffff88806bc16dc4 [ 176.629678][ T3507] R13: 1ffff9200182ae88 R14: 0000000000000001 R15: dffffc0000000000 [ 176.637672][ T3507] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 176.643739][ T3507] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 176.649888][ T3507] invoke_tx_handlers_late+0xba/0x18a0 [ 176.655342][ T3507] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 176.661144][ T3507] ieee80211_tx+0x2ac/0x460 [ 176.665645][ T3507] ? __pfx_ieee80211_tx+0x10/0x10 [ 176.670760][ T3507] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 176.676728][ T3507] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 176.682526][ T3507] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 176.688842][ T3507] ieee80211_scan_state_send_probe+0x594/0xa00 [ 176.695011][ T3507] ieee80211_scan_work+0x65f/0x1c50 [ 176.700219][ T3507] cfg80211_wiphy_work+0x2bb/0x470 [ 176.705321][ T3507] ? process_scheduled_works+0x9ef/0x17b0 [ 176.711031][ T3507] process_scheduled_works+0xae1/0x17b0 [ 176.716586][ T3507] ? __pfx_process_scheduled_works+0x10/0x10 [ 176.722565][ T3507] worker_thread+0x8a0/0xda0 [ 176.727267][ T3507] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 176.733596][ T3507] ? __kthread_parkme+0x7b/0x200 [ 176.738531][ T3507] kthread+0x711/0x8a0 [ 176.742597][ T3507] ? __pfx_worker_thread+0x10/0x10 [ 176.747698][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.752280][ T3507] ? _raw_spin_unlock_irq+0x23/0x50 [ 176.757467][ T3507] ? lockdep_hardirqs_on+0x9c/0x150 [ 176.762653][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.767235][ T3507] ret_from_fork+0x4bc/0x870 [ 176.771814][ T3507] ? __pfx_ret_from_fork+0x10/0x10 [ 176.776920][ T3507] ? __switch_to_asm+0x39/0x70 [ 176.781669][ T3507] ? __switch_to_asm+0x33/0x70 [ 176.786414][ T3507] ? __pfx_kthread+0x10/0x10 [ 176.791028][ T3507] ret_from_fork_asm+0x1a/0x30 [ 176.795797][ T3507] [ 176.799080][ T3507] Kernel Offset: disabled [ 176.803390][ T3507] Rebooting in 86400 seconds..